TheTechGuide Forum

General Category => Tech Clinic => Topic started by: snaggles on June 27, 2005, 03:52:01 PM

Title: Win32.P2P-Worm.Alcan.a
Post by: snaggles on June 27, 2005, 03:52:01 PM

Hey all, I am having the same problem as Daniel earlier posted.

I believe i got this worm front lime wire also.

I have copied in the log of HiJack

Logfile of HijackThis v1.99.1
Scan saved at 21:33:58, on 27/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\JOHNBR~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.yahoo.com/config/mail?.intl=au (http://\"http://login.yahoo.com/config/mail?.intl=au\")
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - Startup: Anapod Manager.lnk = C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm021YYGB (http://\"http://bar.mywebsearch.com/menusearch.html?p=ZUxdm021YYGB\")
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409 (http://\"http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409\")
O16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://us.dl1.yimg.com/download.yahoo.com/...bt/yregucfg.cab (http://\"http://us.dl1.yimg.com/download.yahoo.com/dl/installs/bt/yregucfg.cab\")
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab (http://\"http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab\")
O18 - Protocol: bw+0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

Can someone help me please.
I run adaware which it finds and deletes every time but it reappears.

snaggles

Title: Win32.P2P-Worm.Alcan.a
Post by: Hugewally on June 27, 2005, 05:39:10 PM

Had the same problem (Win32.P2P-Worm.Alcan.a) but have since fixed the problem.

I used the steps from the thread below and it seems to have worked. have completed multiple Ad-Aware Se scans and nothing has been found. Also task manager and regedit.exe now work too.

http://www.thetechguide.com/forum/index.ph...=18075&hl=alcan (http://\"http://www.thetechguide.com/forum/index.php?showtopic=18075&hl=alcan\")

I saved the thread as a .mht file on my desktop so i could read it while in safe mode, etc.

Also I noticed two new folders in my computer that had tons and I mean tons (3 Gb maybe?) of zip files that I hadn't downloaded. Have since deleted them, but of course, I forgot to recored their names. So you might want to search for a couple large folders (with lots of zip files) on your hard drivers too.


Martin

Title: Win32.P2P-Worm.Alcan.a
Post by: Guest on June 28, 2005, 03:23:17 PM

Hello,

I run adaware again and it has told me the worm is still there. I have attached the adaware scan log and the hijack it .

Someone help me! This is driving me nuts.

Ad-Aware SE Build 1.06r1
Logfile Created on:28 June 2005 21:05:31
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R51 21.06.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):6 total references
Tracking Cookie(TAC index:3):5 total references
Win32.P2P-Worm.Alcan.a(TAC index:8):1 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


28-06-2005 21:05:31 - Scan started. (Full System Scan)

 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\John Bradley\Application Data\microsoft\office\recent
    Description        : list of recently opened documents using microsoft office


 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\John Bradley\recent
    Description        : list of recently opened documents


 MRU List Object Recognized!
    Location:          : software\microsoft\directdraw\mostrecentapplication
    Description        : most recent application to use microsoft directdraw


 MRU List Object Recognized!
    Location:          : S-1-5-21-3592940346-2313388317-1811405697-1006\software\microsoft\internet explorer\typedurls
    Description        : list of recently entered addresses in microsoft internet explorer


 MRU List Object Recognized!
    Location:          : S-1-5-21-3592940346-2313388317-1811405697-1006\software\microsoft\search assistant\acmru
    Description        : list of recent search terms used with the search assistant


 MRU List Object Recognized!
    Location:          : S-1-5-21-3592940346-2313388317-1811405697-1006\software\microsoft\windows\currentversion\explorer\recentdocs
    Description        : list of recent documents opened


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
    FilePath           : \SystemRoot\System32\
    ProcessID          : 596
    ThreadCreationTime : 28-06-2005 06:18:46
    BasePriority       : Normal


#:2 [csrss.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 644
    ThreadCreationTime : 28-06-2005 06:18:48
    BasePriority       : Normal


#:3 [winlogon.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 668
    ThreadCreationTime : 28-06-2005 06:18:48
    BasePriority       : High


#:4 [services.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 712
    ThreadCreationTime : 28-06-2005 06:18:49
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Services and Controller app
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : services.exe

#:5 [lsass.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 724
    ThreadCreationTime : 28-06-2005 06:18:49
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe

#:6 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 912
    ThreadCreationTime : 28-06-2005 06:18:50
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:7 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 984
    ThreadCreationTime : 28-06-2005 06:18:50
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:8 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1140
    ThreadCreationTime : 28-06-2005 06:18:50
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:9 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1236
    ThreadCreationTime : 28-06-2005 06:18:50
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:10 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1348
    ThreadCreationTime : 28-06-2005 06:18:50
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:11 [lexbces.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1532
    ThreadCreationTime : 28-06-2005 06:18:51
    BasePriority       : Normal
    FileVersion        : 9.45
    ProductVersion     : 9.45
    ProductName        : MarkVision for Windows (32 bit)
    CompanyName        : Lexmark International, Inc.
    FileDescription    : LexBce Service
    InternalName       : LexBce Service
    LegalCopyright     : © 1993 - 2004 Lexmark International, Inc.
    OriginalFilename   : LexBceS.exe

#:12 [lexpps.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1560
    ThreadCreationTime : 28-06-2005 06:18:51
    BasePriority       : Normal
    FileVersion        : 9.45
    ProductVersion     : 9.45
    ProductName        : MarkVision for Windows (32 bit)
    CompanyName        : Lexmark International, Inc.
    FileDescription    : LEXPPS.EXE
    InternalName       : LEXPPS
    LegalCopyright     : © 1993 - 2004 Lexmark International, Inc.
    OriginalFilename   : LEXPPS.EXE
    Comments           : MarkVision for Windows '95 New P2P Server  (32-bit)

#:13 [spoolsv.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1568
    ThreadCreationTime : 28-06-2005 06:18:51
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Spooler SubSystem App
    InternalName       : spoolsv.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : spoolsv.exe

#:14 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1840
    ThreadCreationTime : 28-06-2005 06:18:52
    BasePriority       : Normal
    FileVersion        : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 6.00.2900.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Explorer
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : EXPLORER.EXE

#:15 [hkcmd.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 2004
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 3.0.0.4020
    ProductVersion     : 7.0.0.4020
    ProductName        : Intel® Common User Interface
    CompanyName        : Intel Corporation
    FileDescription    : hkcmd Module
    InternalName       : HKCMD
    LegalCopyright     : Copyright 1999-2004, Intel Corporation
    OriginalFilename   : HKCMD.EXE

#:16 [smax4pnp.exe]
    FilePath           : C:\Program Files\Analog Devices\Core\
    ProcessID          : 2012
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 5, 2, 0, 5
    ProductVersion     : 5, 2, 0, 5
    ProductName        : SMax4PNP Application
    CompanyName        : Analog Devices, Inc.
    FileDescription    : SMax4PNP MFC Application
    InternalName       : SMax4PNP
    LegalCopyright     : Copyright © 2002-2004 Analog Devices
    OriginalFilename   : SMax4PNP.EXE

#:17 [jusched.exe]
    FilePath           : C:\Program Files\Java\jre1.5.0_02\bin\
    ProcessID          : 2024
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal


#:18 [intelmem.exe]
    FilePath           : C:\Program Files\Intel\Modem Event Monitor\
    ProcessID          : 2036
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 0, 1, 0, 10
    ProductVersion     : 0, 1, 0, 10
    ProductName        : Intel Modem Event Monitor Application
    CompanyName        : Intel Corporation
    FileDescription    : Modem Event Monitor Application
    InternalName       : Modem Event Monitor
    LegalCopyright     : Copyright © 2003
    OriginalFilename   : IntelMEM.exe

#:19 [realplay.exe]
    FilePath           : C:\Program Files\Real\RealPlayer\
    ProcessID          : 2044
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 6.0.9.584
    ProductVersion     : 6.0.9.584
    ProductName        : RealPlayer (32-bit)
    CompanyName        : RealNetworks, Inc.
    FileDescription    : RealPlayer
    InternalName       : REALPLAY
    LegalCopyright     : Copyright © RealNetworks, Inc. 1995-2000
    LegalTrademarks    : RealAudio(tm) is a trademark of RealNetworks, Inc.
    OriginalFilename   : REALPLAY.EXE

#:20 [mcagent.exe]
    FilePath           : C:\PROGRA~1\mcafee.com\agent\
    ProcessID          : 140
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 5, 1, 0, 2
    ProductVersion     : 5, 1, 0, 0
    ProductName        : McAfee SecurityCenter
    CompanyName        : McAfee, Inc
    FileDescription    : McAfee SecurityCenter Agent
    InternalName       : mcagent
    LegalCopyright     : Copyright © 2005 McAfee, Inc.
    OriginalFilename   : mcagent.exe

#:21 [dmxlauncher.exe]
    FilePath           : C:\Program Files\Dell\Media Experience\
    ProcessID          : 168
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal


#:22 [mcvsshld.exe]
    FilePath           : C:\PROGRA~1\mcafee.com\vso\
    ProcessID          : 184
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 9, 1, 0, 6
    ProductVersion     : 9, 1, 0, 0
    ProductName        : McAfee VirusScan
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee VirusScan ActiveShield Resource
    InternalName       : msvcshld
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : mcvsshld.exe
    Comments           : McAfee VirusScan ActiveShield Resource

#:23 [mscifapp.exe]
    FilePath           : C:\PROGRA~1\mcafee.com\mps\
    ProcessID          : 216
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 7.1.1.46
    ProductVersion     : 7.1.1.46
    ProductName        : McAfee Privacy Service
    CompanyName        : McAfee, Inc
    FileDescription    : McAfee Privacy Service
    InternalName       : mscifapp
    LegalCopyright     : Copyright © 2005 McAfee, Inc.
    OriginalFilename   : mscifapp.exe

#:24 [mcvsescn.exe]
    FilePath           : c:\progra~1\mcafee.com\vso\
    ProcessID          : 224
    ThreadCreationTime : 28-06-2005 06:18:53
    BasePriority       : Normal
    FileVersion        : 9, 1, 0, 4
    ProductVersion     : 9, 1, 0, 0
    ProductName        : McAfee VirusScan
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee VirusScan E-mail Scan Module
    InternalName       : mcvsescn
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : mcvsescn.EXE
    Comments           : McAfee VirusScan E-mail Scan Module

#:25 [mskagent.exe]
    FilePath           : C:\PROGRA~1\McAfee\SPAMKI~1\
    ProcessID          : 260
    ThreadCreationTime : 28-06-2005 06:18:54
    BasePriority       : Normal
    FileVersion        : 6.1.0.6
    ProductVersion     : 6.1
    ProductName        : McAfee SpamKiller
    CompanyName        : McAfee Inc.
    FileDescription    : McAfee SpamKiller Agent Interface module
    InternalName       : MskAgent
    LegalCopyright     : Copyright © 1998-2005 McAfee, Inc.
    OriginalFilename   : MskAgent.exe

#:26 [point32.exe]
    FilePath           : C:\Program Files\Microsoft Hardware\Mouse\
    ProcessID          : 432
    ThreadCreationTime : 28-06-2005 06:18:54
    BasePriority       : Normal


#:27 [tfswctrl.exe]
    FilePath           : C:\WINDOWS\system32\dla\
    ProcessID          : 440
    ThreadCreationTime : 28-06-2005 06:18:54
    BasePriority       : Normal
    FileVersion        : 1.04.08a
    CompanyName        : Sonic Solutions
    FileDescription    : Drive Letter Access Component
    LegalCopyright     : Copyright © 2004 Sonic Solutions

#:28 [lvcomsx.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 464
    ThreadCreationTime : 28-06-2005 06:18:54
    BasePriority       : Normal
    FileVersion        : 8.4.1.1092
    ProductVersion     : 8.4.1.1092
    ProductName        : Logitech QuickCam
    CompanyName        : Logitech Inc.
    FileDescription    : LVCom Server
    InternalName       : LVComS.exe
    LegalCopyright     : © 1996-2004 Logitech.  All rights reserved.
    OriginalFilename   : LVComS.exe

#:29 [logitray.exe]
    FilePath           : C:\Program Files\Logitech\Video\
    ProcessID          : 524
    ThreadCreationTime : 28-06-2005 06:18:54
    BasePriority       : Normal
    FileVersion        : 8.4.1.1092
    ProductVersion     : 8.4.1.1092
    ProductName        : Logitech QuickCam
    CompanyName        : Logitech Inc.
    FileDescription    : ImageStudio Tray Application
    InternalName       : LogiTray.exe
    LegalCopyright     : © 1996-2004 Logitech.  All rights reserved.
    OriginalFilename   : LogiTray.exe

#:30 [msnappau.exe]
    FilePath           : C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\
    ProcessID          : 612
    ThreadCreationTime : 28-06-2005 06:18:55
    BasePriority       : Normal


#:31 [ituneshelper.exe]
    FilePath           : C:\Program Files\iTunes\
    ProcessID          : 648
    ThreadCreationTime : 28-06-2005 06:18:55
    BasePriority       : Normal
    FileVersion        : 4.8.0.31
    ProductVersion     : 4.8.0.31
    ProductName        : iTunes
    CompanyName        : Apple Computer, Inc.
    FileDescription    : iTunesHelper Module
    InternalName       : iTunesHelper
    LegalCopyright     : © 2003-2005 Apple Computer, Inc. All Rights Reserved.
    OriginalFilename   : iTunesHelper.exe

#:32 [mpftray.exe]
    FilePath           : C:\PROGRA~1\McAfee.com\PERSON~1\
    ProcessID          : 364
    ThreadCreationTime : 28-06-2005 06:18:55
    BasePriority       : Normal
    FileVersion        : 6.1.0.44
    ProductVersion     : 6.1.0.44
    ProductName        : McAfee Personal Firewall (MPF)
    CompanyName        : McAfee Security
    FileDescription    : McAfee Personal Firewall Tray Monitor
    InternalName       : MpfTray
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : MPFTRAY.EXE
    Comments           : Tray Icon for McAfee Personal Firewall

#:33 [dsagnt.exe]
    FilePath           : C:\Program Files\Dell Support\
    ProcessID          : 1076
    ThreadCreationTime : 28-06-2005 06:18:55
    BasePriority       : Below Normal
    FileVersion        : 1, 1, 0, 73
    ProductVersion     : 1, 1, 0, 73
    ProductName        : Dell Support
    CompanyName        : Gteko Ltd.
    FileDescription    : Dell Support
    InternalName       : AUAgent
    LegalCopyright     : Copyright © 2000 - 2004 Gteko Ltd.
    OriginalFilename   : AUAgent.exe

#:34 [ctfmon.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1168
    ThreadCreationTime : 28-06-2005 06:18:56
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : CTF Loader
    InternalName       : CTFMON
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : CTFMON.EXE

#:35 [fxsvr2.exe]
    FilePath           : C:\Program Files\Logitech\Video\
    ProcessID          : 1204
    ThreadCreationTime : 28-06-2005 06:18:56
    BasePriority       : Normal
    FileVersion        : 8.4.1.1092
    ProductVersion     : 8.4.1.1092
    ProductName        : Logitech QuickCam
    CompanyName        : Logitech Inc.
    FileDescription    : QuickCam Framework Server
    InternalName       : FxSvr.EXE
    LegalCopyright     : © 1996-2004 Logitech.  All rights reserved.
    OriginalFilename   : FxSvr.EXE

