Options

Can't remove Home search...

Unknown
edited January 2005 in Spyware & Virus Removal
Hello

I've tried without luck to remove the Home Search adware, using both Hijackthis, Ad-Aware and Spy-bot search and destroy. I've also tried using the "Home search Assistant removal Guide" found on shortmedia. Could anyone please look at my log from hijackthis and maybe help me?

Logfile of HijackThis v1.99.0
Scan saved at 20:24:31, on 25.12.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe
C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe
C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Programfiler\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Programfiler\Winamp\winampa.exe
C:\Programfiler\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programfiler\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe
c:\Programfiler\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\iehj32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ipxa32.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\System32\tibs3.exe
C:\Programfiler\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zvlii.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zvlii.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zvlii.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zvlii.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zvlii.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zvlii.dll/sp.html#10001
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Progra~1\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {4C8800AB-6CF3-C966-4F43-113BB2B29CDB} - C:\WINDOWS\ipod.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll
O4 - HKLM\..\Run: [Smapp] C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ASUS Live Update] C:\Programfiler\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [pccguide.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Programfiler\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programfiler\ASUSTek\ASUSDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programfiler\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ipxa32.exe] C:\WINDOWS\system32\ipxa32.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\System32\tibs3.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.tw
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://t058.com/inst//x.chm::/open.exe
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/no/big/1.1.62-big/GoogleNav.cab
O23 - Service: InCD Helper - AHEAD Software - C:\Programfiler\Ahead\InCD\InCDsrv.exe
O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - c:\Programfiler\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - c:\Programfiler\Trend Micro\PC-cillin 2002\Tmntsrv.exe
O23 - Service: Network Security Service - Unknown - C:\WINDOWS\iehj32.exe

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited December 2004
    1. Download this tool called AboutBuster http://www.downloads.subratam.org/AboutBuster.zip

    Unzip it to your desktop but don't run it yet.

    2. Download Adaware from http://www.lavasoft.de/english/default.shtml. Install and open Adaware and click on *Check for Updates Now* and then *Connect*. It will find a new reference-file. Click *ok* and let it download and install the updates by clicking on *Finish* .This will return you to the main screen. Exit Adaware.

    3. Print out these instructions so you have them handy as most of the steps need to be done in safe mode and you may not be able to go online.

    4. Make sure your PC is configured to show hidden files

    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    5. Next, go to Start->Run and type "Services.msc" (without quotes) then hit Ok

    Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.

    6. Reboot to Safe Mode
    Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. To get back to normal mode just restart the computer as you normally would.

    7. Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zvlii.dll/sp.html#10001
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zvlii.dll/sp.html#10001
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zvlii.dll/sp.html#10001
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zvlii.dll/sp.html#10001
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zvlii.dll/sp.html#10001
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zvlii.dll/sp.html#10001
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {4C8800AB-6CF3-C966-4F43-113BB2B29CDB} - C:\WINDOWS\ipod.dll
    O4 - HKLM\..\Run: [ipxa32.exe] C:\WINDOWS\system32\ipxa32.exe
    O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\System32\tibs3.exe
    O15 - Trusted Zone: *.awmdabest.com
    O15 - Trusted Zone: *.awmdabest.com (HKLM)
    O15 - Trusted IP range: 206.161.125.149
    O15 - Trusted IP range: (HKLM)
    O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://t058.com/inst//x.chm::/open.exe
    O23 - Service: Network Security Service - Unknown - C:\WINDOWS\iehj32.exe

    and delete the following files if present.

    C:\WINDOWS\zvlii.dll
    C:\WINDOWS\ipod.dll
    C:\WINDOWS\system32\ipxa32.exe
    C:\WINDOWS\System32\tibs3.exe
    C:\WINDOWS\iehj32.exe

    8. Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

    9. Scan with Adaware and let it remove any bad files found.

    10. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

    Temporary Files
    Temporary Internet Files
    Recycle Bin

    11. Reboot to normal mode, scan again with Hijack This and post a new log here.

    12. Finally, do an online scan at the following site. Let it remove any infected files found.
    Trend Micro (PC-cillin) - Free on-line Scan
    http://housecall.antivirus.com

    Post a fresh HijackThis log and the AboutBuster report back here please.
  • Dagstian
    edited January 2005
    Hello

    I've followed the procedure as described. Thank you for the help. However, the home search assistent is still present. Here are my logs from Hijackthis and adbuster:

    Hijackthis:

    Logfile of HijackThis v1.99.0
    Scan saved at 13:57:04, on 03.01.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe
    C:\Programfiler\ASUS\ASUS Live Update\ALU.exe
    C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    C:\Programfiler\Trend Micro\PC-cillin 2002\pccguide.exe
    C:\Programfiler\Trend Micro\PC-cillin 2002\PCCClient.exe
    C:\Programfiler\Trend Micro\PC-cillin 2002\Pop3trap.exe
    C:\Programfiler\Winamp\winampa.exe
    C:\Programfiler\ASUSTek\ASUSDVD\PDVDServ.exe
    C:\Programfiler\Ahead\InCD\InCD.exe
    C:\Programfiler\QuickTime\qttask.exe
    C:\Programfiler\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programfiler\Messenger\msmsgs.exe
    C:\Programfiler\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe
    c:\Programfiler\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Programfiler\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\1XConfig.exe
    C:\Programfiler\HJT\HijackThis.exe

    O2 - BHO: (no name) - {E44B3176-A212-33ED-258C-B8510C2679C8} - C:\WINDOWS\system32\sdkfp32.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll
    O4 - HKLM\..\Run: [Smapp] C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [ASUS Live Update] C:\Programfiler\ASUS\ASUS Live Update\ALU.exe
    O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [pccguide.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Programfiler\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
    O4 - HKLM\..\Run: [RemoteControl] C:\Programfiler\ASUSTek\ASUSDVD\PDVDServ.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Programfiler\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Programfiler\iTunes\iTunesHelper.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html
    O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.tw
    O15 - Trusted IP range: 206.161.125.149
    O15 - Trusted IP range: (HKLM)
    O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/no/big/1.1.62-big/GoogleNav.cab
    O23 - Service: InCD Helper - AHEAD Software - C:\Programfiler\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe
    O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - c:\Programfiler\Trend Micro\PC-cillin 2002\PCCPFW.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - c:\Programfiler\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    AboutBuster:

    Scanned at: 13:49:04 on: 03.01.2005


    -- Scan 1
    About:Buster Version 4.0
    Reference List : 21


    ADS not scanned System(FAT)
    Removed 4 Random Key Entries
    Removed! : C:\WINDOWS\qeiyl.dat
    Removed! : C:\WINDOWS\ytukrg.dat
    Attempted Clean Of Temp folder.
    Removed Uninstall Key (HSA)
    Removed Uninstall Key (SE)
    Removed Uninstall Key (SW)
    Pages Reset... Done!

    -- Scan 2
    About:Buster Version 4.0
    Reference List : 21


    ADS not scanned System(FAT)
    Attempted Clean Of Temp folder.
    Pages Reset... Done!

    Kind Regards,
    Dag Stian Husby
  • SpywareShooterSpywareShooter 127.0.0.1
    edited January 2005
    O2 - BHO: (no name) - {E44B3176-A212-33ED-258C-B8510C2679C8} - C:\WINDOWS\system32\sdkfp32.dll

    Fix that entry then find and delete sdkfp32.dll, reboot and post a new log.
  • Dagstian
    edited January 2005
    I've done the new steps described, and now it seems that the HSA is removed:

    Logfile of HijackThis v1.99.0
    Scan saved at 17:18:42, on 04.01.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe
    C:\Programfiler\ASUS\ASUS Live Update\ALU.exe
    C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    C:\Programfiler\Trend Micro\PC-cillin 2002\pccguide.exe
    C:\Programfiler\Trend Micro\PC-cillin 2002\PCCClient.exe
    C:\Programfiler\Trend Micro\PC-cillin 2002\Pop3trap.exe
    C:\Programfiler\Winamp\winampa.exe
    C:\Programfiler\ASUSTek\ASUSDVD\PDVDServ.exe
    C:\Programfiler\Ahead\InCD\InCD.exe
    C:\Programfiler\QuickTime\qttask.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programfiler\Messenger\msmsgs.exe
    C:\Programfiler\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe
    c:\Programfiler\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    C:\WINDOWS\System32\1XConfig.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Programfiler\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll
    O4 - HKLM\..\Run: [Smapp] C:\Programfiler\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [ASUS Live Update] C:\Programfiler\ASUS\ASUS Live Update\ALU.exe
    O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [pccguide.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "c:\Programfiler\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Programfiler\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
    O4 - HKLM\..\Run: [RemoteControl] C:\Programfiler\ASUSTek\ASUSDVD\PDVDServ.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Programfiler\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Programfiler\iTunes\iTunesHelper.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html
    O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
    O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/no/big/1.1.62-big/GoogleNav.cab
    O23 - Service: InCD Helper - AHEAD Software - C:\Programfiler\Ahead\InCD\InCDsrv.exe
    O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - c:\Programfiler\Trend Micro\PC-cillin 2002\PCCPFW.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - c:\Programfiler\Trend Micro\PC-cillin 2002\Tmntsrv.exe
Sign In or Register to comment.