|
|
jca1060
new user
Reg'd: Sat
Posts: 8
|
|
My explorer Desktop icons and taskbar disappear for 5-10 seconds then reappear again. I have tried many solutions to this problem by searching from google nothing seems to help solve this problem and this is probably my last resort from reinstalling my windows. I need your help pls. thanks. Here is my hijackthislog:
Logfile of Trend Micro HijackThis v2.0.2 Carlo Scan saved at 12:39:07 AM, on 6/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal
Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\explorer.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT4022 R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O4 - HKLM\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /QS O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKUS\S-1-5-21-3536113355-4028590675-215682633-1006\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User '?') O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User '?') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801MFUS O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} (BwOutlook.OutlookIntegrator) - http://appserver.dca.broadvoice.com/commpilot/customcontrols/BwOutlook.CAB O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsof...b?1189185047468 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsof...b?1189185034156 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1FAA78A7-5314-4A19-BE4B-9675378DCB0A}: NameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{97B2DF5B-1017-4533-8123-0EC634030161}: NameServer = 192.168.1.254 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-- End of file - 9318 bytes
|
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 28096
Loc: belfast
|
|
Welcome to the Webuser forum. 
go HERE and get a free anti virus program and install it, run a full scan, then reboot and post a fresh HJT log and let me know if the anti virus found anything.
-------------------- MY HELP IS FREE,BUT PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST SPYWARE.
A computer once beat me at chess, but it was no match for me at kick boxing.
|
jca1060
new user
Reg'd: Sat
Posts: 8
|
|
Hi. I have downloaded a free anti virus software that you recommended and I wasn't able to install any of them because my windows installer was corrupted and infected with virus instead I run my super anti spy ware program and here is the HJIT log and the superantispyware results log:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:30:35 PM, on 6/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal
Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Mozilla Firefox\firefox.exe L:\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT4022 R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: NavigationEnhancer - {391C0909-C026-3B63-FFDB-93FFF4E81675} - C:\Program Files\NavigationEnhancer\NavigationEnhancer-2.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {CBDCC40C-5DCE-474A-8978-DF00F5731B90} - C:\WINDOWS\system32\cbXOHbCT.dll (file missing) O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-21-3536113355-4028590675-215682633-1006\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User '?') O4 - HKUS\S-1-5-21-3536113355-4028590675-215682633-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User '?') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801MFUS O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} (BwOutlook.OutlookIntegrator) - http://appserver.dca.broadvoice.com/commpilot/customcontrols/BwOutlook.CAB O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsof...b?1189185047468 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsof...b?1189185034156 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1FAA78A7-5314-4A19-BE4B-9675378DCB0A}: NameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{97B2DF5B-1017-4533-8123-0EC634030161}: NameServer = 192.168.1.254 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-- End of file - 12595 bytes
And here is the SuperAntiSpyware results log:
SUPERAntiSpyware Scan Log http://www.superantispyware.com
Generated 06/10/2008 at 06:26 PM
Application Version : 4.15.1000
Core Rules Database Version : 3476 Trace Rules Database Version: 1467
Scan type : Quick Scan Total Scan Time : 01:19:20
Memory items scanned : 269 Memory threats detected : 0 Registry items scanned : 550 Registry threats detected : 1 File items scanned : 186304 File threats detected : 10
Adware.Tracking Cookie C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@advertising[1].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@122.2o7[2].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@mediatraffic[1].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@dmtracker[1].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@2o7[2].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@cpvfeed[1].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@adtech[1].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@msnportal.112.2o7[1].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@imagebank.ipcmedia[2].txt C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Cookies\owner@ad.yieldmanager[2].txt .insightexpressai.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .insightexpressai.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .insightexpressai.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .insightexpressai.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .insightexpressai.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .apmebf.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] ads.revsci.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .realmedia.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .realmedia.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .tacoda.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .tacoda.net [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] adopt.euroclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .realmedia.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] imagebank.ipcmedia.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .toplist.cz [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .richmedia.yahoo.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] stats.sphere.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .ad2.billboard.cz [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .yourfreeporn.us [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .kontera.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .kontera.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] www.burstbeacon.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .xiti.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .bravenet.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .interclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .interclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .interclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ] .interclick.com [ C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\Mozilla\Firefox\Profiles\4o85w986.default\cookies.txt ]
Adware.Vundo Variant/Rel HKLM\SOFTWARE\Microsoft\RemoveRP
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 28096
Loc: belfast
|
|
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
-------------------- MY HELP IS FREE,BUT PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST SPYWARE.
