|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
02-16-2007, 08:32 PM
|
#1 (permalink) |
|
Registered User
Join Date: Feb 2007
Posts: 12
OS: XP
|
update.exe
Hi again...
This is the result after the comboscan: ComboScan v20070212.14 run by max on 2007-02-17 at 12:22:39 Computer is in Normal Mode. -------------------------------------------------------------------------------- Successfully created restore point. Performed disk cleanup. -- HijackThis log (run as max.com) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 12:23:03, on 17/02/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\svchosts.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Apoint2K\Apoint.exe C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Apoint2K\Apntex.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\max\Desktop\comboscan.exe C:\DOCUME~1\max\LOCALS~1\Temp\~ejtnops.tmp\max.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID} R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8080;http=localhost:8080;https=localhost:8080;socks=localhost:1080 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe" O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Wallpaper Calendar.lnk = C:\Program Files\zepsoft\Wallpaper Calendar\WallCal3.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocx O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001377 (file missing) O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- File Associations ------------------------------------------------------------ .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - unable to read key .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------- 3 3xHybrid (3xHybrid service) - system32\DRIVERS\3xHybrid.sys 0 ACPIEC (Microsoft Embedded Controller Driver) - System32\DRIVERS\ACPIEC.sys 3 AgereSoftModem (Agere Systems Soft Modem) - System32\DRIVERS\AGRSM.sys 3 ALCXWDM (Service for Realtek AC97 Audio (WDM)) - system32\drivers\ALCXWDM.SYS 3 ApfiltrService (Alps Pointing-device Filter Driver) - System32\DRIVERS\Apfiltr.sys 3 Arp1394 (1394 ARP Client Protocol) - System32\DRIVERS\arp1394.sys 3 BlueletAudio (Bluetooth Audio Service) - system32\DRIVERS\blueletaudio.sys 3 BT (Bluetooth PAN Network Adapter) - system32\DRIVERS\btnetdrv.sys 3 Btcsrusb (Bluetooth USB For Bluetooth Service) - System32\Drivers\btcusb.sys 3 BTDriver (Bluetooth Virtual Communications Driver) - system32\DRIVERS\btport.sys 3 BTHidEnum (Bluetooth HID Enumerator) - system32\DRIVERS\vbtenum.sys 0 BTHidMgr (Bluetooth HID Manager Service) - System32\Drivers\BTHidMgr.sys 3 BTNetFilter (Bluetooth Network Filter) - \??\C:\WINDOWS\system32\drivers\BTNetFilter.sys 3 BTWDNDIS (Bluetooth LAN Access Server) - system32\DRIVERS\btwdndis.sys 3 BTWUSB (WIDCOMM USB Bluetooth Driver) - System32\Drivers\btwusb.sys 3 CCDECODE (Closed Caption Decoder) - system32\DRIVERS\CCDECODE.sys 4 cdawdm - system32\DRIVERS\CDAWDM.sys 3 DKbFltr (Dritek HotKey Keyboard Filter Driver) - System32\Drivers\DKbFltr.sys 0 fcdabus - system32\DRIVERS\fcdabus.sys 3 fsRamDsk (RamDisk Drive Service) - system32\DRIVERS\fsRamDsk.sys 0 FVXSCSI - system32\DRIVERS\fvxscsi.sys 3 gv3 (Intel GV3 Processor Driver) - System32\DRIVERS\gv3.sys 3 HidUsb (Microsoft HID Class Driver) - System32\DRIVERS\hidusb.sys 3 ialm - System32\DRIVERS\ialmnt5.sys 1 intelppm (Intel Processor Driver) - System32\DRIVERS\intelppm.sys 2 irda (IrDA Protocol) - System32\DRIVERS\irda.sys 3 mouhid (Mouse HID Driver) - System32\DRIVERS\mouhid.sys 3 MPE (BDA MPE Filter) - system32\DRIVERS\MPE.sys 3 MSIRCOMM (Microsoft IR Communications Driver) - system32\DRIVERS\MSIRCOMM.sys 3 MSTEE (Microsoft Streaming Tee/Sink-to-Sink Converter) - system32\drivers\MSTEE.sys 3 NABTSFEC (NABTS/FEC VBI Codec) - system32\DRIVERS\NABTSFEC.sys 3 NAVENG - \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070214.020\NAVENG.Sys 3 NAVEX15 - \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070214.020\NavEx15.Sys 3 NdisIP (Microsoft TV/Video Connection) - system32\DRIVERS\NdisIP.sys 3 NIC1394 (1394 Net Driver) - System32\DRIVERS\nic1394.sys 3 nm (Network Monitor Driver) - system32\DRIVERS\NMnt.sys 3 NPF (WinPcap Packet Driver (NPF)) - system32\drivers\NPF.sys 3 NTIDrvr (Upper Class Filter Driver) - System32\DRIVERS\NTIDrvr.sys 2 NwlnkIpx (NWLink IPX/SPX/NetBIOS Compatible Transport Protocol) - system32\DRIVERS\nwlnkipx.sys 2 NwlnkNb (NWLink NetBIOS) - system32\DRIVERS\nwlnknb.sys 2 NwlnkSpx (NWLink SPX/SPXII Protocol) - system32\DRIVERS\nwlnkspx.sys 0 ohci1394 (VIA OHCI Compliant IEEE 1394 Host Controller) - System32\DRIVERS\ohci1394.sys 0 PCIIde - System32\DRIVERS\pciide.sys 0 Pcmcia - System32\DRIVERS\pcmcia.sys 3 pfc (Padus ASPI Shell) - system32\drivers\pfc.sys 0 PxHelp20 - System32\Drivers\PxHelp20.sys 3 Rasirda (WAN Miniport (IrDA)) - System32\DRIVERS\rasirda.sys 3 ROOTMODEM (Microsoft Legacy Modem Driver) - System32\Drivers\RootMdm.sys 3 rtl8139 (Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver) - System32\DRIVERS\R8139n51.SYS 3 SAVRT - \??\C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVRT.SYS 1 SAVRTPEL - \??\C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVRTPEL.SYS 0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - System32\drivers\sfdrv01.sys 0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - System32\drivers\sfhlp02.sys 3 Sfloppy (High-Capacity Floppy Disk Drive) - system32\DRIVERS\sfloppy.sys 0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - System32\drivers\sfsync02.sys 3 SLIP (BDA Slip De-Framer) - system32\DRIVERS\SLIP.sys 3 SMCIRDA (SMC IrCC Miniport Device Driver) - System32\DRIVERS\smcirda.sys 3 SONYPVU1 (Sony USB Filter Driver (SONYPVU1)) - system32\DRIVERS\SONYPVU1.SYS 1 SPBBCDrv - \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys 0 sptd - System32\Drivers\sptd.sys 3 streamip (BDA IPSink) - system32\DRIVERS\StreamIP.sys 3 SYMDNS - \SystemRoot\System32\Drivers\SYMDNS.SYS 3 SymEvent - \??\C:\Program Files\Symantec\SYMEVENT.SYS 3 SYMFW - \SystemRoot\System32\Drivers\SYMFW.SYS 3 SYMIDS - \SystemRoot\System32\Drivers\SYMIDS.SYS 3 SYMIDSCO - \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20070214.003\symidsco.sys 2 symlcbrd - \??\C:\WINDOWS\system32\drivers\symlcbrd.sys 3 SYMNDIS - \SystemRoot\System32\Drivers\SYMNDIS.SYS 3 SYMREDRV - \SystemRoot\System32\Drivers\SYMREDRV.SYS 1 SYMTDI - \SystemRoot\System32\Drivers\SYMTDI.SYS 1 Tcpip6 (Microsoft IPv6 Protocol Driver) - system32\DRIVERS\tcpip6.sys 3 tunmp (Microsoft Tun Miniport Adapter Driver) - system32\DRIVERS\tunmp.sys 3 usb2vcom (USB to Serial Bridge Controller) - System32\Drivers\usb2vcom.sys 3 usbehci (Microsoft USB 2.0 Enhanced Host Controller Miniport Driver) - System32\DRIVERS\usbehci.sys 3 usbprint (Microsoft USB PRINTER Class) - system32\DRIVERS\usbprint.sys 3 usbscan (USB Scanner Driver) - system32\DRIVERS\usbscan.sys 3 USBSTOR (USB Mass Storage Driver) - system32\DRIVERS\USBSTOR.SYS 3 VComm (Virtual Serial port driver) - system32\DRIVERS\VComm.sys 3 VcommMgr (Bluetooth VComm Manager Service) - System32\Drivers\VcommMgr.sys 3 w70n51 (Intel(R) PRO/Wireless 7100 Adapter Driver) - System32\DRIVERS\w70n51.sys 4 WS2IFSL (Windows Socket 2.0 Non-IFS Service Provider Support Environment) - \SystemRoot\System32\drivers\ws2ifsl.sys 3 WSTCODEC (World Standard Teletext Codec) - system32\DRIVERS\WSTCODEC.SYS 3 WudfPf (Windows Driver Foundation - User-mode Driver Framework Platform Driver) - system32\DRIVERS\WudfPf.sys 3 WudfRd (Windows Driver Foundation - User-mode Driver Framework Reflector) - system32\DRIVERS\wudfrd.sys 3 {6080A529-897E-4629-A488-ABA0C29B635E} (Intel(R) Graphics Platform (SoftBIOS) Driver) - system32\drivers\ialmsbw.sys 3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (Intel(R) Graphics Chipset (KCH) Driver) - system32\drivers\ialmkchw.sys 3 {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55} (AIM 3.0 Part 01 Codec Driver CH-7009-A/CH-7011) - system32\drivers\wA301a.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 2 6to4 (IPv6 Helper Service) - %SystemRoot%\system32\svchost.exe -k netsvcs 3 Adobe LM Service - "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" 3 aspnet_state (ASP.NET State Service) - %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe 2 Automatic LiveUpdate Scheduler - "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" 2 ccEvtMgr (Symantec Event Manager) - "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" 3 ccPwdSvc (Symantec Password Validation) - "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe" 2 ccSetMgr (Symantec Settings Manager) - "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" 2 COM+ Messages - "C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001377 2 Fax - %systemroot%\system32\fxssvc.exe 2 Irmon (Infrared Monitor) - %SystemRoot%\System32\svchost.exe -k netsvcs 3 LiveUpdate - "C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE" 2 MDM (Machine Debug Manager) - "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" 2 navapsvc (Norton AntiVirus Auto-Protect Service) - "C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe" 2 NPFMntor (Norton AntiVirus Firewall Monitor Service) - "C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe" 3 ose (Office Source Engine) - "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" 3 SAVScan - "C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe" 2 SBService (ScriptBlocking Service) - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe 2 SNDSrvc (Symantec Network Drivers Service) - "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" 2 SPBBCSvc (Symantec SPBBCSvc) - "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" 2 Symantec Core LC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe 2 UxTuneUp (TuneUp Design Expansion) - %SystemRoot%\System32\svchost.exe -k netsvcs 3 WMPNetworkSvc (Windows Media Player Network Sharing Service) - C:\Program Files\Windows Media Player\WMPNetwk.exe 3 WudfSvc (Windows Driver Foundation - User-mode Driver Framework) - %SystemRoot%\system32\svchost.exe -k WudfServiceGroup -- Scheduled Tasks -------------------------------------------------------------- 2007-02-17 00:00:02 304 --a------ C:\WINDOWS\Tasks\Symantec Drmc.job<SYMANT~2.JOB> 2007-02-16 20:00:36 544 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - max.job<NORTON~2.JOB> 2007-02-16 18:31:48 386 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job<1-CLIC~1.JOB> 2007-02-12 12:00:04 288 --a------ C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job<NORTON~1.JOB> -- Files created between 2007-01-17 and 2007-02-17 ------------------------------ 2007-02-17 12:22:55 0 d-------- C:\Program Files\HijackThis<HIJACK~1> 2007-02-17 09:31:31 0 d-------- C:\Program Files\Common Files\{262916F0-0512-1033-0804-03121620002c}<{26291~1> 2007-02-16 08:23:04 0 d-------- C:\Program Files\BillP Studios<BILLPS~1> 2007-02-14 13:32:05 0 d-------- C:\Documents and Settings\Administrator.MADMAX\Application Data\TuneUp Software<TUNEUP~1> 2007-02-14 11:53:45 0 d-------- C:\Documents and Settings\Administrator.MADMAX\Application Data\InterTrust<INTERT~1> 2007-02-14 11:53:44 774144 --a------ C:\Documents and Settings\Administrator.MADMAX\ntuser.dat 2007-02-14 11:03:49 0 d-------- C:\Program Files\QuickTime<QUICKT~1> 2007-02-08 14:18:27 135168 --a------ C:\WINDOWS\system32\igfxres.dll<Signed: Intel Corporation> 2007-02-08 11:36:44 0 d-------- C:\Program Files\Alien Shooter<ALIENS~1> 2007-02-08 11:36:29 0 d-------- C:\Program Files\ReflexiveArcade<REFLEX~1> 2007-02-07 22:10:18 0 d-------- C:\Program Files\BitComet 2007-02-07 15:35:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2007-02-02 07:27:26 0 d-------- C:\Program Files\ChrisTV 2007-02-02 06:50:32 0 d--hs---- C:\FOUND.004 2007-01-31 07:20:16 0 d--h----- C:\DBBackup 2007-01-30 22:48:30 10 --a------ C:\WINDOWS\smdat32m.sys<Unsigned: n/a> 2007-01-30 22:48:30 0 --a------ C:\WINDOWS\smdat32a.sys<Unsigned: n/a> 2007-01-30 22:48:28 0 d-------- C:\Program Files\Altnet 2007-01-30 17:32:02 24072 --a------ C:\WINDOWS\system32\uxtuneup.dll<Signed: TuneUp Software GmbH> 2007-01-30 17:31:49 0 d-------- C:\Program Files\TuneUp Utilities 2007<TUNEUP~1> 2007-01-30 11:57:18 155648 --a------ C:\WINDOWS\system32\ssleay32.dll<Unsigned: n/a> 2007-01-30 11:57:18 684032 --a------ C:\WINDOWS\system32\libeay32.dll<Unsigned: n/a> 2007-01-29 13:30:57 0 d-------- C:\Documents and Settings\SUPPORT_388945a0\Application Data\FarStone 2007-01-29 13:30:57 0 d-------- C:\Documents and Settings\HelpAssistant\Application Data\FarStone 2007-01-29 13:30:57 0 d-------- C:\Documents and Settings\Guest\Application Data\FarStone 2007-01-29 13:30:57 0 d-------- C:\Documents and Settings\Administrator\Application Data\FarStone 2007-01-29 13:10:39 646392 --a------ C:\WINDOWS\system32\drivers\sptd.sys<Unsigned: n/a> 2007-01-29 00:51:39 0 d-------- C:\Documents and Settings\All Users\Application Data\farstone 2007-01-29 00:34:28 36864 -----n--- C:\WINDOWS\system32\unVHDDrvExe.exe<UNVHDD~1.EXE><Unsigned: n/a> 2007-01-29 00:34:28 36864 -----n--- C:\WINDOWS\system32\inVHDDrvExe.exe<INVHDD~1.EXE><Unsigned: n/a> 2007-01-28 16:01:36 0 d--hs---- C:\FOUND.003 2007-01-26 09:18:54 200704 --a------ C:\WINDOWS\system32\ssldivx.dll<Unsigned: The OpenSSL Project, http://www.openssl.org/> 2007-01-26 09:18:54 1044480 --a------ C:\WINDOWS\system32\libdivx.dll<Unsigned: The OpenSSL Project, http://www.openssl.org/> 2007-01-26 09:13:45 196608 --a------ C:\WINDOWS\system32\dtu100.dll<Unsigned: DivX, Inc.> 2007-01-26 09:13:45 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll<Unsigned: DivXNetworks> 2007-01-26 09:13:45 73728 --a------ C:\WINDOWS\system32\dpl100.dll<Unsigned: DivX, Inc.> 2007-01-26 09:13:44 57344 --a------ C:\WINDOWS\system32\dpv11.dll<Unsigned: DivXNetworks> 2007-01-26 09:13:44 344064 --a------ C:\WINDOWS\system32\dpus11.dll<Unsigned: DivXNetworks> 2007-01-26 09:13:44 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll<Unsigned: DivXNetworks> 2007-01-26 09:13:44 294912 --a------ C:\WINDOWS\system32\dpu11.dll<Unsigned: DivXNetworks> 2007-01-26 09:13:44 294912 --a------ C:\WINDOWS\system32\dpu10.dll<Unsigned: DivXNetworks> 2007-01-26 09:13:42 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll<DIVX_X~2.DLL><Unsigned: DivX, Inc.> 2007-01-26 09:13:40 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll<DIVX_X~3.DLL><Unsigned: DivX, Inc.> 2007-01-26 09:13:40 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll<DIVX_X~1.DLL><Unsigned: DivX, Inc.> 2007-01-26 09:13:40 738906 --a------ C:\WINDOWS\system32\DivX.dll<Unsigned: DivX, Inc.> 2007-01-25 20:47:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Trymedia 2007-01-19 15:46:16 0 d-------- C:\Documents and Settings\All Users\Application Data\SnapStream<SNAPST~1> 2007-01-19 15:33:49 0 d-------- C:\Program Files\MSXML 4.0<MSXML4~1.0> 2007-01-17 23:02:31 639872 --a------ C:\WINDOWS\system32\drivers\3xHybrid.sys<Unsigned: Philips Semiconductors GmbH> 2007-01-17 23:02:31 3072 --a------ C:\WINDOWS\system32\34CoInstaller.dll<34COIN~1.DLL><Unsigned: n/a> 2007-01-17 12:34:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion<YAHOO!~1> 2007-01-17 12:02:51 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! -- Find3M Report ---------------------------------------------------------------- 2007-02-07 22:10:36 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll<BITCOM~1.DLL><Unsigned: BitComet> 2007-01-26 09:19:06 524288 --a------ C:\WINDOWS\system32\DivXsm.exe<Unsigned: DivX Inc.> 2007-01-26 09:19:04 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll<Unsigned: n/a> 2007-01-26 09:19:02 118520 -----n--- C:\WINDOWS\system32\pxinsi64.exe<Signed: Sonic Solutions> 2007-01-26 09:19:02 116472 -----n--- C:\WINDOWS\system32\pxcpyi64.exe<Signed: Sonic Solutions> 2007-01-26 09:19:02 129784 -----n--- C:\WINDOWS\system32\pxafs.dll<Signed: Sonic Solutions> 2007-01-26 09:19:02 36624 -----n--- C:\WINDOWS\system32\drivers\PxHelp20.sys<Unsigned: Sonic Solutions> 2007-01-15 16:25:52 0 d-------- C:\Program Files\Registry Mechanic<REGIST~1> 2007-01-12 12:20:28 0 d-------- C:\Documents and Settings\max\Application Data\WinPatrol<WINPAT~1> 2007-01-09 18:26:42 0 d-------- C:\Program Files\BitTorrent<BITTOR~1> 2007-01-09 17:58:22 0 d-------- C:\Program Files\F?nts 2007-01-08 12:24:30 36864 --a------ C:\WINDOWS\system32\svchosts.exe<Unsigned: n/a> 2007-01-08 12:18:24 0 d-------- C:\Program Files\TvInternet<TVINTE~1> 2007-01-08 12:18:24 0 d-------- C:\Program Files\Common Files\Nullsoft 2007-01-04 12:53:14 3047 --a------ C:\WINDOWS\mozver.dat 2007-01-04 11:23:24 0 d-------- C:\Documents and Settings\max\Application Data\DivX 2007-01-03 17:27:20 0 d-------- C:\Program Files\Google 2006-12-28 19:13:36 0 d-------- C:\Program Files\Xilisoft 2006-12-24 23:11:52 0 d-------- C:\Documents and Settings\max\Application Data\Nokia 2006-12-24 22:51:46 0 d-------- C:\Program Files\DIFX 2006-12-24 22:50:56 0 d-------- C:\Documents and Settings\max\Application Data\PC Suite<PCSUIT~1> 2006-12-24 22:50:42 0 d-------- C:\Program Files\Nokia 2006-12-21 15:13:36 0 d-------- C:\Documents and Settings\max\Application Data\VersionTracker Pro<VERSIO~1> 2006-12-19 12:42:18 0 d-------- C:\Program Files\thriXXX 2006-12-18 11:25:40 0 d-------- C:\Program Files\YAMAHA 2006-12-13 00:24:44 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll<DIVXWM~1.DLL><Unsigned: n/a> 2006-12-13 00:24:44 118784 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe<DIVXCO~1.EXE><Unsigned: DivX, Inc.> -- Registry Dump ---------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "LaunchApp"="Alaunch" "SoundMan"="SOUNDMAN.EXE" "AGRSMMSG"="AGRSMMSG.exe" "Apoint"="\"C:\\Program Files\\Apoint2K\\Apoint.exe\"" "LManager"="C:\\PROGRA~1\\LAUNCH~1\\CPLBCL53.EXE" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "Symantec NetDriver Monitor"="\"C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe\" /Consumer" "igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe" "igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe" "igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "WinPatrol"="C:\\Program Files\\BillP Studios\\WinPatrol\\winpatrol.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] "backup"="C:\\WINDOWS\\pss\\Adobe Acrobat Speed Launcher.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\Installer\\{AC76BA86-1033-0000-7760-000000000002}\\SC_Acrobat.exe " "item"="Adobe Acrobat Speed Launcher" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^max^Start Menu^Programs^Startup^Adobe Gamma.lnk] "backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE " "item"="Adobe Gamma" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^max^Start Menu^Programs^Startup^Wallpaper Calendar.lnk] "path"="C:\\Documents and Settings\\max\\Start Menu\\Programs\\Startup\\Wallpaper Calendar.lnk" "backup"="C:\\WINDOWS\\pss\\Wallpaper Calendar.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\zepsoft\\WALLPA~1\\WallCal3.exe /delay 5" "item"="Wallpaper Calendar" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Acrotray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="BJPSMAIN" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skype" "hkey"="HKCU" "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="realsched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Norton SystemWorks"="\"C:\\Program Files\\Norton SystemWorks\\cfgwiz.exe\" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "Norton SystemWorks"="\"C:\\Program Files\\Norton SystemWorks\\cfgwiz.exe\" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* UxTuneUp [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b26c5070-4274-11db-b207-0004236ff40e}] Shell\Auto\command BrO_AcT.exe Shell\AutoRun\command BrO_AcT.exe Shell\Explore\command BrO_AcT.exe Shell\OPEN\command BrO_AcT.exe -- End of ComboScan: finished at 2007-02-17 at 12:23:47 ------------------------- |
|
     
|
|
02-17-2007, 09:06 PM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,566
OS: Windows XP Pro
|
Hi and welcome to TSF.
