Trendmicro log:
Started Scanning
Internet Cookies
Found 'tribalfusion.com' in 'Internet Explorer Cache'
Programs in Memory
Windows Registry
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\InprocServer32'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\MiscStatus'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\MiscStatus\1'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ProgID'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ToolboxBitmap32'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\TypeLib'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\Version'
Found '' in 'software\classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\VersionIndependentProgID'
Found '' in 'software\classes\FlashAX.FlashXControl'
Found '' in 'software\classes\FlashAX.FlashXControl.1'
Found '' in 'software\classes\FlashAX.FlashXControl.1\CLSID'
Found '' in 'software\classes\FlashAX.FlashXControl\CLSID'
Found '' in 'software\classes\FlashAX.FlashXControl\CurVer'
Found '' in 'software\classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}'
Found '' in 'software\classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}\ProxyStubClsid'
Found '' in 'software\classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}\ProxyStubClsid32'
Found '' in 'software\classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}\TypeLib'
Found '' in 'software\classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0'
Found '' in 'software\classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0\0\win32'
Found '' in 'software\classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0\FLAGS'
Found '' in 'software\classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0\HELPDIR'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\InprocServer32'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\MiscStatus'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\MiscStatus\1'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ProgID'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ToolboxBitmap32'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\TypeLib'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\Version'
Found '' in 'SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\VersionIndependentProgID'
Found '' in 'SOFTWARE\Classes\FlashAX.FlashXControl'
Found '' in 'SOFTWARE\Classes\FlashAX.FlashXControl.1'
Found '' in 'SOFTWARE\Classes\FlashAX.FlashXControl.1\CLSID'
Found '' in 'SOFTWARE\Classes\FlashAX.FlashXControl\CLSID'
Found '' in 'SOFTWARE\Classes\FlashAX.FlashXControl\CurVer'
Found '' in 'SOFTWARE\Classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}'
Found '' in 'SOFTWARE\Classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{BF8F3D4F-2A19-4645-B3EB-7B0F4953130F}\TypeLib'
Found '' in 'SOFTWARE\Classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0'
Found '' in 'SOFTWARE\Classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0\0\win32'
Found '' in 'SOFTWARE\Classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0\FLAGS'
Found '' in 'SOFTWARE\Classes\TypeLib\{A0126017-3B4D-451B-AE12-DF7FE7B43330}\1.0\HELPDIR'
Internet URL Shortcuts
Files and Directories
Found 'Mss32.dll' in 'C:\Program Files\pokerrewardsMPP'
Found 'Mss32.dll' in 'C:\Program Files\royalvegasMPP'
Finished Scanning
Started Backup
Finished Backup
Started Cleaning
Checking for 'C:\Program Files\pokerrewardsMPP\Mss32.dll' in shortcut areas.
Checking for 'C:\Program Files\pokerrewardsMPP\Mss32.dll' in startup areas.
Cleaning 'C:\Program Files\pokerrewardsMPP\Mss32.dll'
Checking for 'C:\Program Files\royalvegasMPP\Mss32.dll' in shortcut areas.
Checking for 'C:\Program Files\royalvegasMPP\Mss32.dll' in startup areas.
Cleaning 'C:\Program Files\royalvegasMPP\Mss32.dll'
Finished Cleaning
Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 3:43:24 PM, on 8/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\2Wire\2PortalMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Tom Caranzza\Desktop\New Folder\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://v5.windowsupdate.microsoft.co...?1111862248046
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) -
http://download.zonelabs.com/bin/pro...tor/WebAAS.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) -
http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe