Here is what i could find to give you....
thanks for everything so far
when i copy file it gives me this (i am pretty sure im doing it wrong)
--------------------------------------
13:23:51: can't open file 'C:\Documents and Settings\Gary.TAFT-D93B5620A7\Desktop\copy_mnxfhean.dat' (error 5: access is denied.)
13:23:51: Successfully copied the file!
Here is HiJackThis...
----------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:01:44 PM, on 3/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20978)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.garena.com/portal/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C3997A9-80CB-44D9-A537-F045CBBE3F06} - C:\WINDOWS\system32\bthser.dll (file missing)
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunServices: [Supports RAS Connections] svhost.exe
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\531220359531.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [mount.exe] C:\Program Files\GiPo@Utilities\FileUtilities.3\mount.exe /z
O4 - HKCU\..\RunServices: [Supports RAS Connections] svhost.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) -
http://www.adobe.com/products/acrobat/nos/gp.cabO23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
--
End of file - 6352 bytes
this is an ugly log file (from ARuns)
------------------------------------------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ Adobe Reader Speed Launcher Adobe Acrobat SpeedLauncher (Verified) Adobe Systems, Incorporated c:\program files\adobe\reader 8.0\reader\reader_sl.exe
+ AppleSyncNotifier AppleSyncNotifier (Verified) Apple Inc. c:\program files\common files\apple\mobile device support\bin\applesyncnotifier.exe
+ avgnt Antivirus System Tray Tool (Not verified) Avira GmbH c:\program files\avira\antivir desktop\avgnt.exe
+ iTunesHelper iTunesHelper Module (Verified) Apple Inc. c:\program files\itunes\ituneshelper.exe
+ Malwarebytes Anti-Malware (reboot) Malwarebytes' Anti-Malware (Verified) Malwarebytes c:\program files\malwarebytes' anti-malware\mbam.exe
+ Ptipbmf ptipbmf DLL (Not verified) Promise Technology, Inc. c:\windows\system32\ptipbmf.dll
+ QuickTime Task QuickTime Task (Not verified) Apple Inc. c:\program files\quicktime\qttask.exe
+ SunJavaUpdateSched Java Platform SE binary (Verified) Sun Microsystems, Inc. c:\program files\java\jre6\bin\jusched.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
+ Malwarebytes Anti-Malware (reboot) Malwarebytes' Anti-Malware (Verified) Malwarebytes c:\program files\malwarebytes' anti-malware\531220359531.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+ mount.exe Drives mounting services and virtual drives management. (Not verified) Gibin Software House (http://www.gibinsoft.net) c:\program files\gipo@utilities\fileutilities.3\mount.exe
+ Yahoo! Pager Yahoo! Messenger (Verified) Yahoo! Inc. c:\program files\yahoo!\messenger\yahoomessenger.exe
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
+ 0 File not found: About:Home
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
+ Windows Media Player Microsoft Windows Media Player Setup Utility (Not verified) Microsoft Corporation c:\windows\inf\unregmp2.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
+ WPDShServiceObj Windows Portable Device Shell Service Object (Not verified) Microsoft Corporation c:\windows\system32\wpdshserviceobj.dll
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers
+ FileUtilities_MainContextMenu Class Shell Extension, Member of GiPo@FileUtilities (Not verified) Gibin Software House (http://www.gibinsoft.net) c:\program files\gipo@utilities\fileutilities.3\fush.dll
+ Shell Extension for Malware scanning AntiVirus context menu (Not verified) Avira GmbH c:\program files\avira\antivir desktop\shlext.dll
+ WinRAR c:\program files\winrar\rarext.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
+ Yahoo! Mail Yahoo! Mail (Verified) Yahoo! Inc. c:\program files\yahoo!\common\ymmapi.dll
HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers
+ MBAMShlExt Malwarebytes' Anti-Malware (Verified) Malwarebytes c:\program files\malwarebytes' anti-malware\mbamext.dll
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers
+ FileUtilities_MainContextMenu Class Shell Extension, Member of GiPo@FileUtilities (Not verified) Gibin Software House (http://www.gibinsoft.net) c:\program files\gipo@utilities\fileutilities.3\fush.dll
+ WinRAR c:\program files\winrar\rarext.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
HKLM\Software\Classes\Directory\Shellex\DragDropHandlers
+ HardLinkShlExt Shell Extension, Member of GiPo@FileUtilities (Not verified) Gibin Software House (http://www.gibinsoft.net) c:\program files\gipo@utilities\fileutilities.3\fush.dll
+ WinRAR c:\program files\winrar\rarext.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
HKLM\Software\Classes\Directory\Shellex\PropertySheetHandlers
+ GiPoPPShellEx GiPo@Utilities Shell (Property Page) (Not verified) Gibin Software House (http://www.gibinsoft.net) c:\program files\common files\gibinsoft shared\gu_shell.dll
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
+ PDF Shell Extension PDF Shell Extension (Not verified) Adobe Systems, Inc. c:\program files\common files\adobe\acrobat\activex\pdfshell.dll
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers
+ FileUtilities_MainContextMenu Class Shell Extension, Member of GiPo@FileUtilities (Not verified) Gibin Software House (http://www.gibinsoft.net) c:\program files\gipo@utilities\fileutilities.3\fush.dll
+ MBAMShlExt Malwarebytes' Anti-Malware (Verified) Malwarebytes c:\program files\malwarebytes' anti-malware\mbamext.dll
+ Shell Extension for Malware scanning AntiVirus context menu (Not verified) Avira GmbH c:\program files\avira\antivir desktop\shlext.dll
+ WinRAR c:\program files\winrar\rarext.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ Display Panning CPL Extension File not found: deskpan.dll
+ iTunes iTunes Mini Player DLL (Verified) Apple Inc. c:\program files\itunes\itunesminiplayer.dll
+ Portable Devices Portable Devices Shell Extension (Not verified) Microsoft Corporation c:\windows\system32\wpdshext.dll
+ Portable Devices Menu Portable Devices Shell Extension (Not verified) Microsoft Corporation c:\windows\system32\wpdshext.dll
+ Portable Media Devices Portable Media Devices Shell Extension (Not verified) Microsoft Corporation c:\windows\system32\audiodev.dll
+ Shell Extension for Malware scanning AntiVirus context menu (Not verified) Avira GmbH c:\program files\avira\antivir desktop\shlext.dll
+ Windows Media Player Add to Playlist Context Menu Handler Windows Media Player Launcher (Not verified) Microsoft Corporation c:\windows\system32\wmpshell.dll
+ Windows Media Player Burn Audio CD Context Menu Handler Windows Media Player Launcher (Not verified) Microsoft Corporation c:\windows\system32\wmpshell.dll
+ Windows Media Player Play as Playlist Context Menu Handler Windows Media Player Launcher (Not verified) Microsoft Corporation c:\windows\system32\wmpshell.dll
+ WinRAR shell extension c:\program files\winrar\rarext.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
+ WinZip WinZip Shell Extension DLL (Verified) WinZip Computing c:\program files\winzip\wzshlstb.dll
+ Yahoo! Mail Yahoo! Mail (Verified) Yahoo! Inc. c:\program files\yahoo!\common\ymmapi.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ &Yahoo! Toolbar Helper Yahoo! Toolbar (Verified) Yahoo! Inc. c:\program files\yahoo!\companion\installs\cpn2\yt.dll
+ Adobe PDF Reader Link Helper Adobe PDF Helper for Internet Explorer (Verified) Adobe Systems, Incorporated c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
+ FlashFXP Helper for Internet Explorer (Verified) IniCom Networks, Inc. c:\program files\flashfxp\ieflash.dll
+ Java Plug-In 2 SSV Helper Java Platform SE binary (Not verified) Sun Microsystems, Inc. c:\program files\java\jre6\bin\jp2ssv.dll
+ JQSIEStartDetectorImpl Class Java Quick Starter binary (Not verified) Sun Microsystems, Inc. c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
+ Yahoo! IE Services Button Yahoo! IE Services (Verified) Yahoo! Inc. c:\program files\yahoo!\common\yiesrvc.dll
+ {5C3997A9-80CB-44D9-A537-F045CBBE3F06} File not found: C:\WINDOWS\system32\bthser.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
+ Yahoo! 工具列 Yahoo! Toolbar (Verified) Yahoo! Inc. c:\program files\yahoo!\companion\installs\cpn2\yt.dll
HKLM\Software\Microsoft\Internet Explorer\Toolbar
+ Yahoo! 工具列 Yahoo! Toolbar (Verified) Yahoo! Inc. c:\program files\yahoo!\companion\installs\cpn2\yt.dll
Task Scheduler
+ AppleSoftwareUpdate.job Apple Software Update (Verified) Apple Inc. c:\program files\apple software update\softwareupdate.exe
HKLM\System\CurrentControlSet\Services
+ AntiVirSchedulerService Service to schedule Avira AntiVir Personal - Free Antivirus jobs and updates. (Not verified) Avira GmbH c:\program files\avira\antivir desktop\sched.exe
+ AntiVirService Offers permanent protection against viruses and malware with the AntiVir search engine. (Not verified) Avira GmbH c:\program files\avira\antivir desktop\avguard.exe
+ Apple Mobile Device Provides the interface to Apple mobile devices. (Verified) Apple Inc. c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe
+ Ati HotKey Poller ATI External Event Utility EXE Module (Not verified) ATI Technologies Inc. c:\windows\system32\ati2evxx.exe
+ Bonjour Service Bonjour allows applications like iTunes and Safari to advertise and discover services on the local network. Having Bonjour running enables you to connect to hardware devices like Apple TV and software services like iTunes sharing and AirTunes. If you disable Bonjour, any network service that explicitly depends on it will fail to start. (Verified) Apple Inc. c:\program files\bonjour\mdnsresponder.exe
+ JavaQuickStarterService Prefetches JRE files for faster startup of Java applets and applications (Verified) Sun Microsystems, Inc. c:\program files\java\jre6\bin\jqs.exe
HKLM\System\CurrentControlSet\Services
+ aeaudio Andrea Audio Noise Cancellation Driver (Not verified) Andrea Electronics Corporation c:\windows\system32\drivers\aeaudio.sys
+ ati2mtag ATI Radeon WindowsNT Miniport Driver (Not verified) ATI Technologies Inc. c:\windows\system32\drivers\ati2mtag.sys
+ avgio Avira AntiVir Support for Minifilter (Verified) Avira GmbH c:\program files\avira\antivir desktop\avgio.sys
+ avgntflt Avira files mini-filter driver (Verified) Avira GmbH c:\windows\system32\drivers\avgntflt.sys
+ avipbb Avira's Driver for RootKit Detection (Verified) Avira GmbH c:\windows\system32\drivers\avipbb.sys
+ Changer File not found: C:\WINDOWS\System32\Drivers\Changer.sys
+ DMusic Microsoft Kernel DLS Synthesizer (Not verified) Microsoft Corporation c:\windows\system32\drivers\dmusic.sys
+ drmkaud Microsoft Kernel DRM Audio Descrambler Filter (Not verified) Microsoft Corporation c:\windows\system32\drivers\drmkaud.sys
+ fasttx2k Promise Driver for Windows XP (Not verified) Promise Technology, Inc. c:\windows\system32\drivers\fasttx2k.sys
+ i2omgmt File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys
+ isapnp PNP ISA Bus Driver (Not verified) Microsoft Corporation c:\windows\system32\drivers\isapnp.sys
+ lbrtfdc File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys
+ NPF npf.sys (NT5/6 x86) Kernel Driver (Verified) CACE TECHNOLOGIES, LLC c:\windows\system32\drivers\npf.sys
+ PCIDump File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys
+ PDCOMP File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys
+ PDFRAME File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys
+ PDRELI File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys
+ PDRFRAME File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys
+ qrgnqkxr Sony USB Lower Filter driver (Not verified) Sony Corporation c:\windows\system32\drivers\qrgnqkxr.sys
+ rspndr Allows this PC to be discovered and located on the network. (Not verified) Microsoft Corporation c:\windows\system32\drivers\rspndr.sys
+ smwdm SoundMAX Integrated Digital Audio (Not verified) Analog Devices, Inc. c:\windows\system32\drivers\smwdm.sys
+ ssmdrv Avira Snapshot Driver (Verified) Avira GmbH c:\windows\system32\drivers\ssmdrv.sys
+ swmidi Microsoft GS Wavetable Synthesizer (Not verified) Microsoft Corporation c:\windows\system32\drivers\swmidi.sys
+ sysaudio System Audio WDM Filter (Not verified) Microsoft Corporation c:\windows\system32\drivers\sysaudio.sys
+ viaagp1 VIA NT AGP Filter (Not verified) VIA Technologies, Inc. c:\windows\system32\drivers\viaagp1.sys
+ viasraid VIA SATA RAID DRIVER FOR WINXP (Not verified) VIA Technologies inc,.ltd c:\windows\system32\drivers\viasraid.sys
+ WDICA File not found: C:\WINDOWS\System32\Drivers\WDICA.sys
+ WudfPf Provide communciation services for UMDF components. (Not verified) Microsoft Corporation c:\windows\system32\drivers\wudfpf.sys
+ WudfRd Reflect device requests to user-mode driver drivers (Not verified) Microsoft Corporation c:\windows\system32\drivers\wudfrd.sys
+ yukonwxp NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter (Not verified) Marvell Semiconductor Inc. c:\windows\system32\drivers\yukonwxp.sys
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
+ AtiExtEvent ATI External Event Utility DLL Module (Not verified) ATI Technologies Inc. c:\windows\system32\ati2evxx.dll
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
+ mdnsNSP Bonjour Namespace Provider (Not verified) Apple Inc. c:\program files\bonjour\mdnsnsp.dll