|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| General Computer Security Get Help With System Security - This forum is not for malware removal assistance. For malware removal assistance, read the sticky topic at the top of the Virus/Trojan/Spyware Help forum, or the "First Steps" link at the top right of each page. |
 |
|
|
LinkBack | Thread Tools |
01-17-2008, 12:27 AM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2006
Posts: 22
OS: XP
|
Malware, etc.
Hi,
My laptop's been really lagging lately, so I figured I'd check for viruses, etc, I ran AVG and it changed a few .dll files or whatever it does. Then I ran spybot and it found and got rid of quite a few things. I ran the online pandascan, and it found a bunch of stuff. I'm not a hundred percent sure what to do with the results it gave me, I don't want to delete anything important, so I will ask you helpful folks for a word of advice. Here's the pandascan report: Incident Status Location Adware:adware/whenusearch Not disinfected c:\program files\common files\WhenU Potentially unwanted tool:application/myglobalsearch Not disinfected c:\program files\MyGlobalSearch Adware:adware/powerstrip Not disinfected Windows Registry Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.advertising.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.com.com/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.atdmt.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.toplist.cz/] Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.ads.addynamix.com/] Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.ads.pointroll.com/] Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.adserver.easyad.info/] Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.adultfriendfinder.com/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.atwola.com/] Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.bravenet.com/] Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.gostats.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[.realmedia.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[citi.bridgetrack.com/] Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Krystal\Application Data\Mozilla\Firefox\Profiles\unnoyrl2.default\cookies.txt[www.burstbeacon.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@247realmedia[1].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@advertising[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@atwola[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@bs.serving-sys[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@questionmarket[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@serving-sys[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Krystal\Cookies\krystal@tribalfusion[2].txt Possible Virus. Not disinfected C:\Documents and Settings\Krystal\Desktop\OpenCanvas\OpenCanvas[oc11b72.exe] Possible Virus. Not disinfected C:\Documents and Settings\Krystal\Desktop\OpenCanvas\OpenCanvas~\oc11b72.exe Possible Virus. Not disinfected C:\Documents and Settings\Krystal\Local Settings\Temporary Internet Files\Content.IE5\ONZJ2BDA\OpenCanvas[1].zip[C:\Documents and Settings\Krystal\Local Settings\Temporary Internet Files\Content.IE5\ONZJ2BDA\OpenCanvas[1].zip][oc11b72.exe] Potentially unwanted tool:Application/MSNContentPlus Not disinfected C:\WINDOWS\msnlogs.exe Hopefully I can get my laptop up and running properly again soon. Thanks so much, ~Krystal |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-17-2008, 02:27 AM
|
#2 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Malware, etc.
Hi, please read this sticky: If you think your computer is infected....
__________________
UNITE and ASAP since 2006  If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
01-17-2008, 12:22 PM
|
#3 (permalink) |
|
Registered User
Join Date: Dec 2006
Posts: 22
OS: XP
|
Re: Malware, etc.
Oops, sorry about that. Now I'm not totally sure whether I should be keeping my post in this thread of if I should be making a new one in the hi-jack this log section. I'm going to guess it'll be better not to start a new thread?
So, here's the contents of main.txt Deckard's System Scanner v20071014.68 Run by Krystal on 2008-01-17 03  52Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 5: 2008-01-17 11:07:19 UTC - RP166 - Deckard's System Scanner Restore Point 4: 2008-01-17 09:24:02 UTC - RP165 - Software Distribution Service 3.0 3: 2008-01-12 09:22:05 UTC - RP164 - Unsigned driver install 2: 2008-01-09 19:15:06 UTC - RP163 - Software Distribution Service 3.0 1: 2008-01-03 00:11:10 UTC - RP162 - Installed Java(TM) 6 Update 3 Backed up registry hives. Performed disk cleanup. Percentage of Memory in Use: 89% (more than 75%). Total Physical Memory: 503 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-01-17 03:13:23 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\explorer.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Grisoft\AVG7\avgemc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe C:\Program Files\Hp\QuickPlay\QPService.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Apoint2K\ApntEx.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe C:\Program Files\Hp\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\hphmon06.exe C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\WINDOWS\VM303_STI.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Hp\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HPQ\Shared\HpqToaster.exe C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Last.fm\LastFM.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\VMZoom.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Azureus\Azureus.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Documents and Settings\Krystal\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [CmUsbAudio] RunDll32 cmcnfg2.cpl,CMICtrlWnd O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [SpybotDeletingD5713] cmd /c del "C:\WINDOWS\NDNuninstall6_38.exe" O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{167927F0-6B64-4A24-8112-F6F5F0332F5E}: NameServer = 64.59.144.18,64.59.144.19 O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\Hp\hpcoretech\comp\hpuiprot.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe -- End of file - 13002 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 giveio - c:\windows\system32\giveio.sys R0 PenClass (Pen Class) - c:\windows\system32\drivers\penclass.sys <Not Verified; Wacom Technology Corporation; Wacom Pen Class Driver> R3 ZSMC303 (USB PC Camera H) - c:\windows\system32\drivers\usbvm303.sys <Not Verified; Vimicro Corporation; > -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour> R2 ProtexisLicensing - c:\windows\system32\psiservice.exe <Not Verified; ; PSIService> S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> S3 hpqwmi (HP WMI Interface) - c:\program files\hpq\shared\hpqwmi.exe <Not Verified; Hewlett-Packard Development Company, L.P.; hpqwmi Module> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Hamachi Network Interface Device ID: ROOT\NET\0000 Manufacturer: LogMeIn, Inc. Name: Hamachi Network Interface PNP Device ID: ROOT\NET\0000 Service: hamachi -- Scheduled Tasks ------------------------------------------------------------- 2008-01-10 21:10:04 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-12-17 and 2008-01-17 ----------------------------- 2008-01-17 02:56:30 0 d-------- C:\Program Files\SpywareBlaster 2008-01-16 12:19:24 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-01-16 02:36:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-12 01:22:06 0 d-------- C:\WINDOWS\LastGood 2007-12-31 15:03:44 0 d-------- C:\Program Files\OLYMPUS 2007-12-21 00:33:16 719872 --a------ C:\WINDOWS\system32\devil.dll <Not Verified; Abysmal Software; Developer's Image Library (DevIL)> 2007-12-21 00:33:16 313344 --a------ C:\WINDOWS\system32\avisynth.dll <Not Verified; The Public; Avisynth 2.5> 2007-12-21 00:33:15 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-12-21 00:33:15 745472 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-12-21 00:32:51 0 d-------- C:\Program Files\DIKO 2007-12-21 00:07:06 0 d-------- C:\Documents and Settings\Krystal\Application Data\Pegasys Inc 2007-12-21 00:05:25 0 d-------- C:\Program Files\Pegasys Inc -- Find3M Report --------------------------------------------------------------- 2008-01-17 03:14:46 0 d-------- C:\Documents and Settings\Krystal\Application Data\Azureus 2008-01-16 16:19:27 0 d-------- C:\Documents and Settings\Krystal\Application Data\MegauploadToolbar 2008-01-16 15:55:12 0 d-------- C:\Program Files\QuickTime 2008-01-16 15:45:23 0 d-------- C:\Program Files\MSN Messenger 2008-01-16 15:41:32 0 d-------- C:\Program Files\MegauploadToolbar 2008-01-16 15:41:10 0 d-------- C:\Program Files\Last.fm 2008-01-16 15:39:58 0 d-------- C:\Program Files\iTunes 2008-01-16 15:29:50 0 d-------- C:\Program Files\Common Files\LightScribe 2008-01-16 15:09:45 0 d-------- C:\Program Files\Bonjour 2008-01-16 15:07:00 0 d-------- C:\Program Files\Azureus 2008-01-16 15:03:40 0 d-------- C:\Program Files\Apoint2K 2008-01-15 02:54:53 0 d-------- C:\Documents and Settings\Krystal\Application Data\AVG7 2008-01-11 01 30 0 d-------- C:\Documents and Settings\Krystal\Application Data\WTablet2008-01-02 16:13:19 0 d-------- C:\Program Files\Java 2008-01-02 16:05:31 0 d-------- C:\Documents and Settings\Krystal\Application Data\Adobe 2007-12-26 00:41:54 0 d-------- C:\Documents and Settings\Krystal\Application Data\Netscape 2007-12-02 23:02:41 0 d-------- C:\Program Files\Tablet -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [19/07/2005 03:09 AM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [19/07/2005 03:06 AM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [19/07/2005 03:10 AM] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [14/10/2004 09:11 AM] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [06/08/2004 08:27 AM] "AGRSMMSG"="AGRSMMSG.exe" [13/04/2005 02:12 AM C:\WINDOWS\AGRSMMSG.exe] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [08/02/2005 08:38 AM] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [16/11/2005 08:30 AM] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [23/09/2005 11:08 PM] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [12/12/2005 11:39 AM] "eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [07/12/2005 10:56 AM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11 AM] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [29/03/2005 02:45 PM] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [11/10/2005 10:23 AM] "CmUsbAudio"="cmcnfg2.cpl" [] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe" [06/01/2006 08:54 PM] "HPHUPD06"="C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [06/01/2006 08:54 PM] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [12/05/2004 02:18 PM] "HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [06/01/2006 08:54 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [23/07/2006 10:51 PM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [20/12/2007 12:18 PM] "BigDog303"="C:\WINDOWS\VM303_STI.exe" [25/10/2005 12:56 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [27/04/2007 08:41 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [01/06/2007 03:51 PM] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 05:53 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [02/04/2007 05:15 PM] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [12/03/2007 12:49 PM] "OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [28/05/2007 04:59 PM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [31/08/2007 04:46 PM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "SpybotDeletingD5713"=cmd /c del "C:\WINDOWS\NDNuninstall6_38.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [23/09/2005 11:28:44 PM] HP Photosmart Premier Fast Start.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe [24/09/2005 1:39:30 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 12:01:04 AM] TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [10/11/2007 12:16:07 AM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ffc9941-02f7-11db-affc-806d6172696f}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 *Newly Created Service* - RKPAVPROC -- Hosts ----------------------------------------------------------------------- 127.0.0.1 007guard.com 127.0.0.1 www.007guard.com 127.0.0.1 008i.com 127.0.0.1 008k.com 127.0.0.1 www.008k.com 127.0.0.1 00hq.com 127.0.0.1 www.00hq.com 127.0.0.1 010402.com 127.0.0.1 032439.com 127.0.0.1 www.032439.com 7840 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-01-17 03:16:06 ------------ And hopefully extra.txt is attached. Sorry about screwing this up the first time. Thanks again ~Krystal |
|
|
|
|
01-17-2008, 12:53 PM
|
#4 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Malware, etc.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums.   PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
| Thread Tools | |
|
|
