|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
03-29-2007, 08:55 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2003
Posts: 58
OS: Windows XP Home
|
AdAware and HJT Logs - Clean Now?
Ad-Aware SE Build 1.06r1
Logfile Created on:March 29, 2007 10:07:41 PM Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R163 26.03.2007 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» None »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Definition File: ========================= Definitions File Loaded: Reference Number : SE1R160 14.03.2007 Internal build : 200 File location : C:\Program Files\Lavasoft\Ad-Aware SE Personal\defs.ref File size : 1060117 Bytes Total size : 3464784 Bytes Signature data size : 3424359 Bytes Reference data size : 39913 Bytes Signatures total : 90990 CSI Fingerprints total : 6451 CSI data size : 318976 Bytes Target categories : 15 Target families : 1072 29-03-2007 10  39 PM Performing WebUpdate...Installing Update... Definitions File Loaded: Reference Number : SE1R163 26.03.2007 Internal build : 203 File location : C:\Program Files\Lavasoft\Ad-Aware SE Personal\defs.ref File size : 1085388 Bytes Total size : 3542513 Bytes Signature data size : 3501943 Bytes Reference data size : 40058 Bytes Signatures total : 92918 CSI Fingerprints total : 6630 CSI data size : 330158 Bytes Target categories : 15 Target families : 1080 29-03-2007 10 58 PM SuccessUpdate successfully downloaded and installed. Memory + processor status: ========================== Number of processors : 1 Processor architecture : Intel Pentium IV Memory available:34 % Total physical memory:260592 kb Available physical memory:87024 kb Total page file size:640476 kb Available on page file:376932 kb Total virtual memory:2097024 kb Available virtual memory:2031200 kb OS:Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Ad-Aware SE Settings =========================== Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan within archives Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 29-03-2007 10:07:41 PM - Scan started. (Full System Scan) Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 440 ThreadCreationTime : 30-03-2007 3:23:31 AM BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 496 ThreadCreationTime : 30-03-2007 3:23:41 AM BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 520 ThreadCreationTime : 30-03-2007 3:23:43 AM BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 564 ThreadCreationTime : 30-03-2007 3:23:47 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 576 ThreadCreationTime : 30-03-2007 3:23:48 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 724 ThreadCreationTime : 30-03-2007 3:23:55 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 788 ThreadCreationTime : 30-03-2007 3:23:58 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 856 ThreadCreationTime : 30-03-2007 3:23:59 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 956 ThreadCreationTime : 30-03-2007 3:23:59 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1044 ThreadCreationTime : 30-03-2007 3:24:02 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [lexbces.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1112 ThreadCreationTime : 30-03-2007 3:24:03 AM BasePriority : Normal FileVersion : 9.35 ProductVersion : 9.35 ProductName : MarkVision for Windows (32 bit) CompanyName : Lexmark International, Inc. FileDescription : LexBce Service InternalName : LexBce Service LegalCopyright : (C) 1993 - 2003 Lexmark International, Inc. OriginalFilename : LexBceS.exe #:12 [lexpps.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1136 ThreadCreationTime : 30-03-2007 3:24:04 AM BasePriority : Normal FileVersion : 9.35 ProductVersion : 9.35 ProductName : MarkVision for Windows (32 bit) CompanyName : Lexmark International, Inc. FileDescription : LEXPPS.EXE InternalName : LEXPPS LegalCopyright : (C) 1993 - 2003 Lexmark International, Inc. OriginalFilename : LEXPPS.EXE Comments : MarkVision for Windows '95 New P2P Server (32-bit) #:13 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1144 ThreadCreationTime : 30-03-2007 3:24:04 AM BasePriority : Normal FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) ProductVersion : 5.1.2600.2696 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:14 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1348 ThreadCreationTime : 30-03-2007 3:24:11 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:15 [mcdetect.exe] FilePath : c:\program files\mcafee.com\agent\ ProcessID : 1372 ThreadCreationTime : 30-03-2007 3:24:12 AM BasePriority : Normal FileVersion : 6, 0, 0, 19 ProductVersion : 6, 0, 0, 0 ProductName : McAfee SecurityCenter CompanyName : McAfee, Inc FileDescription : McAfee WSC Integration Service InternalName : McDetect LegalCopyright : Copyright © 2005 McAfee, Inc. OriginalFilename : McDetect.exe Comments : McAfee WSC Integration Service #:16 [mcshield.exe] FilePath : c:\PROGRA~1\mcafee.com\vso\ ProcessID : 1420 ThreadCreationTime : 30-03-2007 3:24:12 AM BasePriority : High #:17 [mctskshd.exe] FilePath : c:\PROGRA~1\mcafee.com\agent\ ProcessID : 1460 ThreadCreationTime : 30-03-2007 3:24:14 AM BasePriority : Normal FileVersion : 6, 0, 0, 13 ProductVersion : 6, 0, 0, 0 ProductName : McAfee SecurityCenter CompanyName : McAfee, Inc FileDescription : McAfee Task Scheduler InternalName : McTskshd LegalCopyright : Copyright © 2005 McAfee, Inc. OriginalFilename : McTskshd.exe #:18 [tcpsvcs.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1576 ThreadCreationTime : 30-03-2007 3:24:19 AM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : TCP/IP Services Application InternalName : TCPSVCS.EXE LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : TCPSVCS.EXE #:19 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1600 ThreadCreationTime : 30-03-2007 3:24:21 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:20 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1936 ThreadCreationTime : 30-03-2007 3:24:34 AM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:21 [hkcmd.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 936 ThreadCreationTime : 30-03-2007 3:25:32 AM BasePriority : Normal FileVersion : 3.0.0.4342 ProductVersion : 7.0.0.4342 ProductName : Intel(R) Common User Interface CompanyName : Intel Corporation FileDescription : hkcmd Module InternalName : HKCMD LegalCopyright : Copyright 1999-2004, Intel Corporation OriginalFilename : HKCMD.EXE #:22 [dlbfbmgr.exe] FilePath : C:\Program Files\Dell AIO Printer A960\ ProcessID : 1004 ThreadCreationTime : 30-03-2007 3:25:33 AM BasePriority : Normal FileVersion : 0.1.25.0 ProductVersion : 0.1.25.0 ProductName : Button Manager Executable FileDescription : Dell AIO Printer A960 Button Manager InternalName : dlbfbmgr.exe OriginalFilename : dlbfbmgr.exe #:23 [jusched.exe] FilePath : C:\Program Files\Java\jre1.5.0_11\bin\ ProcessID : 1032 ThreadCreationTime : 30-03-2007 3:25:35 AM BasePriority : Normal #:24 [mcvsshld.exe] FilePath : C:\Program Files\McAfee.com\VSO\ ProcessID : 1084 ThreadCreationTime : 30-03-2007 3:25:36 AM BasePriority : Normal FileVersion : 10, 0, 0, 22 ProductVersion : 10, 0, 0, 0 ProductName : McAfee VirusScan CompanyName : McAfee, Inc. FileDescription : McAfee VirusScan ActiveShield Resource InternalName : McVsShld LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved. OriginalFilename : McVsShld.exe Comments : McAfee VirusScan ActiveShield Resource #:25 [dlbfbmon.exe] FilePath : C:\Program Files\Dell AIO Printer A960\ ProcessID : 1056 ThreadCreationTime : 30-03-2007 3:25:36 AM BasePriority : Normal FileVersion : 0.1.25.0 ProductVersion : 0.1.25.0 ProductName : Button Monitor Executable FileDescription : Dell AIO Printer A960 Button Monitor InternalName : dlbfbmon.exe OriginalFilename : dlbfbmon.exe #:26 [oasclnt.exe] FilePath : C:\Program Files\McAfee.com\VSO\ ProcessID : 1248 ThreadCreationTime : 30-03-2007 3:25:36 AM BasePriority : Normal FileVersion : 10, 0, 0, 24 ProductVersion : 10, 0, 0, 0 ProductName : McAfee VirusScan CompanyName : McAfee, Inc. FileDescription : McAfee VirusScan OAS Client InternalName : OasClnt LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved. OriginalFilename : OasClnt.exe Comments : McAfee VirusScan OAS Client #:27 [mcagent.exe] FilePath : C:\PROGRA~1\mcafee.com\agent\ ProcessID : 1164 ThreadCreationTime : 30-03-2007 3:25:39 AM BasePriority : Normal FileVersion : 6, 0, 0, 16 ProductVersion : 6, 0, 0, 0 ProductName : McAfee SecurityCenter CompanyName : McAfee, Inc FileDescription : McAfee SecurityCenter Agent InternalName : mcagent LegalCopyright : Copyright © 2005 McAfee, Inc. OriginalFilename : mcagent.exe #:28 [mcvsescn.exe] FilePath : c:\progra~1\mcafee.com\vso\ ProcessID : 1644 ThreadCreationTime : 30-03-2007 3:25:40 AM BasePriority : Normal FileVersion : 10, 0, 0, 20 ProductVersion : 10, 0, 0, 0 ProductName : McAfee VirusScan CompanyName : McAfee, Inc. FileDescription : McAfee VirusScan E-mail Scan Module InternalName : mcvsescn LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved. OriginalFilename : mcvsescn.EXE Comments : McAfee VirusScan E-mail Scan Module #:29 [msmsgs.exe] FilePath : C:\Program Files\Messenger\ ProcessID : 1920 ThreadCreationTime : 30-03-2007 3:25:46 AM BasePriority : Normal FileVersion : 4.7.2009 ProductVersion : Version 4.7 ProductName : Messenger CompanyName : Microsoft Corporation FileDescription : Messenger InternalName : msmsgs LegalCopyright : Copyright (c) Microsoft Corporation 1997-2003 LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. OriginalFilename : msmsgs.exe #:30 [msnmsgr.exe] FilePath : C:\Program Files\MSN Messenger\ ProcessID : 1704 ThreadCreationTime : 30-03-2007 3:25:50 AM BasePriority : Normal FileVersion : 7.5.0324 ProductVersion : 7.5.0324 ProductName : MSN Messenger CompanyName : Microsoft Corporation FileDescription : MSN Messenger InternalName : msnmsgr LegalCopyright : Copyright (c) Microsoft Corporation 1997-2004 LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. OriginalFilename : msnmsgr.exe #:31 [ctfmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 172 ThreadCreationTime : 30-03-2007 3:25:51 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:32 [wmpnscfg.exe] FilePath : C:\Program Files\Windows Media Player\ ProcessID : 816 ThreadCreationTime : 30-03-2007 3:25:53 AM BasePriority : Normal FileVersion : 11.0.5721.5145 (WMP_11.061018-2006) ProductVersion : 11.0.5721.5145 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Media Player Network Sharing Service Configuration Application LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WMPNSCFG.EXE #:33 [sgmain.