Hi,
Since the beginning of the year I am experiencing problems on my computer (Windows/Vista SP2). Defender won't start, virus scanner won't run anymore, programs won't install, websites have 'broken links' and programs crash (ie GoogleToolbar).
Now last week, Vista suddenly told me that this was all due to a Trojan named UACD.sys, which seems to be extremely difficult to remove.
After consulting the web, I (a.o.) was guided to you guys. I studied 2 similar problems but since one of you mentioned these problems are unique, I decided to post my own.
I already went through your start up cookbook and will append the logs for SAS/MBAM and HJT as text to this message
I installed AVAST as a virus scanner, ran CCleaner and updated Java. Note that this was all over the span of 2/3 days.
I had to rename all my downloads/executables to get them started at all, so whatever is running the show on my computer blocks by certain keywords or exact names???
Any help is greatly appreciated!
Thanks in advance
-----------------------
Logs:
SUPERAntiSpyware Scan Log
http://www.superantispyware.comGenerated 01/31/2010 at 09:00 PM
Application Version : 4.33.1000
Core Rules Database Version : 4541
Trace Rules Database Version: 2353
Scan type : Complete Scan
Total Scan Time : 02:10:11
Memory items scanned : 656
Memory threats detected : 0
Registry items scanned : 8033
Registry threats detected : 169
File items scanned : 184240
File threats detected : 81
Adware.Tracking Cookie
C:\Users\eigenaar\AppData\Roaming\Microsoft\Windows\Cookies\eigenaar@atdmt[1].txt
C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@adtech[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@advertising[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@apmebf[2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@atdmt[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@atdmt[3].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@collective-media[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][3].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@doubleclick[2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@fastclick[2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@media6degrees[2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@mediaplex[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@overture[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@revsci[2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@serving-sys[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@tacoda[2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@tradedoubler[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@trafficmp[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@weborama[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@yieldmanager[1].txt
C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Cookies\lana@zedo[1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@advertentiezoeker[1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@apmebf[1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@atdmt[1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@imrworldwide[2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@mediamarkt[2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\tim@weborama[1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][1].txt
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
C:\Users\xbox\AppData\Roaming\Microsoft\Windows\Cookies\
[email protected][2].txt
Rogue.SmartProtector
C:\Windows\system32\srcr.dat
Trojan.Agent/Gen-Alureon
HKU\.DEFAULT\Software\h8srt
HKU\S-1-5-19\Software\h8srt
HKU\S-1-5-20\Software\h8srt
HKU\S-1-5-21-2280200681-2884239558-2584356172-1000\Software\h8srt
HKU\S-1-5-18\Software\h8srt
HKLM\Software\H8SRT
HKLM\Software\H8SRT#affid
HKLM\Software\H8SRT#subid
HKLM\Software\H8SRT#type
HKLM\Software\H8SRT#build
HKLM\Software\H8SRT#cmddelay
HKLM\Software\H8SRT#slrd
HKLM\Software\H8SRT#slrm
HKLM\Software\H8SRT\connections
HKLM\Software\H8SRT\connections#925b3039
HKLM\Software\H8SRT\connections#784d43e
HKLM\Software\H8SRT\connections#9d0ed33a
HKLM\Software\H8SRT\connections#dfbfa93a
HKLM\Software\H8SRT\connections#1feaa9a4
HKLM\Software\H8SRT\disallowed
HKLM\Software\H8SRT\disallowed#trsetup.exe
HKLM\Software\H8SRT\disallowed#ViewpointService.exe
HKLM\Software\H8SRT\disallowed#ViewMgr.exe
HKLM\Software\H8SRT\disallowed#SpySweeper.exe
HKLM\Software\H8SRT\disallowed#SUPERAntiSpyware.exe
HKLM\Software\H8SRT\disallowed#SpySub.exe
HKLM\Software\H8SRT\disallowed#SpywareTerminatorShield.exe
HKLM\Software\H8SRT\disallowed#SpyHunter3.exe
HKLM\Software\H8SRT\disallowed#XoftSpy.exe
HKLM\Software\H8SRT\disallowed#SpyEraser.exe
HKLM\Software\H8SRT\disallowed#otscanit.exe
HKLM\Software\H8SRT\disallowed#mbam.exe
HKLM\Software\H8SRT\disallowed#mbam-setup.exe
HKLM\Software\H8SRT\disallowed#flash_disinfector.exe
HKLM\Software\H8SRT\disallowed#otmoveit2.exe
HKLM\Software\H8SRT\disallowed#smitfraudfix.exe
HKLM\Software\H8SRT\disallowed#prevxcsifree.exe
HKLM\Software\H8SRT\disallowed#download_mbam-setup.exe
HKLM\Software\H8SRT\disallowed#cbo_setup.exe
HKLM\Software\H8SRT\disallowed#spywareblastersetup.exe
HKLM\Software\H8SRT\disallowed#rminstall.exe
HKLM\Software\H8SRT\disallowed#sdsetup.exe
HKLM\Software\H8SRT\disallowed#vundofixsvc.exe
HKLM\Software\H8SRT\disallowed#daft.exe
HKLM\Software\H8SRT\disallowed#gmer.exe
HKLM\Software\H8SRT\disallowed#catchme.exe
HKLM\Software\H8SRT\disallowed#mcpr.exe
HKLM\Software\H8SRT\disallowed#sdfix.exe
HKLM\Software\H8SRT\disallowed#hjtinstall.exe
HKLM\Software\H8SRT\disallowed#fixpolicies.exe
HKLM\Software\H8SRT\disallowed#emergencyutil.exe
HKLM\Software\H8SRT\disallowed#techweb.exe
HKLM\Software\H8SRT\disallowed#GoogleUpdate.exe
HKLM\Software\H8SRT\disallowed#windowsdefender.exe
HKLM\Software\H8SRT\disallowed#spybotsd.exe
HKLM\Software\H8SRT\disallowed#klif.sys
HKLM\Software\H8SRT\disallowed#pctssvc.sys
HKLM\Software\H8SRT\disallowed#pctcore.sys
HKLM\Software\H8SRT\disallowed#mchinjdrv.sys
HKLM\Software\H8SRT\disallowed#szkg.sys
HKLM\Software\H8SRT\disallowed#sasdifsv.sys
HKLM\Software\H8SRT\disallowed#saskutil.sys
HKLM\Software\H8SRT\disallowed#sasenum.sys
HKLM\Software\H8SRT\disallowed#ccHPx86.sys
HKLM\Software\H8SRT\disallowed#mbamswissarmy.sys
HKLM\Software\H8SRT\disallowed#mbam.sys
HKLM\Software\H8SRT\disallowed#acs.exe
HKLM\Software\H8SRT\disallowed#op_mon.exe
HKLM\Software\H8SRT\disallowed#shWebSv.exe
HKLM\Software\H8SRT\disallowed#ashmaiSv.exe
HKLM\Software\H8SRT\disallowed#imapi.exe
HKLM\Software\H8SRT\disallowed#aswUpdSv.exe
HKLM\Software\H8SRT\disallowed#ashServ.exe
HKLM\Software\H8SRT\disallowed#ashDisp.exe
HKLM\Software\H8SRT\disallowed#avast.exe
HKLM\Software\H8SRT\disallowed#avgemc.exe
HKLM\Software\H8SRT\disallowed#avgwdsvc.exe
HKLM\Software\H8SRT\disallowed#avgyray.exe
HKLM\Software\H8SRT\disallowed#avgrsx.exe
HKLM\Software\H8SRT\disallowed#avcenter.exe
HKLM\Software\H8SRT\disallowed#avgnt.exe
HKLM\Software\H8SRT\disallowed#sched.exe
HKLM\Software\H8SRT\disallowed#avguard.exe
HKLM\Software\H8SRT\disallowed#Combofix.exe
HKLM\Software\H8SRT\disallowed#FAMEH32.exe
HKLM\Software\H8SRT\disallowed#FCH32.exe
HKLM\Software\H8SRT\disallowed#fsaua.exe
HKLM\Software\H8SRT\disallowed#fsav32.exe
HKLM\Software\H8SRT\disallowed#fsdfwd.exe
HKLM\Software\H8SRT\disallowed#fsgk32.exe
HKLM\Software\H8SRT\disallowed#fsgk32st.exe
HKLM\Software\H8SRT\disallowed#fsguidll.exe
HKLM\Software\H8SRT\disallowed#FSM32.EXE
HKLM\Software\H8SRT\disallowed#FSMA32.EXE
HKLM\Software\H8SRT\disallowed#FSMB32.EXE
HKLM\Software\H8SRT\disallowed#fspc.exe
HKLM\Software\H8SRT\disallowed#fsqh.exe
HKLM\Software\H8SRT\disallowed#fssm32.exe
HKLM\Software\H8SRT\disallowed#fsus.exe
HKLM\Software\H8SRT\disallowed#avp.exe
HKLM\Software\H8SRT\disallowed#nod32krn.exe
HKLM\Software\H8SRT\disallowed#nod32kui.exe
HKLM\Software\H8SRT\disallowed#CCSVCHST.exe
HKLM\Software\H8SRT\disallowed#AluSchedulerSvc.exe
HKLM\Software\H8SRT\disallowed#oahlp.exe
HKLM\Software\H8SRT\disallowed#oasrv.exe
HKLM\Software\H8SRT\disallowed#oacat.exe
HKLM\Software\H8SRT\disallowed#oaui.exe
HKLM\Software\H8SRT\disallowed#PF6.exe
HKLM\Software\H8SRT\disallowed#pfsvc.exe
HKLM\Software\H8SRT\disallowed#SCFManager.exe
HKLM\Software\H8SRT\disallowed#SavService.exe
HKLM\Software\H8SRT\disallowed#ALsvc.exe
HKLM\Software\H8SRT\disallowed#SAVAdminService.exe
HKLM\Software\H8SRT\disallowed#ALMon.exe
HKLM\Software\H8SRT\disallowed#SCFService.exe
HKLM\Software\H8SRT\disallowed#SAService.exe
HKLM\Software\H8SRT\disallowed#McNASvc.exe
HKLM\Software\H8SRT\disallowed#McProxy.exe
HKLM\Software\H8SRT\disallowed#Mcshield.exe
HKLM\Software\H8SRT\disallowed#MpfSrv.exe
HKLM\Software\H8SRT\disallowed#msksrver.exe
HKLM\Software\H8SRT\disallowed#mcagent.exe
HKLM\Software\H8SRT\disallowed#SiteAdv.exe
HKLM\Software\H8SRT\disallowed#mcmscsvc.exe
HKLM\Software\H8SRT\disallowed#mcregist.exe
HKLM\Software\H8SRT\disallowed#mcsysmon.exe
HKLM\Software\H8SRT\disallowed#Smc.exe
HKLM\Software\H8SRT\disallowed#Rtvscan.exe
HKLM\Software\H8SRT\disallowed#SmcGui.exe
HKLM\Software\H8SRT\disallowed#SymCorpUI.exe
HKLM\Software\H8SRT\disallowed#PavPrSrv.exe
HKLM\Software\H8SRT\disallowed#PslmSvc.exe
HKLM\Software\H8SRT\disallowed#PsCrtlS.exe
HKLM\Software\H8SRT\disallowed#PAVSRV51.EXE
HKLM\Software\H8SRT\disallowed#AVENGINE.EXE
HKLM\Software\H8SRT\disallowed#ApVxdWin.exe
HKLM\Software\H8SRT\disallowed#WebProxy.exe
HKLM\Software\H8SRT\disallowed#spiderml.exe
HKLM\Software\H8SRT\disallowed#spiderui.exe
HKLM\Software\H8SRT\disallowed#drwebbscd.exe
HKLM\Software\H8SRT\disallowed#MpCmdRun.exe
HKLM\Software\H8SRT\disallowed#MsMpEng.exe
HKLM\Software\H8SRT\disallowed#TeaTimer.exe
HKLM\Software\H8SRT\disallowed#sdra64.exe
HKLM\Software\H8SRT\disallowed#avgtrey.exe
HKLM\Software\H8SRT\disallowed#avg.exe
HKLM\Software\H8SRT\disallowed#mcvsshld.exe
HKLM\Software\H8SRT\disallowed#mcuimgr.exe
HKLM\Software\H8SRT\disallowed#mcshell.exe
HKLM\Software\H8SRT\disallowed#mcods.exe
HKLM\Software\H8SRT\disallowed#avgtrày.exe
HKLM\Software\H8SRT\disallowed#msseces.exe
HKLM\Software\H8SRT\disallowed#MSASCui.exe
HKLM\Software\H8SRT\disallowed#MsMpRes.dll
HKLM\Software\H8SRT\disallowed#MpClient.Dll
HKLM\Software\H8SRT\disallowed#MpRtMon.DLL
HKLM\Software\H8SRT\disallowed#pev.exe
HKLM\Software\H8SRT\disallowed#KDSsetap.exe
HKLM\Software\H8SRT\disallowed#BDTUpdateService.exe
HKLM\Software\H8SRT\disallowed#pctsAuxs.exe
HKLM\Software\H8SRT\disallowed#pctsGui.exe
HKLM\Software\H8SRT\disallowed#pctsSvc.exe
HKLM\Software\H8SRT\disallowed#pctsTray.exe
HKLM\Software\H8SRT\injector
HKLM\Software\H8SRT\injector#*
HKLM\Software\H8SRT\versions
HKLM\Software\H8SRT\versions#/css/crcmds/install
HKLM\Software\H8SRT\versions#/css/crcmds/extra
Adware.MyWebSearch
D:\DOWNLOADS\SMILEYCENTRALPFSETUP2.3.50.10.ZNFOX000.EXE
===================================================================
Malwarebytes' Anti-Malware 1.44
Database version: 3673
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882
1-2-2010 18:17:54
mbam-log-2010-02-01 (18-17-54).txt
Scan type: Quick Scan
Objects scanned: 160779
Time elapsed: 9 minute(s), 52 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\ProgramData\sysReserve.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\System32\krl32mainweq.dll (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\ProgramData\h8srtkrl32mainweq.dll (Rootkit.Trace) -> Delete on reboot.
===================================================================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:28:58, on 1-2-2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://nl.intl.acer.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://nl.intl.acer.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://home.sweetim.comR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - *{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
R3 - URLSearchHook: (no name) - *{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - *{1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (file missing)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ccXgui - [XC]D-Ice - C:\Program Files\ccxgui\ccXservice.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 8075 bytes