A computer once beat me at chess, but it was no match for me at kick boxing.
|
jca1060
new user
Reg'd: Sat
Posts: 8
|
|
hello again, sorry for the late reply, Here is the combofix log and the new hjit log that you asked:
ComboFix 08-06-10.5 - Owner 2008-06-11 20:05:39.1 - NTFSx86
Running from: C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Desktop\ComboFix.exe * Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! .
((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) .
C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\FunWebProducts C:\Program Files\FunWebProducts C:\Program Files\FunWebProducts\ScreenSaver\Images\02932313.urr C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S C:\Program Files\MyWebSearch\bar\Cache\0079A03B C:\Program Files\MyWebSearch\bar\Cache\0079A77E.bin C:\Program Files\MyWebSearch\bar\Cache\0079AEE1.bin C:\Program Files\MyWebSearch\bar\Cache\0079B1A0.bin C:\Program Files\MyWebSearch\bar\Cache\0079B29A.bin C:\Program Files\MyWebSearch\bar\Cache\00D72F18.bin C:\Program Files\MyWebSearch\bar\Cache\00D732F1.bin C:\Program Files\MyWebSearch\bar\Cache\00D73562.bin C:\Program Files\MyWebSearch\bar\Cache\00D7365C.bin C:\Program Files\MyWebSearch\bar\Cache\00F51E7D C:\Program Files\MyWebSearch\bar\Cache\files.ini C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S C:\Program Files\MyWebSearch\bar\History\search2 C:\Program Files\MyWebSearch\bar\icons\CM.ICO C:\Program Files\MyWebSearch\bar\icons\MFC.ICO C:\Program Files\MyWebSearch\bar\icons\PSS.ICO C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO C:\Program Files\MyWebSearch\bar\icons\WB.ICO C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S C:\Program Files\MyWebSearch\bar\Message\COMMON\ask_logo.gif C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.gif C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.htm C:\Program Files\MyWebSearch\bar\Message\COMMON\center.htm C:\Program Files\MyWebSearch\bar\Message\COMMON\index.htm C:\Program Files\MyWebSearch\bar\Message\COMMON\mid_dots.gif C:\Program Files\MyWebSearch\bar\Message\COMMON\mws_logo.gif C:\Program Files\MyWebSearch\bar\Message\COMMON\protect.htm C:\Program Files\MyWebSearch\bar\Message\COMMON\shocked.gif C:\Program Files\MyWebSearch\bar\Message\COMMON\stop.gif C:\Program Files\MyWebSearch\bar\Message\COMMON\systray.htm C:\Program Files\MyWebSearch\bar\Message\COMMON\systrayp.htm C:\Program Files\MyWebSearch\bar\Message\COMMON\tp_grad.gif C:\Program Files\MyWebSearch\bar\Message\COMMON\warn.gif C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\MyWebSearch\bar\Settings\setting2.htm C:\Program Files\MyWebSearch\bar\Settings\settings.dat C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL C:\Program Files\PlayMP3z C:\Program Files\PlayMP3z\PlayMP3.exe C:\Program Files\PlayMP3z\uninstall.exe C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\WINDOWS\system32\TCbHOXbc.ini C:\WINDOWS\system32\TCbHOXbc.ini2
. ((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))) .
2008-06-10 20:47 . 2008-06-10 20:47 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-10 20:47 . 2008-06-10 20:47 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-10 12:19 . 2008-06-10 14:39 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-06-10 00:24 . 2008-06-10 16:27 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-10 00:24 . 2008-06-10 16:21 <DIR> d-------- C:\Program Files\AVG 2008-06-10 00:24 . 2008-06-10 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-06-10 00:24 . 2008-06-10 00:24 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-06-10 00:24 . 2008-06-10 00:24 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-06-10 00:24 . 2008-06-10 00:24 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys 2008-06-10 00:24 . 2008-06-10 00:24 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-06-09 23:50 . 2008-06-09 23:50 <DIR> d-------- C:\kav 2008-06-09 23:06 . 2008-06-10 16:37 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\AVGTOOLBAR 2008-06-07 17:30 . 2008-06-09 23:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-06-07 17:12 . 2008-06-07 17:12 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-06-06 23:02 . 2008-06-06 23:02 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-06 17:49 . 2008-06-06 17:49 <DIR> d-------- C:\VundoFix Backups 2008-06-06 16:33 . 2008-06-06 16:33 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\SUPERAntiSpyware.com 2008-06-06 16:33 . 2008-06-06 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-06-05 17:36 . 2008-06-05 17:36 26,560 --a------ C:\WINDOWS\system32\urqRjJDS.dll.vir 2008-05-27 19:51 . 2007-10-17 13:53 43,816 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys 2008-05-27 19:50 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-05-27 19:49 . 2008-05-27 19:49 <DIR> d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-27 19:46 . 2008-05-27 19:46 <DIR> d-------- C:\Program Files\Windows Live Favorites 2008-05-27 19:36 . 2008-05-27 19:53 <DIR> d-------- C:\Program Files\Windows Live 2008-05-27 19:36 . 2008-05-27 19:43 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-05-27 19:35 . 2008-05-28 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-17 09:03 . 2008-05-17 09:04 <DIR> d-------- C:\Program Files\Philips 2008-05-17 08:49 . 2008-05-17 08:49 <DIR> d-------- C:\Program Files\SonicWallES 2008-05-17 08:39 . 2008-06-06 20:37 1,113 --a------ C:\rollback.ini 2008-05-17 08:22 . 2008-05-31 21:39 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\MailFrontier 2008-05-17 08:12 . 2008-06-11 20:19 14,904,096 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-05-17 08:12 . 2008-06-11 20:13 200,564 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-05-17 08:09 . 2008-05-17 08:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-05-17 08:09 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-05-17 08:09 . 2004-04-27 05:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
. (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-12 01:56 --------- d-----w C:\Program Files\Warcraft III 2008-06-11 22:15 --------- d-----w C:\Program Files\NavigationEnhancer 2008-06-11 22:03 --------- d-----w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\LimeWire 2008-06-10 07:43 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd6605.sys 2008-06-08 00:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-05 17:03 --------- d-----w C:\Program Files\mIRC 2008-05-28 02:47 --------- d-----w C:\Program Files\Windows Live Toolbar 2008-05-28 02:44 --------- d-----w C:\Program Files\MSN Messenger 2008-05-17 16:52 --------- d-----w C:\Program Files\LimeWire 2008-05-17 16:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-08 15:48 --------- d-----w C:\Program Files\Safari 2008-05-08 15:47 --------- d-----w C:\Program Files\Apple Software Update 2008-04-23 20:45 --------- d-----w C:\Program Files\WC3Banlist 2008-04-22 21:39 --------- d-----w C:\Program Files\WinPcap 2008-04-12 21:39 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-04-10 13:20 49 ----a-w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\internaldb41.dat 2007-03-23 21:13 382 ----a-w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\internaldb6500.dat 2007-02-24 17:22 32 ----a-r C:\Documents and Settings\All Users\hash.dat 2007-01-17 17:46 20,480 ----a-w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\internaldb4827.dat 2006-11-25 02:32 0 ----a-w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\internaldb5436.dat 2006-11-09 19:04 9,216 ----a-w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\internaldb8467.dat 2006-11-09 19:04 0 ----a-w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\internaldb6334.dat 2006-10-03 11:39 774,144 ----a-w C:\Program Files\RngInterstitial.dll .
((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{391C0909-C026-3B63-FFDB-93FFF4E81675}] 2007-12-30 13:48 1019904 --a------ C:\Program Files\NavigationEnhancer\NavigationEnhancer-2.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}] 2007-10-17 13:53 57384 --a------ C:\Program Files\Windows Live\Family Safety\fssbho.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CBDCC40C-5DCE-474A-8978-DF00F5731B90}] C:\WINDOWS\system32\cbXOHbCT.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 17:44 1200128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-10 16:27 1177368] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-09-16 21:52 185784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"= 0 (0x0) "NoBandCustomize"= 0 (0x0) "NoMovingBands"= 0 (0x0) "NoCloseDragDropBands"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DataViz Inc Messenger.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DataViz Inc Messenger.lnk backup=C:\WINDOWS\pss\DataViz Inc Messenger.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner.YOUR-34EFF17BD0^Start Menu^Programs^Startup^IMVU.lnk] path=C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Start Menu\Programs\Startup\IMVU.lnk backup=C:\WINDOWS\pss\IMVU.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner.YOUR-34EFF17BD0^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner.YOUR-34EFF17BD0^Start Menu^Programs^Startup^palmOne Registration.lnk] path=C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Start Menu\Programs\Startup\palmOne Registration.lnk backup=C:\WINDOWS\pss\palmOne Registration.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner.YOUR-34EFF17BD0^Start Menu^Programs^Startup^Xfire.lnk] path=C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Start Menu\Programs\Startup\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] --a------ 2004-12-13 23:12 483328 C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2008-01-03 09:15 50528 C:\Program Files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-09-14 11:38 69632 C:\WINDOWS\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd] --------- 2006-06-28 07:46 622592 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] --a------ 2006-04-24 21:51 1273856 C:\WINDOWS\system32\WLTRAY.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cctray] C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Chckup] C:\WINDOWS\system32\Netverchk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChikkaIM] --a------ 2005-10-07 13:56 1646592 C:\PROGRA~1\Chikka\Chikka.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey] --a------ 2004-12-08 17:57 550912 C:\WINDOWS\zHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3] --a------ 2006-06-29 12:18 77824 C:\Program Files\Brother\ControlCenter3\brctrcen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-10 12:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2005-12-10 07:57 133016 C:\Program Files\DAEMON Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DrvMon.exe] --a------ 2006-06-14 21:11 53248 C:\WINDOWS\system32\DrvMon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] --a------ 2005-08-05 21:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fssui] --a------ 2007-10-17 13:53 243240 C:\Program Files\Windows Live\Family Safety\fssui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2005-11-15 17:44 1200128 C:\Program Files\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --a------ 2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] C:\Program Files\Common Files\AOL\1163043455\ee\AOLSoftware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-05-11 20:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch] --a------ 2005-03-17 11:45 40960 C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McafWelcome] c:\PROGRA~1\mcafee.com\agent\mcwelcom.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe] --a------ 2005-08-12 16:16 1121792 C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 16:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor] C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2007-12-05 02:41 8523776 C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-12-05 02:41 81920 C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD] --a------ 2005-03-17 11:25 57393 C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --a------ 2007-05-01 23:08 366400 C:\Program Files\Picasa2\PicasaMediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QOELOADER] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.17.0\QOELoader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readericon] --a------ 2005-12-09 18:44 139264 C:\Program Files\Digital Media Reader\readericon45G.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] %WINDIR%\SMINST\RECGUARD.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] %WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] --a------ 2005-09-14 11:38 14820864 C:\WINDOWS\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt] --a------ 2005-01-26 18:02 49152 C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] --a------ 2006-12-18 15:32 25365032 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] -ra------ 2003-10-14 07:22 155648 C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2007-12-15 19:34 1266936 C:\Program Files\Valve\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-11-10 10:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-06-26 18:39 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2006-09-16 21:52 185784 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] --a------ 2006-10-30 12:34 3576512 C:\Program Files\TomTom HOME\TomTomHOME.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] --a------ 2007-12-03 14:21 3461120 C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask] C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Security]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2008-02-29 10:14 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection] --a------ 2007-06-08 07:59 224248 C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client] --a------ 2008-04-02 21:07 919016 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "CaCCProvSP"=3 (0x3) "6to4"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Valve\\Steam\\SteamApps\\jca_001\\counter-strike source\\hl2.exe"= "C:\\Program Files\\Valve\\Steam\\SteamApps\\jca_001\\half-life 2 deathmatch\\hl2.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\Warcraft III\\war3.exe"= "C:\\Program Files\\Sierra Online\\FreeStyle Street Basketball(TM)\\FreeStyle.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-06-10 00:24] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-10 00:24] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-10 16:27] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-10 16:27] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-10 00:24] R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 13:53] R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 22:31] S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys [2004-10-15 12:50] S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2006-01-18 22:44] S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2006-01-19 03:17] S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 13:22] S4 fsssvc;Windows Live OneCare Family Safety;"C:\Program Files\Windows Live\Family Safety\fsssvc.exe" [2007-10-17 13:53] S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38] S4 WMP300NSvc;WMP300NSvc;"C:\Program Files\Wireless-N PCI Adapter\WLService.exe" "WMP300N.exe" []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] \Shell\AutoRun\command - K:\autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0f2030c-8824-11dc-88a6-0040ca988631}] \Shell\AutoRun\command - M:\Loaderw.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a22affb4-3188-11dc-87cd-0040ca988631}] \Shell\AutoRun\command - L:\Loaderw.exe
. Contents of the 'Scheduled Tasks' folder "2008-05-31 05:10:20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-06 18:42:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . **************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-11 20:18:55 Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully hidden files: 0
************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\PROGRA~1\MICROS~3\rapimgr.exe . ************************************************************************** . Completion time: 2008-06-11 20:31:29 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-12 03:31:24
Pre-Run: 117,529,718,784 bytes free Post-Run: 117,776,338,944 bytes free
456 --- E O F --- 2007-09-07 19:00:51
And here is the new HJIT log:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:37:52 PM, on 6/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal
Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Windows Live Toolbar\msn_sl.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT4022 R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file) R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: NavigationEnhancer - {391C0909-C026-3B63-FFDB-93FFF4E81675} - C:\Program Files\NavigationEnhancer\NavigationEnhancer-2.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {CBDCC40C-5DCE-474A-8978-DF00F5731B90} - C:\WINDOWS\system32\cbXOHbCT.dll (file missing) O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm801MFUS O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} (BwOutlook.OutlookIntegrator) - http://appserver.dca.broadvoice.com/commpilot/customcontrols/BwOutlook.CAB O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsof...b?1189185047468 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsof...b?1189185034156 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1FAA78A7-5314-4A19-BE4B-9675378DCB0A}: NameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{97B2DF5B-1017-4533-8123-0EC634030161}: NameServer = 192.168.1.254 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-- End of file - 11634 bytes
Thanx.
|
jca1060
new user
Reg'd: Sat
Posts: 8
|
|
hello, I encountered a spy ware just after i post my combofix log and hjit log so Please don't consider the above combofix log and hjit log instead I post another Combofix log and HJIT log for u to see and here is the combo fix and hjit log:
ComboFix 08-06-10.5 - Owner 2008-06-11 21:18:05.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.508 [GMT -7:00] Running from: C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Desktop\ComboFix.exe * Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! .
((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) .
D:\Autorun.inf
. ((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))) .
2008-06-11 20:57 . 2008-06-11 20:57 <DIR> d-------- C:\Program Files\shc9suj0e75c 2008-06-11 20:57 . 2008-06-11 20:57 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\shc9suj0e75c 2008-06-11 20:57 . 2008-06-11 21:23 60,928 --a------ C:\WINDOWS\system32\blphcesuj0e75c.scr 2008-06-11 20:56 . 2008-06-11 20:56 109,056 --a------ C:\WINDOWS\system32\lphcesuj0e75c.exe 2008-06-11 20:56 . 2008-06-11 21:13 90,838 --a------ C:\WINDOWS\system32\phcesuj0e75c.bmp 2008-06-10 20:47 . 2008-06-10 20:47 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-10 20:47 . 2008-06-10 20:47 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-10 12:19 . 2008-06-10 14:39 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-06-10 00:24 . 2008-06-10 16:27 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-10 00:24 . 2008-06-10 16:21 <DIR> d-------- C:\Program Files\AVG 2008-06-10 00:24 . 2008-06-10 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-06-10 00:24 . 2008-06-10 00:24 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-06-10 00:24 . 2008-06-10 00:24 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-06-10 00:24 . 2008-06-10 00:24 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys 2008-06-10 00:24 . 2008-06-10 00:24 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-06-09 23:50 . 2008-06-09 23:50 <DIR> d-------- C:\kav 2008-06-09 23:06 . 2008-06-10 16:37 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\AVGTOOLBAR 2008-06-07 17:30 . 2008-06-09 23:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-06-07 17:12 . 2008-06-07 17:12 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-06-06 23:02 . 2008-06-06 23:02 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-06 17:49 . 2008-06-06 17:49 <DIR> d-------- C:\VundoFix Backups 2008-06-06 16:33 . 2008-06-06 16:33 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\SUPERAntiSpyware.com 2008-06-06 16:33 . 2008-06-06 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-06-05 17:36 . 2008-06-05 17:36 26,560 --a------ C:\WINDOWS\system32\urqRjJDS.dll.vir 2008-05-27 19:51 . 2007-10-17 13:53 43,816 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys 2008-05-27 19:50 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-05-27 19:49 . 2008-05-27 19:49 <DIR> d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-27 19:46 . 2008-05-27 19:46 <DIR> d-------- C:\Program Files\Windows Live Favorites 2008-05-27 19:36 . 2008-05-27 19:53 <DIR> d-------- C:\Program Files\Windows Live 2008-05-27 19:36 . 2008-05-27 19:43 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-05-27 19:35 . 2008-05-28 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-17 09:03 . 2008-05-17 09:04 <DIR> d-------- C:\Program Files\Philips 2008-05-17 08:49 . 2008-05-17 08:49 <DIR> d-------- C:\Program Files\SonicWallES 2008-05-17 08:39 . 2008-06-06 20:37 1,113 --a------ C:\rollback.ini 2008-05-17 08:22 . 2008-05-31 21:39 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-34EFF17BD0\Application Data\MailFrontier 2008-05-17 08:12 . 2008-06-11 21:24 15,033,120 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-05-17 08:12 . 2008-06-11 21:10 201,836 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-05-17 08:09 . 2008-05-17 08:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-05-17 08:09 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-05-17 08:09 . 2004-04-27 05:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
. (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-12 04:15 --------- d-----w C:\Program Files\NavigationEnhancer 2008-06-12 03:15 34,658,048 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-06-12 01:56 --------- d-----w C:\Program Files\Warcraft III 2008-06-11 22:03 --------- d-----w C:\Documents and Settings\Owner.YOUR-34EFF17BD0\App | |