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. You may wish to Subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription. Please be patient with me during this time.
__________________
 Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
02-18-2007, 09:52 AM
|
#3 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,566
OS: Windows XP Pro
|
Please save these instructions to Notepad as the internet will not be available to you at certain points of the removal process.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes. --------------------------------------------------------------------------------------------- The cleaning process is not instant. Please follow through to the end until I tell you your machine is clear. The absence of symptoms does not mean that everything is clean. Please make every effort to reply to my posts in a timely manner. Malware spreads quickly, and the longer an infection remains on a system, increases the llikelihood of any additional infections coming into your computer. --------------------------------------------------------------------------------------------- Open My Computer. Select the View menu and click Folder Options. Select the View Tab then select Show all files in the Hidden files section. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK. --------------------------------------------------------------------------------------------- Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) DO NOT run SDFix yet. We will shortly --------------------------------------------------------------------------------------------- Download AVG Anti Spyware Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows" 
--------------------------------------------------------------------------------------------- Download and install CCleaner..http://www.ccleaner.com/ccdownload.asp *Note* On the install please uncheck the option "Add CCleaner Yahoo toolbar and use CCleaner from within IE" 1. Open the program and the "Cleaner" button should be active. 2. Click on "Run Cleaner" 3. Once thats done it will clean out the TEMP folder. 4. Now click on "Issues" and then "Scan for Issues" 5. Once it's done checkmark ALL it finds and click "Fix Selected Issues" 6. It will ask you if you want to back up the registry entrys it's removing so please do so. If it removes anything important..just locate the .reg file you saved...double click on it to add the entrys back. Close the program. --------------------------------------------------------------------------------------------- P2P Software P2P - I see you have P2P software BitComet & BitTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. --------------------------------------------------------------------------------------------- Enter Safe Mode
Note: Some systems, this may be the F5 key, so try that if F8 doesn't work. --------------------------------------------------------------------------------------------- Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): K-Lite Mega Codec Pack 1.35 - Is a component of Kazaa, which is known for its adware thriXXX 3DSexVilla-030.001 <<<These types of programs usually contain adware, so I suggest you uninstall the program --------------------------------------------------------------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\FOUND.003 C:\FOUND.004 C:\WINDOWS\smdat32m.sys C:\WINDOWS\smdat32a.sys C:\Program Files\Common Files\{262916F0-0512-1033-0804-03121620002c} C:\Program Files\F?nts <<<The question mark can be any random character C:\Program Files\Altnet C:\Program Files\thriXXX --------------------------------------------------------------------------------------------- Run AVG Anti-Spyware Run AVG Anti-Spyware with it's updated definitions:(...it's important that all windows must be closed)
--------------------------------------------------------------------------------------------- Run SDFix
--------------------------------------------------------------------------------------------- Perform an online scan with Internet Explorer with Panda ActiveScan
* Turn off the real time scanner of any existing antivirus program while performing the online scan Paste the Panda Scan report here together with a new HiJack This log. --------------------------------------------------------------------------------------------- Please include the following in your next reply: AVG Anti-Spyware Report Report.txt Log Panda results New HijackThis Log
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
02-21-2007, 08:29 PM
|
#4 (permalink) |
|
Registered User
Join Date: Feb 2007
Posts: 12
OS: XP
|
update.exe
hi again.
these are the results of the scans.... --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 11:11:49 22/02/2007 + Scan result: C:\Documents and Settings\max\Application Data\TuneUp Software\TuneUp Utilities\Backups\00000033.rcb/00000054.fil -> Adware.Altnet : Cleaned with backup (quarantined). C:\Program Files\Altnet -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\ADM25.ADM25 -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\ADM25.ADM25\CurVer -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\ADM4.ADM4 -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\ADM4.ADM4\CurVer -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\TopSearch.TSLink -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\TopSearch.TSLink.1 -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\TopSearch.TSLink\CLSID -> Adware.Altnet : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\TopSearch.TSLink\CurVer -> Adware.Altnet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000018.DLL -> Adware.IESearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000015.exe/SaveUninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000015.exe/ffext.mod/{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll -> Adware.SaveNow : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000016.exe/Uninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000016.exe/search.dl~ -> Adware.SaveNow : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000016.exe/whse.exe -> Adware.SaveNow : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\WUSE.1 -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Recycled\Dc1\system.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000002.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP2\A0000162.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP3\A0000187.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP4\A0000257.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP5\A0000326.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP7\A0000414.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP7\A0000415.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP7\A0000416.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP7\A0000417.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP7\A0000418.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP7\A0000419.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP8\A0001224.dll -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP8\A0001225.dll -> Adware.Softomate : Cleaned with backup (quarantined). HKLM\SOFTWARE\webhancer -> Adware.WebHancer : Cleaned with backup (quarantined). HKLM\SOFTWARE\webhancer\CC -> Adware.WebHancer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{88E8CE90-9E51-4BCD-AABB-A4526D600B0B}\RP1\A0000013.exe -> Adware.Whenu : Cleaned with backup (quarantined). C:\WINDOWS\system32\svchosts.exe -> Downloader.Agent.bca : Cleaned with backup (quarantined). C:\Documents and Settings\max\Application Data\TuneUp Software\TuneUp Utilities\Backups\00000033.rcb/00000073.fil -> Downloader.Small.buy : Cleaned with backup (quarantined). ::Report end SDFix: Version 1.66 Run by max - 22/02/2007 @ 11:14:26.73 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Name: COM+ Messages Path: "C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001377 COM+ Messages Deleted Restoring Windows Registry Entries Restoring Default Hosts File Rebooting... Normal Mode: Checking Files: Below files will be copied to Backups folder then removed: C:\WINDOWS\system32\unsvchosts.lzma - Deleted ADS Check: C:\WINDOWS\system32 No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\Messenger\\MSMSGS.EXE"="C:\\Program Files\\Messenger\\MSMSGS.EXE:*:Enabled:Windows Messenger" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++" "C:\\Documents and Settings\\MAX\\Desktop\\dota\\Frozen Throne.exe"="C:\\Documents and Settings\\MAX\\Desktop\\dota\\Frozen Throne.exe:*:Enabled:Frozen Throne" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\TVAnts\\Tvants.exe"="C:\\Program Files\\TVAnts\\Tvants.exe:*:Enabled:TVAnts" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"="C:\\Program Files\\TVUPlayer\\TVUPlayer.exe:*:Enabled:TVU Player Component" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: --------------- Backups Folder: - C:\SDFix\backups\backups.zip Checking For Files with Hidden Attributes : C:\WINDOWS\system32\NTICDMK32.dll C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\5a0d771158cfd69be5ddd26d8f58c73b\BIT5.tmp C:\Documents and Settings\All Users\DRM\Cache\Indiv03.tmp Add/Remove Programs List: Adobe Acrobat 7.0 Professional Adobe Photoshop CS2 Adobe Shockwave Player Agere Systems AC'97 Modem Alien Shooter AVG Anti-Spyware 7.5 CCleaner (remove only) DC++ 0.680 DivX Content Uploader Microsoft Internationalized Domain Names Mitigation APIs Windows Internet Explorer 7 Indeor Software LiveReg (Symantec Corporation) LiveUpdate 3.0 (Symantec Corporation) Launch Manager Microsoft Compression Client Pack 1.0 for Windows XP Microsoft National Language Support Downlevel APIs PCWH Registry Mechanic 6.0 Satellite TV for PC Elite 4.8.8.0 Adobe Flash Player 9 ActiveX Skype (BETA) WARP13 Norton SystemWorks 2005 (Symantec Corporation) Theme Creator Pro 3.1.260 SR-1 TravelMate 290 TVAnts 1.0 TVUPlayer 2.3.0.0 VideoLAN VLC media player 0.8.2 Wallpaper Calendar Winamp (remove only) Windows XP Service Pack 2 WinRAR archiver Microsoft User-Mode Driver Framework Feature Pack 1.0 XviD 1.1 final uninstall Yahoo! Toolbar Yahoo! Messenger Yahoo! Install Manager YAMAHA ATS-MA5-SMAF Google Toolbar for Internet Explorer Adobe Photoshop CS2 Internet Worm Protection Google Toolbar for Firefox SymNet WinPatrol J2SE Runtime Environment 5.0 Update 7 J2SE Runtime Environment 5.0 Update 9 DFX for Windows Media Player EasyGPRS Norton CleanSweep ChrisTV Professional 4.99 PowerDVD MSXML 4.0 SP2 Parser and SDK Norton SystemWorks 2005 Nokia Nseries Skin for Microsoft Windows Media Player SPBBC Adobe Stock Photos 1.0 DivX Codec Intel(R) Extreme Graphics 2 Driver DivX Player Adobe Common File Installer NSW_DRM_COLLECTION Microsoft Office Professional Edition 2003 Microsoft Office Visio Professional 2003 Noiseware Community Edition Norton SystemWorks ALPS Touch Pad Driver Adobe Acrobat 7.0 Professional DivX Converter DivX Web Player Adobe Bridge 1.0 Norton AntiVirus 2005 TuneUp Utilities 2007 Symantec Network Drivers Update Microsoft .NET Framework 1.1 MSRedist Nero 7 Demo Symantec Script Blocking Installer Google Toolbar for Internet Explorer ccCommon Norton AntiVirus Parent MSI Beyond TV DVD Burning Foundation Adobe Help Center 1.0 Huge Pine USB to UART Driver QuickTime Guitar Pro 4 Norton WMI Update Realtek AC'97 Audio Finished Incident Status Location Potentially unwanted tool:application/need2find Not disinfected hkey_local_machine\software\Need2Find Adware:adware/savenow Not disinfected Windows Registry Potentially unwanted tool:application/altnet Not disinfected hkey_classes_root\clsid\{B7156514-A76C-4545-9D5B-A4E1D02C7AEC} Dialer:dialer.min Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB893839-10F0-4AF9-92FA-B23528F530AF} Adware:adware/rxtoolbar Not disinfected Windows Registry Adware:adware/whenusearch Not disinfected Windows Registry Adware:adware/webhancer Not disinfected Windows Registry Potentially unwanted tool:Application/RealSpy Not disinfected C:\WINDOWS\SYSTEM32\ACTSKN45.OCX Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\MAX\Desktop\SDFix.exe[SDFix\apps\Process.exe] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\MAX\Cookies\max@atdmt[2].txt Potentially unwanted tool:Application/ErrorGuard Not disinfected C:\Program Files\DC++\Downloads\TAB\setuperrorguard.exe Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\APPS\Process.exe Adware:Adware/Gator Not disinfected D:\SOFTWARE\CODEC\DivXPro511Adware.exe[Gain_Trickler.exe] Potentially unwanted tool:Application/MotherboardMonitor.A Not disinfected D:\SOFTWARE\mIRC\sysreset_2.53.exe[addons\moo.dll] Logfile of HijackThis v1.99.1 Scan saved at 12:24:54, on 22/02/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\SYSTEM32\notepad.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Apoint2K\Apoint.exe C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\zepsoft\Wallpaper Calendar\WallCal3.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\hijackthis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID} R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8080;http=localhost:8080;https=localhost:8080;socks=localhost:1080 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe" O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Wallpaper Calendar.lnk = C:\Program Files\zepsoft\Wallpaper Calendar\WallCal3.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocx O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe |
|
|
|
|
02-22-2007, 07:36 PM
|
#5 (permalink) | |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,566
OS: Windows XP Pro
|
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now.
Open notepad and copy/paste the text in the quotebox below: (don't forget to copy and paste REGEDIT4) Quote:
It should look like this:  Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards. --------------------------------------------------------------------------------------------- Enter Safe Mode
Note: Some systems, this may be the F5 key, so try that if F8 doesn't work. --------------------------------------------------------------------------------------------- Delete the following Files indicated in RED if they still exist. C:\WINDOWS\SYSTEM32\ACTSKN45.OCX C:\Program Files\DC++\Downloads\TAB\setuperrorguard.exe D:\SOFTWARE\CODEC\DivXPro511Adware.exe D:\SOFTWARE\mIRC\sysreset_2.53.exe --------------------------------------------------------------------------------------------- Can you tell me what else is in the folder in blue C:\Program Files\DC++\Downloads\TAB --------------------------------------------------------------------------------------------- Restart your computer in Normal Mode --------------------------------------------------------------------------------------------- Perform an online scan with Internet Explorer with Kaspersky WebScanner Next Click on Launch Kaspersky Anti-Virus Web Scanner You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
--------------------------------------------------------------------------------------------- Please include the following in your next reply: Kaspersky Results Whats are the contents inside the following folder: C:\Program Files\DC++\Downloads\TAB How is your system behaving now?
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
located at the bottom of the page.
then click 