Ok, I hope I did this log correctly. Located the boxes I missed the first time. And this is the new version you gave me. I didn't have the newest one. Thanks!
StartupList report, 8/12/2004, 10:30:16 PM
StartupList version: 1.52.2
Started from : C:\Spyware tools\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.
exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.
exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-
LC\symlcsvc.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\MailWasher\MailWasher.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\msiexec.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Spyware tools\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\Jojo\Start
Menu\Programs\Startup]
*No files*
Shell folders AltStartup:
*Folder not found*
User shell folders Startup:
*Folder not found*
User shell folders AltStartup:
*Folder not found*
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start
Menu\Programs\Startup]
*No files*
Shell folders Common AltStartup:
*Folder not found*
User shell folders Common Startup:
*Folder not found*
User shell folders Alternate Common Startup:
*Folder not found*
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
[
HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
[HKCU\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon]
*Registry value not found*
[
HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = C:\Program Files\Common
Files\Dell\EUSW\Support.exe
ccApp = "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
NAV CfgWiz = C:\Program Files\Common Files\Symantec
Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
SunJavaUpdateSched = C:\Program Files\Java\j2re1.4.2_04
\bin\jusched.exe
Dell AIO Printer A920 = "C:\Program Files\Dell AIO
Printer A920\dlbkbmgr.exe"
SSC_UserPrompt = C:\Program Files\Common Files\Symantec
Shared\Security Center\UsrPrmpt.exe
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServic
es
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServic
esOnce
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServic
es
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServic
esOnce
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServic
es
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServic
esOnce
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServic
es
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServic
esOnce
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command
(Default) = "%1" /S
--------------------------------------------------
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
--------------------------------------------------
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed
Components
(* = disabled by HKCU twin)
[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP
[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe
OCInstallUserConfigIE
[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe
OCInstallUserConfigOE
[{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:
\WINDOWS\INF\mplayer2.inf,PerUserStub.NT
[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i
:/UserInstall %SystemRoot%\system32\themeui.dll
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe"
/APP:OE /CALLER:WINNT /user /install
[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:
\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection %
SystemRoot%\INF\msmsgs.inf,BLC.Install.PerUser
[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:
\WINDOWS\INF\wmp.inf,PerUserStub
[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe"
/APP:WAB /CALLER:WINNT /user /install
[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll
[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe
--------------------------------------------------
Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps
*Registry key not found*
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*
Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*
Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry
key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry
key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*
Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*
Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry
key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry
key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry
value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*
Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry
value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\SSMYPICS.SCR
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Checking for EXPLORER.EXE instances:
C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present
--------------------------------------------------
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
--------------------------------------------------
Verifying REGEDIT.EXE integrity:
- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'
Registry check passed
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat 5.0
\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-
B87D-784B7D6BE0B3}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt
.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
--------------------------------------------------
Enumerating Task Scheduler jobs:
DFRG.job
Disk Cleanup.job
Norton AntiVirus - Scan my computer - Jojo.job
Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job
--------------------------------------------------
Enumerating Download Program Files:
[DirectAnimation Java Classes]
CODEBASE = file://C:\WINDOWS\Java\classes\dajava.cab
OSD = C:\WINDOWS\Downloaded Program
Files\DirectAnimation Java Classes.osd
[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab
OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML
Parser for Java.osd
[Yahoo! Chat]
CODEBASE =
http://cs6.chat.sc5.yahoo.com/c381/chat.cabOSD = C:\WINDOWS\Downloaded Program Files\Yahoo! Chat.
osd
[sys Class]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\PCPitStop.dll
CODEBASE =
http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
[Scanner Class]
InProcServer32 = C:\temp\TDECntrl\TDECntrl.dll
CODEBASE =
http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
[Yahoo! Audio Conferencing]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\yacscom.dll
CODEBASE =
http://cs6.chat.sc5.yahoo.com/v43/yacscom.cab[PWMediaSendControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\PWActiveXImgCtl.dll
CODEBASE =
http://216.249.24.140/code/PWActiveXImgCtl.