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 284 ThreadCreationTime : 30-03-2007 3:26:01 AM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SpywareGuard FileDescription : SpywareGuard InternalName : sgmain LegalCopyright : Copyright (C) 2002-2003 Javacool Software LLC OriginalFilename : sgmain.exe Comments : SpywareGuard #:34 [mcvsftsn.exe] FilePath : c:\progra~1\mcafee.com\vso\ ProcessID : 672 ThreadCreationTime : 30-03-2007 3:26:18 AM BasePriority : Normal FileVersion : 10, 0, 0, 19 ProductVersion : 10, 0, 0, 0 ProductName : McAfee VirusScan CompanyName : McAfee, Inc. FileDescription : McAfee VirusScan Instant Messenger Scan Module InternalName : mcvsftsn LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved. OriginalFilename : mcvsftsn.EXE Comments : McAfee VirusScan Instant Messenger Scan Module #:35 [sgbhp.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 1768 ThreadCreationTime : 30-03-2007 3:26:24 AM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SG Browser Hijacking Protection FileDescription : SG Browser Hijacking Protection InternalName : sgbhp LegalCopyright : Copyright (C) 2002-2003 Javacool Software LLC. OriginalFilename : sgbhp.exe Comments : SG Browser Hijacking Protection #:36 [wuauclt.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2772 ThreadCreationTime : 30-03-2007 4:04:39 AM BasePriority : Normal FileVersion : 5.8.0.2469 built by: lab01_n(wmbla) ProductVersion : 5.8.0.2469 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Automatic Updates InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wuauclt.exe #:37 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 2832 ThreadCreationTime : 30-03-2007 4 14 AMBasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Scanning Hosts file...... Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 693 entries scanned. New critical objects:0 Objects found so far: 0 10:35:46 PM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:28:05.156 Objects scanned:204261 Objects identified:0 Objects ignored:0 New critical objects:0 Logfile of HijackThis v1.99.1 Scan saved at 10:41:18 PM, on 29/03/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Dell AIO Printer A960\dlbfbmgr.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\McAfee.com\VSO\mcvsshld.exe C:\Program Files\Dell AIO Printer A960\dlbfbmon.exe C:\Program Files\McAfee.com\VSO\oasclnt.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\SpywareGuard\sgmain.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\HJT\HijackThis.exe C:\Program Files\Microsoft Office\Office\WINWORD.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/cust...//my.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Dell AIO Printer A960] "C:\Program Files\Dell AIO Printer A960\dlbfbmgr.exe" O4 - HKLM\..\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: Ali Baba Slots TM by pogo - http://game1.pogo.com/applet-6.4.3.3...-ob-assets.cab O16 - DPF: Big Shot Roulette TM by pogo - http://game1.pogo.com/applet-6.4.3.2...-ob-assets.cab O16 - DPF: Buckaroo Blackjack TM by pogo - http://game1.pogo.com/applet-6.4.3.2...-ob-assets.cab O16 - DPF: Double Deuce Poker by pogo - http://game1.pogo.com/applet-6.4.3.2...-ob-assets.cab O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.4.3.2...-ob-assets.cab O16 - DPF: Jokers Wild Poker by pogo - http://game1.pogo.com/applet-6.4.3.2...-ob-assets.cab O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.4.3.3...-ob-assets.cab O16 - DPF: SciFi Slots by pogo - http://game1.pogo.com/applet-6.4.3.3...-ob-assets.cab O16 - DPF: Showbiz Slots 2 by pogo - http://game1.pogo.com/applet-6.4.3.3...-ob-assets.cab O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.4.3.3...-ob-assets.cab O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/u...lorer1_8us.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security3.norton.com/SSC/Shar.../bin/cabsa.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe |
|
     
|
|
04-05-2007, 06:35 PM
|
#3 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 25,369
OS: 2000 Pro; XP Pro; XP Home
|
Re: AdAware and HJT Logs - Clean Now?
Hello and Welcome. Apologies for any delay in replying, but we have been rather busy lately.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. At a glance, your logs appear clean. Are you having any issues which make you think you need malware removal assistance? Since it has been a few days since you first posted, please do this: Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
What DSS will do:
--------------------------------------------------------------------------------------------- Thank you.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Our help is voluntary, but this site needs donations to operate.
Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience. |
|
|
|
|
| Thread Tools | |
|
|