#:36 [msnmsgr.exe]
    FilePath           : C:\Program Files\MSN Messenger\
    ProcessID          : 1324
    ThreadCreationTime : 28-06-2005 06:18:57
    BasePriority       : Normal
    FileVersion        : 7.0.0813
    ProductVersion     : 7.0.0813
    ProductName        : MSN Messenger
    CompanyName        : Microsoft Corporation
    FileDescription    : MSN Messenger
    InternalName       : msnmsgr
    LegalCopyright     : Copyright © Microsoft Corporation 1997-2005
    LegalTrademarks    : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
    OriginalFilename   : msnmsgr.exe

#:37 [mpfagent.exe]
    FilePath           : C:\PROGRA~1\McAfee.com\PERSON~1\
    ProcessID          : 1360
    ThreadCreationTime : 28-06-2005 06:18:57
    BasePriority       : Normal
    FileVersion        : 6.1.0.44
    ProductVersion     : 6.1.0.44
    ProductName        : McAfee Personal Firewall (MPF)
    CompanyName        : McAfee Security
    FileDescription    : McAfee Personal Firewall Agent Interface
    InternalName       : MpfAgent
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : MPFAGENT.EXE
    Comments           : McAfee Personal Firewall Security Center Module

#:38 [acrotray.exe]
    FilePath           : C:\Program Files\Adobe\Acrobat 6.0\Distillr\
    ProcessID          : 1712
    ThreadCreationTime : 28-06-2005 06:18:57
    BasePriority       : Normal
    FileVersion        : 6.0.0.2003051500
    ProductVersion     : 6.0.0.0
    ProductName        : AcroTray - Adobe Acrobat Distiller helper application.
    CompanyName        : Adobe Systems Inc.
    FileDescription    : AcroTray
    InternalName       : AcroTray
    LegalCopyright     : Copyright 1984-2003 Adobe Systems Incorporated and its licensors. All rights reserved.
    OriginalFilename   : AcroTray.exe

#:39 [nkbmonitor.exe]
    FilePath           : C:\Program Files\Nikon\PictureProject\
    ProcessID          : 1760
    ThreadCreationTime : 28-06-2005 06:18:58
    BasePriority       : Normal
    FileVersion        : 1, 0, 0, 3007
    ProductVersion     : 1, 0, 0
    ProductName        : PictureProject Monitor
    CompanyName        : Nikon Corporation
    FileDescription    : PictureProject Monitor
    InternalName       : NkbMonitor
    LegalCopyright     : Copyright © Nikon Corporation. 1998 - 2004
    OriginalFilename   : NKBMONITOR.EXE
    Comments           : PictureProject Monitor

#:40 [ymsgr_tray.exe]
    FilePath           : C:\Program Files\Yahoo!\Messenger\
    ProcessID          : 1424
    ThreadCreationTime : 28-06-2005 06:18:58
    BasePriority       : Normal


#:41 [mcvsftsn.exe]
    FilePath           : c:\progra~1\mcafee.com\vso\
    ProcessID          : 1956
    ThreadCreationTime : 28-06-2005 06:18:58
    BasePriority       : Normal
    FileVersion        : 9, 1, 0, 4
    ProductVersion     : 9, 1, 0, 0
    ProductName        : McAfee VirusScan
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee VirusScan Instant Messenger Scan Module
    InternalName       : mcvsftsn
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : mcvsftsn.EXE
    Comments           : McAfee VirusScan Instant Messenger Scan Module

#:42 [anamgr.exe]
    FilePath           : C:\Program Files\Red Chair Software\Anapod Explorer\
    ProcessID          : 1972
    ThreadCreationTime : 28-06-2005 06:18:58
    BasePriority       : Normal
    FileVersion        : 8, 7, 0, 0
    ProductVersion     : 8, 7, 0, 0
    ProductName        : Red Chair Manager
    CompanyName        : Red Chair Software, Inc.
    FileDescription    : Red Chair Manager
    InternalName       : Red Chair Manager
    LegalCopyright     : Copyright © 2002-2004 Red Chair Software, Inc.

#:43 [msmsgs.exe]
    FilePath           : C:\Program Files\Messenger\
    ProcessID          : 2148
    ThreadCreationTime : 28-06-2005 06:19:00
    BasePriority       : Normal
    FileVersion        : 4.7.3001
    ProductVersion     : Version 4.7.3001
    ProductName        : Messenger
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Messenger
    InternalName       : msmsgs
    LegalCopyright     : Copyright © Microsoft Corporation 2004
    LegalTrademarks    : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
    OriginalFilename   : msmsgs.exe

#:44 [mcvsrte.exe]
    FilePath           : c:\PROGRA~1\mcafee.com\vso\
    ProcessID          : 2184
    ThreadCreationTime : 28-06-2005 06:19:00
    BasePriority       : Normal
    FileVersion        : 9, 1, 0, 8
    ProductVersion     : 9, 1, 0, 0
    ProductName        : McAfee VirusScan
    CompanyName        : McAfee, Inc
    FileDescription    : McAfee VirusScan Real-time Engine
    InternalName       : mcvsrte
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : mcvsrte.exe
    Comments           : McAfee VirusScan Real-time Engine

#:45 [mdm.exe]
    FilePath           : C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\
    ProcessID          : 2208
    ThreadCreationTime : 28-06-2005 06:19:00
    BasePriority       : Normal
    FileVersion        : 7.00.9466
    ProductVersion     : 7.00.9466
    ProductName        : Microsoft® Visual Studio .NET
    CompanyName        : Microsoft Corporation
    FileDescription    : Machine Debug Manager
    InternalName       : mdm.exe
    LegalCopyright     : © Microsoft Corporation.  All rights reserved.
    OriginalFilename   : mdm.exe

#:46 [mpfservice.exe]
    FilePath           : C:\PROGRA~1\McAfee.com\PERSON~1\
    ProcessID          : 2604
    ThreadCreationTime : 28-06-2005 06:19:03
    BasePriority       : Normal
    FileVersion        : 6.1.0.44
    ProductVersion     : 6.1.0.44
    ProductName        : McAfee Personal Firewall
    CompanyName        : McAfee Corporation
    FileDescription    : McAfee Personal Firewall Service
    InternalName       : MPFService
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : MpfService.exe
    Comments           : McAfee Personal Firewall Service

#:47 [msksrvr.exe]
    FilePath           : C:\PROGRA~1\McAfee\SPAMKI~1\
    ProcessID          : 2624
    ThreadCreationTime : 28-06-2005 06:19:03
    BasePriority       : Normal
    FileVersion        : 6.1.0.7
    ProductVersion     : 6.1
    ProductName        : McAfee SpamKiller
    CompanyName        : McAfee Inc.
    FileDescription    : McAfee SpamKiller Server
    InternalName       : MSKSRVR
    LegalCopyright     : Copyright © 1998-2005, McAfee Inc.
    OriginalFilename   : MSKSRVR.EXE

#:48 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 2892
    ThreadCreationTime : 28-06-2005 06:19:06
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:49 [wdfmgr.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 2952
    ThreadCreationTime : 28-06-2005 06:19:06
    BasePriority       : Normal
    FileVersion        : 5.2.3790.1230 built by: DNSRV(bld4act)
    ProductVersion     : 5.2.3790.1230
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows User Mode Driver Manager
    InternalName       : WdfMgr
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : WdfMgr.exe

#:50 [ipodservice.exe]
    FilePath           : C:\Program Files\iPod\bin\
    ProcessID          : 3532
    ThreadCreationTime : 28-06-2005 06:19:08
    BasePriority       : Normal
    FileVersion        : 4.8.0.31
    ProductVersion     : 4.8.0.31
    ProductName        : iTunes
    CompanyName        : Apple Computer, Inc.
    FileDescription    : iPodService Module
    InternalName       : iPodService
    LegalCopyright     : © 2003-2005 Apple Computer, Inc. All Rights Reserved.
    OriginalFilename   : iPodService.exe

#:51 [mcshield.exe]
    FilePath           : c:\PROGRA~1\mcafee.com\vso\
    ProcessID          : 3772
    ThreadCreationTime : 28-06-2005 06:19:12
    BasePriority       : High


#:52 [alg.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 3852
    ThreadCreationTime : 28-06-2005 06:19:13
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Application Layer Gateway Service
    InternalName       : ALG.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : ALG.exe

#:53 [ad-aware.exe]
    FilePath           : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
    ProcessID          : 128
    ThreadCreationTime : 28-06-2005 20:05:16
    BasePriority       : Normal
    FileVersion        : 6.2.0.236
    ProductVersion     : SE 106
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft AB Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 6


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 6


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 6


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : john bradley@doubleclick[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:4
    Value              : Cookie:john [email protected]/
    Expires            : 27-06-2008 13:28:12
    LastSync           : Hits:4
    UseCount           : 0
    Hits               : 4

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : john bradley@serving-sys[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:9
    Value              : Cookie:john [email protected]/
    Expires            : 01-01-2038 06:00:00
    LastSync           : Hits:9
    UseCount           : 0
    Hits               : 9

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : john [email protected][1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:1
    Value              : Cookie:john [email protected]/
    Expires            : 01-01-2038 06:00:00
    LastSync           : Hits:1
    UseCount           : 0
    Hits               : 1

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : john bradley@atdmt[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:1
    Value              : Cookie:john [email protected]/
    Expires            : 27-06-2010 01:00:00
    LastSync           : Hits:1
    UseCount           : 0
    Hits               : 1

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : john bradley@overture[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:3
    Value              : Cookie:john [email protected]/
    Expires            : 26-06-2015 20:29:36
    LastSync           : Hits:3
    UseCount           : 0
    Hits               : 3

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 5
Objects found so far: 11



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

 Win32.P2P-Worm.Alcan.a Object Recognized!
    Type               : File
    Data               : A0007809.dll
    TAC Rating         : 8
    Category           : Worm
    Comment            :
    Object             : C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP136\
    FileVersion        : 3.0.2.0
    ProductVersion     : 3.02
    ProductName        : BigSpeed Zip DLL
    CompanyName        : BigSpeedSoft
    InternalName       : bszip.dll
    LegalCopyright     : © BigSpeedSoft
    LegalTrademarks    : BigSpeed is a trademark of BigSpeedSoft
    OriginalFilename   : bszip.dll


Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 12




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12

21:14:40 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:09:09.156
Objects scanned:130975
Objects identified:6
Objects ignored:0
New critical objects:6

HIJACK THIS.....

Logfile of HijackThis v1.99.1
Scan saved at 21:21:59, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
C:\Program Files\Messenger\msmsgs.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Explorer.EXE
C:\DOCUME~1\JOHNBR~1\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.yahoo.com/config/mail?.intl=au (http://\"http://login.yahoo.com/config/mail?.intl=au\")
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway (http://\"http://www.dell.co.uk/myway\")
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - Startup: Anapod Manager.lnk = C:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm021YYGB (http://\"http://bar.mywebsearch.com/menusearch.html?p=ZUxdm021YYGB\")
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409 (http://\"http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409\")
O16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://us.dl1.yimg.com/download.yahoo.com/...bt/yregucfg.cab (http://\"http://us.dl1.yimg.com/download.yahoo.com/dl/installs/bt/yregucfg.cab\")
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab (http://\"http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab\")
O18 - Protocol: bw+0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {7DBB09D7-A367-4C71-BDBD-424A019B192C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugPro