Hi Guestello Find the report generated by Combofix and HJT :
ComboFix 08-02.03.1 - asd 2008-02-03 19:57:07.1 - [color=\"red\"]
FAT32[/color]x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.150 [GMT 5.5:30]
Running from: C:\Documents and Settings\asd\Desktop\ComboFix.exe
* Created a new restore point
[color=\"red\"]
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo1.dll
----- BITS: Possible infected sites -----
hxxp://nxpagent.airtelbroadband.in
.
((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.
2008-02-03 16:31 . 2008-02-03 19:52 103,870 -r-hs---- C:\2ifetri.cmd
2008-02-03 08:05 . 2008-02-03 08:05 <DIR> d--hs---- C:\FOUND.167
2008-02-02 20:26 . 2008-02-02 20:26 104,644 -r-hs---- C:\i.cmd
2008-01-31 20:03 . 2008-01-31 20:03 <DIR> d--hs---- C:\FOUND.166
2008-01-31 13:31 . 2008-01-31 13:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-31 09:31 . 2008-01-31 09:31 <DIR> d--hs---- C:\FOUND.165
2008-01-31 09:31 . 2007-12-13 17:54 <DIR> d-------- C:\Documents and Settings\TEMP\.housecall6.6
2008-01-30 16:24 . 2008-01-30 16:24 <DIR> d--hs---- C:\FOUND.164
2008-01-30 13:16 . 2008-02-02 14:15 103,574 -r-hs---- C:\h.cmd
2008-01-30 08:04 . 2008-01-30 08:04 <DIR> d--hs---- C:\FOUND.163
2008-01-28 21:17 . 2008-01-30 08:06 103,683 -r-hs---- C:\ylr.exe
2008-01-28 20:56 . 2008-01-28 20:56 <DIR> d--hs---- C:\FOUND.162
2008-01-28 07:20 . 2008-01-28 07:20 <DIR> d--hs---- C:\FOUND.161
2008-01-27 18:41 . 2008-01-27 18:41 <DIR> d--hs---- C:\FOUND.160
2008-01-27 06:17 . 2008-01-27 06:17 <DIR> d--hs---- C:\FOUND.159
2008-01-26 12:57 . 2008-02-03 19:55 531 -r-hs---- C:\autorun.inf
2008-01-26 12:56 . 2008-01-26 12:56 1,751 --a------ C:\Documents and Settings\asd\clean.reg
2008-01-26 12:51 . 2008-01-26 12:51 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-25 18:48 . 2008-01-28 16:36 105,293 -r-hs---- C:\xo8wr9.exe
2008-01-25 18:48 . 2008-01-25 18:48 54,784 -r-hs---- C:\WINDOWS\system32\amvo2.dll
2008-01-25 08:13 . 2008-01-25 08:13 104,822 -r-hs---- C:\qd.cmd
2008-01-24 23:07 . 2008-01-24 09:02 <DIR> d-------- C:\Program Files\SDFix
2008-01-24 19:33 . 2007-06-28 18:52 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-01-24 19:33 . 2007-06-28 18:54 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-01-24 19:33 . 2007-06-28 18:55 77,824 --a------ C:\WINDOWS\system32\xvid.ax
2008-01-24 19:20 . 2008-01-24 19:20 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-01-24 18:50 . 2008-01-24 18:50 <DIR> d-------- C:\Documents and Settings\asd\Application Data\CyberLink
2008-01-24 18:50 . 2008-01-24 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-01-24 17:49 . 2008-01-24 17:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-24 17:49 . 2008-01-24 17:49 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-24 09:52 . 2008-01-24 22:28 103,642 -r-hs---- C:\awda2.exe
2008-01-23 10:01 . 2008-01-23 20:41 105,199 -r-hs---- C:\xn1i9x.com
2008-01-23 10:00 . 2007-12-31 12:10 105,216 -r-hs---- C:\80avp08.com
2008-01-22 11:12 . 2008-01-22 11:12 <DIR> d--hs---- C:\FOUND.158
2008-01-21 19:49 . 2008-01-21 19:49 <DIR> d--hs---- C:\FOUND.157
2008-01-21 07:20 . 2008-01-21 07:20 83,456 --a------ C:\WINDOWS\system32\swpr41.dll
2008-01-18 14:07 . 2008-01-18 14:07 <DIR> d--hs---- C:\FOUND.156
2008-01-18 10:01 . 2008-01-18 10:01 <DIR> d--hs---- C:\FOUND.155
2008-01-14 06:15 . 2008-01-14 06:15 <DIR> d--hs---- C:\FOUND.154
2008-01-12 07:04 . 2008-01-12 07:04 <DIR> d--hs---- C:\FOUND.153
2008-01-11 08:20 . 2008-02-01 16:56 268 --ah----- C:\sqmdata16.sqm
2008-01-11 08:20 . 2008-02-01 16:56 244 --ah----- C:\sqmnoopt16.sqm
2008-01-11 07:18 . 2008-01-11 07:18 <DIR> d--hs---- C:\FOUND.152
2008-01-08 19:15 . 2008-01-08 19:15 <DIR> d--hs---- C:\FOUND.151
2008-01-03 10:57 . 2008-01-03 10:57 <DIR> d--hs---- C:\FOUND.150
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-31 10:03 --------- d-----w C:\Documents and Settings\Brahma mayam\Application Data\MEGAUPLOADTOOLBAR
2007-12-27 12:12 --------- d-----w C:\Program Files\DNA
2007-12-27 12:12 --------- d-----w C:\Documents and Settings\asd\Application Data\DNA
2007-12-27 11:12 --------- d-----w C:\Program Files\uTorrent
2007-12-27 11:12 --------- d-----w C:\Documents and Settings\asd\Application Data\uTorrent
2007-12-22 18:17 --------- d-----w C:\Program Files\Common Files\SupportSoft
2007-12-20 14:48 --------- d-----w C:\Documents and Settings\asd\Application Data\Rediff.com
2007-12-14 03:08 --------- d-----w C:\Program Files\Alwil Software
2007-12-13 06:48 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-11 06:17 --------- d-----w C:\Program Files\Common Files\DAZ
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-08 15:43 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2006-02-19 10:29 40960]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 21:54 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 19:26 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nxpclient"="C:\Program Files\Airtel\NetXpert\bin\sprtcmd.exe" [2007-11-26 16:22 202016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58 282624]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-24 19:19 185896]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^asd^Start Menu^Programs^Startup^Mopy Points Collector.lnk]
path=C:\Documents and Settings\asd\Start Menu\Programs\Startup\Mopy Points Collector.lnk
backup=C:\WINDOWS\pss\Mopy Points Collector.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
D:\Bit torrent\bittorrent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
--------- 2007-11-08 15:05 4568576 D:\Download accelerator plus\DAP\DAP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 06:40 409600 C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 21:54 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--------- 2005-12-13 08:49 217088 D:\Nokia\PCSUIT~1\NOKIAP~1\LAUNCH~1.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-06-18 13:25 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
R2 sprtsvc_nxpclient;SupportSoft Sprocket Service (nxpclient);C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe /service []
R3 SNPP106;PC Camera (6029 CIF);C:\WINDOWS\system32\DRIVERS\snpp106.sys [2002-12-23 18:46]
S3 SupportSoft RemoteAssist;SupportSoft RemoteAssist;C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe [2007-11-01 15:20]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\xo8wr9.exe
\Shell\explore\Command - C:\xo8wr9.exe
\Shell\open\Command - C:\xo8wr9.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\xo8wr9.exe
\Shell\explore\Command - D:\xo8wr9.exe
\Shell\open\Command - D:\xo8wr9.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\xo8wr9.exe
\Shell\explore\Command - E:\xo8wr9.exe
\Shell\open\Command - E:\xo8wr9.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\xo8wr9.exe
\Shell\explore\Command - F:\xo8wr9.exe
\Shell\open\Command - F:\xo8wr9.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18689a84-d544-11db-8d8d-0013d4c4c34b}]
\Shell\AutoRun\command - G:\scvshosts.exe
\Shell\Open\command - G:\scvshosts.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{caf3417f-c589-11db-8d53-0013d4c4c34b}]
\Shell\AutoRun\command - H:\80avp08.com
\Shell\explore\Command - H:\80avp08.com
\Shell\open\Command - H:\80avp08.com
.
Contents of the 'Scheduled Tasks' folder
"2008-02-03 11:01:12 C:\WINDOWS\Tasks\User_Feed_Synchronization-{69D17CCE-E12A-4591-850D-356A728FE3B3}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-02-03 19:58:40
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-03 19:58:59
ComboFix-quarantined-files.txt 2008-02-03 14:28:58
.
2008-01-09 07:39:44 --- E O F ---
HJT logfile :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:01:39 PM, on 03/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Airtel\NetXpert\bin\sprtcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Download accelerator plus\DAP\DAP.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
D:\Hijack this\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.co.in/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.comR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Real player\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nxpclient] C:\Program Files\Airtel\NetXpert\bin\sprtcmd.exe /P nxpclient
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Clean Traces - D:\Download accelerator plus\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Download accelerator plus\DAP\dapextie.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download &all with DAP - D:\Download accelerator plus\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) -
http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by129fd.bay129.Email Removed.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -
http://cdn.scan.onecare.live.com/resource/...lscbase9602.cabO16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) -
http://chat.yahoo.com/cab/yuplapp.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{E4ECD48C-B422-4C35-BE71-3E218ED33D7A}: NameServer = 125.22.47.125,202.56.250.5
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SupportSoft Sprocket Service (nxpclient) (sprtsvc_nxpclient) - SupportSoft, Inc. - C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
--
End of file - 8564 bytes
