My PC comes with XP Service Pack 2. However it still got Winfixer popups. I did all the scan and clean procedure required by the board. Here is the Ewido log and HJT log.
Thank you for your help. I look forward to your response.
hyshi
--------------------------------- Ewido log ---------------------------------------
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 6:21:47 PM, 11/22/2005
+ Report-Checksum: 28B15DC
+ Scan result:
HKU\S-1-5-21-766659268-3655945277-336054478-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{26E8361F-BCE7-4F75-A347-98C88B418322} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-766659268-3655945277-336054478-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{56A7DC70-E102-4408-A34A-AE06FEF01586} -> Spyware.HDTBar : Cleaned with backup
HKU\S-1-5-21-766659268-3655945277-336054478-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87067F04-DE4C-4688-BC3C-4FCF39D609E7} -> Spyware.WebSearch : Cleaned with backup
HKU\S-1-5-21-766659268-3655945277-336054478-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DDFFA75A-E81D-4454-89FC-B9FD0631E726} -> Spyware.VX2 : Cleaned with backup
HKU\S-1-5-21-766659268-3655945277-336054478-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E0CE16CB-741C-4B24-8D04-A817856E07F4} -> Spyware.Roimoi : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
C:\WINDOWS\system32\ddayy.dll -> Spyware.Virtumonde : Cleaned with backup
C:\WINDOWS\system32\gebcb.dll -> TrojanDownloader.Agent.yf : Cleaned with backup
C:\WINDOWS\system32\pmkhg.dll -> TrojanDownloader.Agent.yf : Cleaned with backup
C:\WINDOWS\system32\pmkhi.dll -> TrojanDownloader.Agent.yf : Cleaned with backup
:mozilla.15:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.16:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.18:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.22:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.24:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.25:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.26:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.27:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.28:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.29:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.30:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.33:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.35:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.36:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.37:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.38:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.39:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.40:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.41:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.42:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.43:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.44:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.46:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.49:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.50:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.60:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.61:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.62:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.63:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.65:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.68:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.71:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.72:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.84:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.85:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.86:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.87:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.88:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.89:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.90:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.91:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.92:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.93:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.94:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.95:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.96:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.97:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.98:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.99:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.100:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.101:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.102:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.103:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.104:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.129:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.130:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.131:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.133:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.137:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.152:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.157:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.158:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.159:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.160:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.161:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.162:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.163:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.180:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.181:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.226:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.227:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.228:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.229:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.230:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.231:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.232:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.233:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.235:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.236:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.237:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.238:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.239:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.240:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.241:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.242:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.243:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.244:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.245:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.246:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.247:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.248:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.249:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.250:F:\email\netscape\yue\9n34bti7.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
::Report End
====================================================================
**************************** HJT log *****************************************************
Logfile of HijackThis v1.99.1
Scan saved at 10:37:27 AM, on 11/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterMute\PopSubtract\PopSub.exe
C:\Program Files\InterMute\SpySubtract\spysub.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\spywarekiller\ewido\security suite\ewidoctrl.exe
C:\Program Files\spywarekiller\ewido\security suite\ewidoguard.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\HJT\HijackThis.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\spywarekiller\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\ddayy.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\spywarekiller\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\InterMute\PopSubtract\PopSub.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\spysub.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Joyo - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\PROGRA~1\JinShan\XDict\IEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PowerWord - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\JinShan\XDict\IEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O15 - Trusted Zone: http://free.aol.com
O16 - DPF: {59CCB4A0-727D-11CF-AC36-00AA00A47DD2} (Timer Object) - http://www.xintv.com...oad/ietimer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1098329103156
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius....tiveXPlugin.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} (cGameControl Class) - http://zone.msn.com/.../RumbleCube.cab
O20 - Winlogon Notify: ddayy - C:\WINDOWS\system32\ddayy.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\spywarekiller\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\spywarekiller\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe