Thread: Another Vundo victim
View Single Post
Old 10-17-2005, 06:03 AM   #5 (permalink)
B.S.Blues
I helped the forums.
 
Join Date: Oct 2005
Posts: 18
OS: XP


Thanks for your help so far.
I followed your instructions as best I could, but I hit two speed bumps:
First, I was unable to locate any of the following files (and was therefore unable to delete them):

Locate and delete the following files:
C:\WINDOWS\Tasks\wavedvd.exe
C:\WINDOWS\system\mp3.exe
C:\WINDOWS\Web\regtcp.exe
C:\WINDOWS\msagent\uninet.exe
C:\WINDOWS\java\classes\adnet.exe
C:\WINDOWS\ServicePackFiles\kbdisk.exe
C:\WINDOWS\ServicePackFiles\ipacc.exe
C:\WINDOWS\msagent\chars\vssexp.exe
C:\WINDOWS\repair\webjpeg.exe
C:\WINDOWS\Fonts\dvdimg.exe
C:\WINDOWS\system\cmdras.exe
C:\WINDOWS\vssvb.exe
C:\WINDOWS\Tasks\faxav.exe
C:\WINDOWS\addins\vssdrv.exe
C:\WINDOWS\system\netplay.exe
C:\WINDOWS\Fonts\antilib.exe
C:\WINDOWS\system\fonttcp.exe
C:\WINDOWS\Driver Cache\accdll.exe
C:\WINDOWS\ServicePackFiles\wmsad.exe
C:\WINDOWS\repair\abrbin.exe
C:\WINDOWS\addins\eulainet.exe
C:\WINDOWS\Web\accodbc.exe
C:\WINDOWS\msagent\chars\logwave.exe
C:\WINDOWS\AppPatch\dlldoc.exe
C:\WINDOWS\Config\eulacr.exe
C:\WINDOWS\java\classes\vbacc.exe

Perhaps I would have better luck in safe mode?

Second, I was able to run the Panda program but was unable to do anything with the information afterward. I could see that it had identified 85 Spyware files and two suspicious files, but it would not allow me to open the window wide enough to take further action.
So I ran Kaspersky instead. What I found was almost 500 infected files, most of which are in Norton quarantine.
Trend Micro found nothing.
The results of my logs are below:


Trend Micro™ Anti-Spyware


Summary of Privacy Threats

No Spyware found.

-----------
Kasperky log results...

C:\Program Files\Norton AntiVirus\Quarantine\669B47C1.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\66FE2A25.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\674937E1.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\67D87079.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\681E403E.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\68283E33.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\69320573.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6997589E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\69FD4EA6.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6ACE593C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6ACE7705.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6B436AE9.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6BAC1E10.tmp Infected: Trojan.Java.ClassLoader.aj
C:\Program Files\Norton AntiVirus\Quarantine\6BAC1E10.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton AntiVirus\Quarantine\6BAC1E10.zip/InsecureClassLoader.class Infected: Exploit.Java.Bytverify
C:\Program Files\Norton AntiVirus\Quarantine\6BAC1E10.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton AntiVirus\Quarantine\6BAC1E10.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton AntiVirus\Quarantine\6BAC1E10.zip Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton AntiVirus\Quarantine\6BD56D4C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6C5849F9.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6CBC2E63.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6CC92BB7.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6D0173E7.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6D0B71DC.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6D2F21BE.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6D4535CC.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6D93520D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6D9474EA.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6DB52A3A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6E1F7C20.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6E643FD5.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6EF84275.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6F2C6ECA.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6F784EA7.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\6FCC0654.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\70097BCE.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\71D95F62.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\72444989.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\72C33C51.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\72C4734C.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\72DC3B75.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\72F86E09.exe Infected: IM-Worm.Win32.Prex.d
C:\Program Files\Norton AntiVirus\Quarantine\7366263F.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\741108D4.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\741432D0.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74185CCD.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\741B06C9.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\741E30C5.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74225AC2.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\742504BE.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74282EBB.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\742B58B7.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\742F02B3.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74322CB0.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\743556AC.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\743800A9.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\743F54A1.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\74426978.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74427E9E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74495297.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\744F268F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7453508C.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\74567A88.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74592485.exe Infected: Trojan-Dropper.Win32.Agent.ce
C:\Program Files\Norton AntiVirus\Quarantine\7460787E.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\7463227A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74664C76.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\74697673.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\746D206F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74737468.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\74761E64.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\747A4861.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\747D725D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\749A6C3D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\749E1639.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74A14036.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\74B546B3.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75283779.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\753F4E1C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75554570.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75723F50.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7575694C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75781348.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\757C3D45.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\7582113E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\758411D1.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75863B3A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75896536.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\758C0F33.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\758D0AA4.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\758F392F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7593632C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75960D28.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75993725.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75A3351A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75A65F16.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75A90913.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75AD330F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75B05D0B.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75B30708.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\75B63104.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75C702F2.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75D42AE4.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75D5670D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75DE28D9.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75E152D5.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75EE7AC7.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75F54EC0.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\75F878BC.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\75FB22B9.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\760520AE.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\760B74A7.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\760F1EA3.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\760F7F38.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\761248A0.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\761F7091.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\76221A8E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7626448A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\76336C7C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\763C6A71.exe Infected: Trojan-Dropper.Win32.Agent.ce
C:\Program Files\Norton AntiVirus\Quarantine\7640146D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\76466866.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\76491262.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\764D3C5F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\766966E1.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\767A082D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\767E3229.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\76815C25.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7687301E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\768B5A1B.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\76E05E7D.dat Infected: Trojan-Spy.Win32.Agent.p
C:\Program Files\Norton AntiVirus\Quarantine\772E0D67.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77313763.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77356160.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77380B5C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\773B3559.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\77420951.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7745334E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7755053C.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\77582F38.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\775C5935.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\775F0331.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77622D2D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7766572A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77690126.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\776C2B23.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\776F551F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77737F1B.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\778D7BA6.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77DB3EA8.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77DE68A5.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77E212A1.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77E53C9E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77E8669A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77EB1096.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77EF3A93.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77F2648F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77F371AE.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77F50E8C.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\77F83888.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77FC6285.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\77FF0C81.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7802367D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7806607A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\78090A76.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\780C3473.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\780F5E6F.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\78126183.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7813086B.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\78163268.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\78195C64.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\781C0661.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7820305D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7830024B.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\783A0040.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\78405439.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\784A522E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\784D7C2B.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\78512627.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\78545023.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\785967B5.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\791A6BF1.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\79497DA8.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\796042FD.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\796A40F2.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\797D3CDC.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\798410D5.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\79873AD2.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\798A64CE.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\798B26F0.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\798D0ECA.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\799138C7.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\799462C3.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\79970CC0.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\799A36BC.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\79A85EAE.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\79F07A1B.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7A1B6ADD.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7A5B6766.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7A7209CF.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7A825BBD.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7A932DAB.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7AA0559D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7AAD7D8E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7AB35187.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7AC109DC.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7AE8714E.exe Infected: Trojan-Dropper.Win32.Agent.fd
C:\Program Files\Norton AntiVirus\Quarantine\7AFC525A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7B237F0E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7B5030DB.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7B5A2ED0.exe Infected: Trojan-Clicker.Win32.Agent.bc
C:\Program Files\Norton AntiVirus\Quarantine\7B7B52AC.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7B8659C3.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7B887A9D.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BAF7272.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BB21C6F.exe Infected: Trojan-Dropper.Win32.Agent.aw
C:\Program Files\Norton AntiVirus\Quarantine\7BD91444.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BDF3F22.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BED102E.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BF03A2A.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BF36427.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BF70E23.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BFA3820.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7BFD621C.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C000C19.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C043615.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C0D340A.dat Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C1731FF.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C1B5BFC.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C1E05F8.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C212FF5.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C2803ED.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C2B2DEA.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C2E57E6.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C3101E3.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C352BDF.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C3B7FD8.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C3E29D4.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7C5F2018.exe Infected: Trojan-Spy.Win32.Agent.l
C:\Program Files\Norton AntiVirus\Quarantine\7D7A7C32.dat Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\addins\disksys.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\addins\ftpexp.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\addins\keycom.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\addins\psrun.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\Cursors\sc.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\java\eulasvr.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\java\keymsvc.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\msagent\chars\nutpc.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\Registration\mp3as.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\ServicePackFiles\log.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\system\rasplay.exe Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\system32\drivers\etc\hosts.bak Infected: Trojan.Win32.Qhost.r
C:\WINDOWS\Temp\avajsii.dat Infected: Trojan-Spy.Win32.Agent.l
C:\WINDOWS\Temp\vrssii.dat Infected: Trojan-Spy.Win32.Agent.l

Scan process completed.

------------------

Logfile of HijackThis v1.99.1
Scan saved at 7:53:53 AM, on 17/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\MDG\MDGnotify.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Richard Beales\Desktop\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-ca\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-ca\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Shortcut to MDGnotify.lnk = C:\WINDOWS\MDG\MDGnotify.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://66.48.68.135/save/makeover.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1126473129562
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...reShowdown.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 9/28/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 7:53:53 AM, on 17/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\MDG\MDGnotify.exe
C:\Documents and Settings\Richard Beales\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-ca\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-ca\msntb.dll
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - Startup: Shortcut to MDGnotify.lnk = C:\WINDOWS\MDG\MDGnotify.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://66.48.68.135/save/makeover.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1126473129562
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...reShowdown.cab
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe


End of KRC HijackThis Analyzer Log.
===================================================================="
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Shortcut to MDGnotify.lnk = C:\WINDOWS\MDG\MDGnotify.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://66.48.68.135/save/makeover.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1126473129562
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...reShowdown.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
B.S.Blues is offline