CAB
[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
CODEBASE =
http://a840.g.akamai.net/7/840/537/d2c89f68a1bb5a/housecall.antivirus.com/housecall/xscan53.cab
[Java Plug-in 1.4.2_04]
InProcServer32 = C:\Program Files\Java\j2re1.4.2_04
\bin\npjpi142_04.dll
CODEBASE =
http://java.sun.com/products/plugin/autodl/jinstall-1_4-windows-i586.cab
[Update Class]
InProcServer32 = C:\WINDOWS\System32\iuctl.dll
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.1908101852
[ActiveDataInfo Class]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\SymAData.dll
CODEBASE =
https://www-secure.symantec.com/techsupp/activedata/SymAData.dll
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32
\macromed\flash\Flash.ocx
CODEBASE =
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[ActiveDataObj Class]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\ActiveData.dll
CODEBASE =
https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
--------------------------------------------------
Enumerating Winsock LSP files:
NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
--------------------------------------------------
Enumerating Windows NT/2000/XP services
abp480n5: \SystemRoot\System32\DRIVERS\ABP480N5.SYS (
disabled)
Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (
system)
adpu160m: \SystemRoot\System32\DRIVERS\adpu160m.sys (
disabled)
aeaudio: system32\drivers\aeaudio.sys (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32
\drivers\aec.sys (manual start)
AFD Networking Support Environment: \SystemRoot\System
32\drivers\afd.sys (autostart)
Intel AGP Bus Filter: System32\DRIVERS\agp440.sys (
system)
Compaq AGP Bus Filter: \SystemRoot\System32
\DRIVERS\agpCPQ.sys (disabled)
Aha154x: \SystemRoot\System32\DRIVERS\aha154x.sys (
disabled)
aic78u2: \SystemRoot\System32\DRIVERS\aic78u2.sys (
disabled)
aic78xx: \SystemRoot\System32\DRIVERS\aic78xx.sys (
disabled)
Alerter: %SystemRoot%\System32\svchost.exe -k
LocalService (manual start)
Application Layer Gateway Service: %SystemRoot%\System
32\alg.exe (manual start)
AliIde: \SystemRoot\System32\DRIVERS\aliide.sys (
disabled)
ALI AGP Bus Filter: \SystemRoot\System32\DRIVERS\alim
1541.sys (disabled)
AMD AGP Bus Filter Driver: \SystemRoot\System32
\DRIVERS\amdagp.sys (disabled)
amsint: \SystemRoot\System32\DRIVERS\amsint.sys (
disabled)
Application Management: %SystemRoot%\system32\svchost.
exe -k netsvcs (manual start)
asc: \SystemRoot\System32\DRIVERS\asc.sys (disabled)
asc3350p: \SystemRoot\System32\DRIVERS\asc3350p.sys (
disabled)
asc3550: \SystemRoot\System32\DRIVERS\asc3550.sys (
disabled)
RAS Asynchronous Media Driver: System32
\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32
\DRIVERS\atapi.sys (system)
ati2mtaa: System32\DRIVERS\ati2mtaa.sys (manual start)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (
manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual
start)
basic2: System32\DRIVERS\HSF_BSC2.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%
\System32\svchost.exe -k netsvcs (manual start)
Computer Browser: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
cbidf: \SystemRoot\System32\DRIVERS\cbidf2k.sys (
disabled)
Symantec Event Manager: "C:\Program Files\Common
Files\Symantec Shared\ccEvtMgr.exe" (autostart)
Symantec Password Validation: "C:\Program Files\Common
Files\Symantec Shared\ccPwdSvc.exe" (manual start)
Symantec Settings Manager: "C:\Program Files\Common
Files\Symantec Shared\ccSetMgr.exe" (autostart)
cd20xrnt: \SystemRoot\System32\DRIVERS\cd20xrnt.sys (
disabled)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (
autostart)
ClipBook: %SystemRoot%\system32\clipsrv.exe (manual
start)
CmdIde: \SystemRoot\System32\DRIVERS\cmdide.sys (
disabled)
COM+ System Application: C:\WINDOWS\System32\dllhost.exe
/Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (
manual start)
Cpqarray: \SystemRoot\System32\DRIVERS\cpqarray.sys (
disabled)
Cryptographic Services: %SystemRoot%\system32\svchost.
exe -k netsvcs (autostart)
dac2w2k: \SystemRoot\System32\DRIVERS\dac2w2k.sys (
disabled)
dac960nt: \SystemRoot\System32\DRIVERS\dac960nt.sys (
disabled)
DHCP Client: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %
SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe
-k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32
\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k
NetworkService (autostart)
dpti2o: \SystemRoot\System32\DRIVERS\dpti2o.sys (
disabled)
Microsoft Kernel DRM Audio Descrambler: system32
\drivers\drmkaud.sys (manual start)
Intel® PRO Adapter Driver: System32\DRIVERS\e100b325.
sys (manual start)
3Com EtherLink XL 90XB/C Adapter Driver: System32
\DRIVERS\el90xbc5.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.
exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (
autostart)
COM+ Event System: C:\WINDOWS\System32\svchost.exe -k
netsvcs (manual start)
Fallback: System32\DRIVERS\HSF_FALL.sys (autostart)
Fast User Switching Compatibility: %SystemRoot%\System
32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys
(manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (
manual start)
Fsks: System32\DRIVERS\HSF_FSKS.sys (autostart)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (
system)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (
manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Human Interface Device Access: %SystemRoot%\System32
\svchost.exe -k netsvcs (disabled)
hpn: \SystemRoot\System32\DRIVERS\hpn.sys (disabled)
HSFHWBS2: System32\DRIVERS\HSFHWBS2.sys (manual start)
HSF_DP: System32\DRIVERS\HSF_DP.sys (manual start)
hsf_msft: System32\DRIVERS\HSF_MSFT.sys (manual start)
i2omp: \SystemRoot\System32\DRIVERS\i2omp.sys (disabled)
i8042 Keyboard and PS/2 Mouse Port Driver: System32
\DRIVERS\i8042prt.sys (system)
i81x: System32\DRIVERS\i81xnt5.sys (manual start)
iAimFP0: System32\DRIVERS\wADV01nt.sys (manual start)
iAimFP1: System32\DRIVERS\wADV02NT.sys (manual start)
iAimFP2: System32\DRIVERS\wADV05NT.sys (manual start)
iAimFP3: System32\DRIVERS\wSiINTxx.sys (manual start)
iAimFP4: System32\DRIVERS\wVchNTxx.sys (manual start)
iAimTV0: System32\DRIVERS\wATV01nt.sys (manual start)
iAimTV1: System32\DRIVERS\wATV02NT.sys (manual start)
iAimTV2: System32\DRIVERS\wATV03nt.sys (manual start)
iAimTV3: System32\DRIVERS\wATV04nt.sys (manual start)
iAimTV4: System32\DRIVERS\wCh7xxNT.sys (manual start)
CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (
system)
IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi
.exe (manual start)
ini910u: \SystemRoot\System32\DRIVERS\ini910u.sys (
disabled)
IntelIde: \SystemRoot\System32\DRIVERS\intelide.sys (
disabled)
IPv6 Firewall Driver: System32\DRIVERS\Ip6Fw.sys (manual
start)
IPv6 Internet Connection Firewall: %SystemRoot%\System
32\svchost.exe -k netsvcs (autostart)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys
(manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (
manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.
sys (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (
manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (
system)
K56: System32\DRIVERS\HSF_K56K.sys (autostart)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (
system)
Microsoft Kernel Wave Audio Mixer: system32
\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (
autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
LexBce Server: C:\WINDOWS\system32\LEXBCES.EXE (
autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe
-k LocalService (autostart)
mdmxsdk: System32\DRIVERS\mdmxsdk.sys (autostart)
Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32
\mnmsrvc.exe (manual start)
Unimodem Streaming Filter Device: system32
\drivers\MODEMCSA.sys (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (
system)
mraid35x: \SystemRoot\System32\DRIVERS\mraid35x.sys (
disabled)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (
manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\System
32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\System32\msiexec.exe /V (
manual start)
Microsoft Streaming Service Proxy: system32
\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32
\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32
\drivers\MSPQM.sys (manual start)
Norton AntiVirus Auto Protect Service: "C:\Program
Files\Norton AntiVirus\navapsvc.exe" (autostart)
NAVENG: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\
20040811.020\NAVENG.Sys (manual start)
NAVEX15: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\
20040811.020\NavEx15.Sys (manual start)
Remote Access NDIS TAPI Driver: System32
\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys
(manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan
.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBT: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (manual
start)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (
manual start)
Net Logon: %SystemRoot%\System32\lsass.exe (manual
start)
Network Connections: %SystemRoot%\System32\svchost.exe
-k netsvcs (manual start)
Network Location Awareness (NLA): %SystemRoot%\System32
\svchost.exe -k netsvcs (manual start)
NIC Management Service Configuration Driver: \??\C:
\WINDOWS\System32\drivers\NMSCFG.SYS (manual start)
Intel® NMS: C:\WINDOWS\System32\NMSSvc.exe (manual
start)
NT LM Security Support Provider: %SystemRoot%\System32
\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k
netsvcs (manual start)
nv: System32\DRIVERS\nv4_mini.sys (manual start)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys
(manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd
.sys (manual start)
OMCI WDM Device Driver: System32\DRIVERS\omci.sys (
system)
Intel PentiumIII Processor Driver: System32\DRIVERS\p3.
sys (system)
Parallel port driver: System32\DRIVERS\parport.sys (
manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
PCIIde: System32\DRIVERS\pciide.sys (system)
perc2: \SystemRoot\System32\DRIVERS\perc2.sys (disabled)
perc2hib: \SystemRoot\System32\DRIVERS\perc2hib.sys (
disabled)
Plug and Play: %SystemRoot%\system32\services.exe (
autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (
autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (
manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (
autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (
manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.
sys (manual start)
ql1080: \SystemRoot\System32\DRIVERS\ql1080.sys (
disabled)
Ql10wnt: \SystemRoot\System32\DRIVERS\ql10wnt.sys (
disabled)
ql12160: \SystemRoot\System32\DRIVERS\ql12160.sys (
disabled)
ql1240: \SystemRoot\System32\DRIVERS\ql1240.sys (
disabled)
ql1280: \SystemRoot\System32\DRIVERS\ql1280.sys (
disabled)
Remote Access Auto Connection Driver: System32
\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%
\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (
manual start)
Remote Access Connection Manager: %SystemRoot%\System32
\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.
sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual
start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: System32
\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\WINDOWS\system
32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32
\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32
\svchost.exe -k netsvcs (disabled)
Rksample: System32\DRIVERS\HSF_SAMP.sys (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%
\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32
\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.
exe (autostart)
SAVRT: \??\C:\Program Files\Norton AntiVirus\SAVRT.SYS
(system)
SAVRTPEL: \??\C:\Program Files\Norton
AntiVirus\SAVRTPEL.SYS (system)
SAVScan: C:\Program Files\Norton AntiVirus\SAVScan.exe
(autostart)
ScriptBlocking Service: C:\PROGRA~1\COMMON~1\SYMANT~1
\SCRIPT~1\SBServ.exe (autostart)
Smart Card Helper: %SystemRoot%\System32\SCardSvr.exe (
manual start)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual
start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
System Event Notification: %SystemRoot%\system32
\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (
manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
Internet Connection Firewall (ICF) / Internet Connection
Sharing (ICS): %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost
.exe -k netsvcs (autostart)
SIS AGP Bus Filter: \SystemRoot\System32\DRIVERS\sisagp
.sys (disabled)
smwdm: system32\drivers\smwdm.sys (manual start)
SoftFax: System32\DRIVERS\HSF_FAXX.sys (autostart)
Sony USB Filter Driver (SONYPVU1): System32
\DRIVERS\SONYPVU1.SYS (manual start)
Sparrow: \SystemRoot\System32\DRIVERS\sparrow.sys (
disabled)
SpeakerPhone: System32\DRIVERS\HSF_SPKP.sys (autostart)
Microsoft Kernel Audio Splitter: system32
\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (
autostart)
System Restore Filter Driver: System32\DRIVERS\sr.sys (
system)
System Restore Service: %SystemRoot%\System32\svchost.
exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\System32\svchost.
exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\System32
\svchost.exe -k imgsvc (autostart)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual
start)
Microsoft Kernel GS Wavetable Synthesizer: system32
\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32
\dllhost.exe /Processid:{F79A1568-D6C5-4C69-A086-936CF
52DBBE3} (manual start)
Symantec Core LC: C:\Program Files\Common Files\Symantec
Shared\CCPD-LC\symlcsvc.exe (autostart)
symc810: \SystemRoot\System32\DRIVERS\symc810.sys (
disabled)
symc8xx: \SystemRoot\System32\DRIVERS\symc8xx.sys (
disabled)
SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (
manual start)
symlcbrd: \??\C:\WINDOWS\System32\drivers\symlcbrd.sys
(autostart)
SYMREDRV: \??\C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
(manual start)
SYMTDI: \??\C:\WINDOWS\System32\Drivers\SYMTDI.SYS (
autostart)
SymWMI Service: C:\Program Files\Common Files\Symantec
Shared\Security Center\SymWSC.exe (autostart)
sym_hi: \SystemRoot\System32\DRIVERS\sym_hi.sys (
disabled)
sym_u3: \SystemRoot\System32\DRIVERS\sym_u3.sys (
disabled)
Microsoft Kernel System Audio Device: system32
\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32
\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs
(manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (
system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (
system)
Terminal Services: %SystemRoot%\System32\svchost.exe -k
netsvcs (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (
autostart)
Tones: System32\DRIVERS\HSF_TONE.sys (autostart)
TosIde: \SystemRoot\System32\DRIVERS\toside.sys (
disabled)
Distributed Link Tracking Client: %SystemRoot%\system32
\svchost.exe -k netsvcs (autostart)
ultra: \SystemRoot\System32\DRIVERS\ultra.sys (disabled)
Microcode Update Driver: System32\DRIVERS\update.sys (
manual start)
Upload Manager: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Universal Plug and Play Device Host: %SystemRoot%
\System32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups
.exe (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport
Driver: System32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: System32
\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: System32\DRIVERS\usbprint.
sys (manual start)
USB Scanner Driver: System32\DRIVERS\usbscan.sys (manual
start)
USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (
manual start)
Microsoft USB Universal Host Controller Miniport Driver:
System32\DRIVERS\usbuhci.sys (manual start)
V124: System32\DRIVERS\HSF_V124.sys (autostart)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
VIA AGP Bus Filter: \SystemRoot\System32\DRIVERS\viaagp
.sys (disabled)
ViaIde: \SystemRoot\System32\DRIVERS\viaide.sys (
disabled)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (
manual start)
Windows Time: %SystemRoot%\system32\svchost.exe -k
netsvcs (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys
(manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system
32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k
LocalService (autostart)
winachsf: System32\DRIVERS\HSF_CNXT.sys (manual start)
Windows Management Instrumentation: %systemroot%\system
32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number: %SystemRoot%\System32
\svchost.exe -k netsvcs (autostart)
WMI Performance Adapter: C:\WINDOWS\System32
\wbem\wmiapsrv.exe (manual start)
Automatic Updates: %systemroot%\system32\svchost.exe -k
netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32
\svchost.exe -k netsvcs (autostart)
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run
*Registry key not found*
--------------------------------------------------
End of report, 36,995 bytes
Report generated in 0.485 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and
unsuspicious data
/full - to include several rarely-important
sections
/force9x - to include Win9x-only startups even if
running on WinNT
/forcent - to include WinNT-only startups even if
running on Win9x
/forceall - to include all Win9x and WinNT startups,
regardless of platform
/history - to list version history only