Show Posts
1
Tech Clinic / Need help to remove spyware!!!
« on: November 15, 2005, 11:31:24 PM »
OK, I am not sure whether I will still receive the message ..."atapi.sys is opened or in used" but I will try it out firist to install window service pack 1a again.
Thanks for all the guide and here is the latest hijiackThis log :
Logfile of HijackThis v1.99.1
Scan saved at 12:25:36 PM, on 11/16/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\CTsvcCDA.exe
E:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
E:\Program Files\VeriSign\NAVI\naviagent.exe
J:\WINDOWS\System32\nvsvc32.exe
J:\Program Files\Spyware Doctor\sdhelp.exe
J:\WINDOWS\system32\slserv.exe
J:\WINDOWS\System32\svchost.exe
J:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
J:\WINDOWS\System32\devldr32.exe
J:\WINDOWS\Explorer.EXE
J:\Program Files\Creative\ShareDLL\CtNotify.exe
J:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\Program Files\QuickTime\qttask.exe
J:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
J:\WINDOWS\System32\ctfmon.exe
E:\Program Files\Creative\ShareDLL\Mediadet.exe
J:\WINDOWS\System32\rundll32.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Internet Explorer\iexplore.exe
J:\Program Files\BitComet\BitComet.exe
D:\Downloads\software\Antivirus and Spyware\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - J:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
F2 - REG:system.ini: UserInit=E:\WINDOWS\system32\userinit.exe,
O4 - HKLM\..\Run: [PPHIDPAD] C:\WINPENJR\win32\pphidpad.exe
O4 - HKLM\..\Run: [Disc Detector] J:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] J:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "J:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] J:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "E:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = J:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Capture All &Flash Files by SuperCapture - E:\Program Files\SuperCapture401Pro\SCWnd.htm
O8 - Extra context menu item: Capture All &Image Files by SuperCapture - E:\Program Files\SuperCapture401Pro\SCAll.htm
O8 - Extra context menu item: Capture Image by SuperCapture - E:\Program Files\SuperCapture401Pro\SCCom.htm
O8 - Extra context menu item: Capture Web &Page to Image by SuperCapture - E:\Program Files\SuperCapture401Pro\SCDoc.htm
O8 - Extra context menu item: Download All by FlashGet - J:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - J:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: ¶«·½¿ì³µ-ʹÓøöÈËÔĶÁÖúÀí·ÒëËùÑ¡Îı¾ - E:\Program Files\!Sunv\DFKC2003\ExtKW.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Instant Messenger - {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} - http://cn.rd.yahoo.com/home/messenger/bjk/...nger.yahoo.com/ (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - J:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Translate - {87680762-4A83-11B4-885B-0000E8ECA40F} - E:\Program Files\LingoCom\Translator.lnk (file missing)
O9 - Extra 'Tools' menuitem: Translator - {87680762-4A83-11B4-885B-0000E8ECA40F} - E:\Program Files\LingoCom\Translator.lnk (file missing)
O9 - Extra button: (no name) - {8B5676AC-9980-4e41-8A9B-5ACD45591170} - E:\Program Files\SuperCapture401Pro\SuperCap.exe
O9 - Extra 'Tools' menuitem: Super&Capture - {8B5676AC-9980-4e41-8A9B-5ACD45591170} - E:\Program Files\SuperCapture401Pro\SuperCap.exe
O9 - Extra button: i-Nav Help - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: i-Nav Help - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - J:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra 'Tools' menuitem: i-Nav Options - {CE000996-A58C-4441-8938-744CD72AB27F} - J:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - J:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - J:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: SuperCapture - {EA0C6C8A-1815-43fc-B117-0DDF22ADC993} - E:\Program Files\SuperCapture401Pro\SuperCap.exe
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/...trolLite_EN.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/...ebio5_0_2_7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4991DFA-152F-4EDA-8303-57F78115174A}: NameServer = 202.188.0.133,202.188.1.5
O20 - Winlogon Notify: WRNotifier - J:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - E:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: GhostStartService - Symantec Corporation - E:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - E:\Program Files\VeriSign\NAVI\naviagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - J:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SmartLinkService (SLService) - - J:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - J:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
Thanks for all the guide and here is the latest hijiackThis log :
Logfile of HijackThis v1.99.1
Scan saved at 12:25:36 PM, on 11/16/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\CTsvcCDA.exe
E:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
E:\Program Files\VeriSign\NAVI\naviagent.exe
J:\WINDOWS\System32\nvsvc32.exe
J:\Program Files\Spyware Doctor\sdhelp.exe
J:\WINDOWS\system32\slserv.exe
J:\WINDOWS\System32\svchost.exe
J:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
J:\WINDOWS\System32\devldr32.exe
J:\WINDOWS\Explorer.EXE
J:\Program Files\Creative\ShareDLL\CtNotify.exe
J:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\Program Files\QuickTime\qttask.exe
J:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
J:\WINDOWS\System32\ctfmon.exe
E:\Program Files\Creative\ShareDLL\Mediadet.exe
J:\WINDOWS\System32\rundll32.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Internet Explorer\iexplore.exe
J:\Program Files\BitComet\BitComet.exe
D:\Downloads\software\Antivirus and Spyware\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - J:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
F2 - REG:system.ini: UserInit=E:\WINDOWS\system32\userinit.exe,
O4 - HKLM\..\Run: [PPHIDPAD] C:\WINPENJR\win32\pphidpad.exe
O4 - HKLM\..\Run: [Disc Detector] J:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] J:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "J:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] J:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "E:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = J:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Capture All &Flash Files by SuperCapture - E:\Program Files\SuperCapture401Pro\SCWnd.htm
O8 - Extra context menu item: Capture All &Image Files by SuperCapture - E:\Program Files\SuperCapture401Pro\SCAll.htm
O8 - Extra context menu item: Capture Image by SuperCapture - E:\Program Files\SuperCapture401Pro\SCCom.htm
O8 - Extra context menu item: Capture Web &Page to Image by SuperCapture - E:\Program Files\SuperCapture401Pro\SCDoc.htm
O8 - Extra context menu item: Download All by FlashGet - J:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - J:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: ¶«·½¿ì³µ-ʹÓøöÈËÔĶÁÖúÀí·ÒëËùÑ¡Îı¾ - E:\Program Files\!Sunv\DFKC2003\ExtKW.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Instant Messenger - {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} - http://cn.rd.yahoo.com/home/messenger/bjk/...nger.yahoo.com/ (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - J:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Translate - {87680762-4A83-11B4-885B-0000E8ECA40F} - E:\Program Files\LingoCom\Translator.lnk (file missing)
O9 - Extra 'Tools' menuitem: Translator - {87680762-4A83-11B4-885B-0000E8ECA40F} - E:\Program Files\LingoCom\Translator.lnk (file missing)
O9 - Extra button: (no name) - {8B5676AC-9980-4e41-8A9B-5ACD45591170} - E:\Program Files\SuperCapture401Pro\SuperCap.exe
O9 - Extra 'Tools' menuitem: Super&Capture - {8B5676AC-9980-4e41-8A9B-5ACD45591170} - E:\Program Files\SuperCapture401Pro\SuperCap.exe
O9 - Extra button: i-Nav Help - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: i-Nav Help - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - J:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra 'Tools' menuitem: i-Nav Options - {CE000996-A58C-4441-8938-744CD72AB27F} - J:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - J:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - J:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: SuperCapture - {EA0C6C8A-1815-43fc-B117-0DDF22ADC993} - E:\Program Files\SuperCapture401Pro\SuperCap.exe
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/...trolLite_EN.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/...ebio5_0_2_7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4991DFA-152F-4EDA-8303-57F78115174A}: NameServer = 202.188.0.133,202.188.1.5
O20 - Winlogon Notify: WRNotifier - J:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - E:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: GhostStartService - Symantec Corporation - E:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - E:\Program Files\VeriSign\NAVI\naviagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - J:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SmartLinkService (SLService) - - J:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - J:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe