![]() |
![]() |
![]() |
|||||
![]() |
![]() |
![]() |
![]() |
![]() |
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
![]() |
|
|
Thread Tools |
|
|
#1 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 1
OS: Windows XP SP3
|
Hijackthis log
Lately been experiencing slower download speeds, Firefox sometimes giving a "time out" message when browsing (can continue by pressing 'Try again' thou), a new "Internet Gateway" has shown up among my Network Connections, I can't remove it, getting the message "The connection is currently busy with a connect or disconnect operation" whenever I try (even with internet unplugged). Also some applications (such as DC++) give me error messages like "Connection was closed by client software" (with client being me of course). Could this be malware/virus or anything like it? Here are my logs:
From DSS: Deckard's System Scanner v20071014.68 Run by Joakim on 2008-02-13 01:12:27 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 19: 2008-02-13 00:12:34 UTC - RP263 - Deckard's System Scanner Restore Point 18: 2008-02-12 22:50:41 UTC - RP262 - Installed ESET NOD32 Antivirus 17: 2008-02-12 22:37:16 UTC - RP261 - Removed Kaspersky Anti-Virus 7.0. 16: 2008-02-12 16:54:07 UTC - RP260 - Installed Windows Media Format Runtime 15: 2008-02-12 16:36:02 UTC - RP259 - Installed Conflict Denied Ops. -- First Restore Point -- 1: 2008-02-08 17:08:13 UTC - RP245 - System Checkpoint Backed up registry hives. Performed disk cleanup. System Drive I: has 15.15 GiB (less than 15%) free. -- HijackThis (run as Joakim.exe) ---------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:16:46, on 2008-02-13 Platform: Windows XP SP3, v.3300 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20696) Boot mode: Normal Running processes: I:\WINDOWS\System32\smss.exe I:\WINDOWS\system32\winlogon.exe I:\WINDOWS\system32\services.exe I:\WINDOWS\system32\lsass.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\svchost.exe I:\WINDOWS\System32\svchost.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\spoolsv.exe I:\WINDOWS\ATKKBService.exe I:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe I:\Program Files\PerfectDisk2008\PD91Agent.exe I:\Program Files\Cyberlink\Shared files\RichVideo.exe I:\Program Files\UPHClean\uphclean.exe I:\WINDOWS\Explorer.EXE I:\WINDOWS\system32\WgaTray.exe I:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE I:\WINDOWS\system32\ctfmon.exe I:\Program Files\DAEMON Tools Pro\DTProAgent.exe I:\Program Files\Messenger\msmsgs.exe I:\Program Files\Samurize\Client.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe I:\WINDOWS\System32\svchost.exe I:\Program Files\ASUS SmartDoctor\SmartDoctor.exe I:\Documents and Settings\Joakim\My Documents\Installationsfiler\dss.exe I:\Program Files\uTorrent\uTorrent.exe I:\PROGRA~1\HIJACK~1\Joakim.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Länkhjälp till Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - I:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [egui] "I:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ASUS SmartDoctor] I:\Program Files\ASUS SmartDoctorSmartDoctor.exe /start O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "I:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user') O4 - Startup: Client Default.lnk = I:\Program Files\Samurize\Client.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: i:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A770C839-C234-4E55-B4D0-CA1D962F0612}: NameServer = 195.67.199.42,195.67.199.43 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - I:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - I:\WINDOWS\ATKKBService.exe O23 - Service: d2cs service (d2cs) - Unknown owner - I:\Documents and Settings\Joakim\Desktop\pvpgn-1.8.2\d2csConsole.exe (file missing) O23 - Service: d2dbs service (d2dbs) - Unknown owner - I:\Documents and Settings\Joakim\Desktop\pvpgn-1.8.2\d2dbsConsole.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - I:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - I:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: PD91Agent - Raxco Software, Inc. - I:\Program Files\PerfectDisk2008\PD91Agent.exe O23 - Service: PD91Engine - Raxco Software, Inc. - I:\Program Files\PerfectDisk2008\PD91Engine.exe O23 - Service: PvPGN service (pvpgn) - Unknown owner - I:\Documents and Settings\Joakim\Desktop\pvpgn-1.8.2\PvPGNConsole.exe (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - I:\Program Files\Cyberlink\Shared files\RichVideo.exe -- End of file - 6775 bytes -- File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* .js - JSFile - DefaultIcon - "I:\Program Files\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe",7 .js - JSFile - shell\open\command - "I:\Program Files\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1" -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 asuskbnt (Enhanced Display Driver Helper Service) - i:\windows\system32\drivers\atkkbnt.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Help driver For Keyboard Service.> R1 SCDEmu - i:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu> R2 EIO - i:\windows\system32\drivers\eio.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Kernel Mode Driver for NT> R3 Video3D (ASUS Video3D Service) - i:\windows\system32\drivers\video3d32.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Video3D driver> R4 atidgllk - i:\windows\atidgllk.sys <Not Verified; Overclocking Tool; Overclocking Tool> S1 ATITool (ATITool Overclocking Utility) - i:\windows\system32\drivers\atitool.sys <Not Verified; ; Low-Level Driver> S3 AgereSoftModem (Agere Systems Soft Modem) - i:\windows\system32\drivers\agrsm.sys (file missing) S3 mcdbus (Driver for MagicISO SCSI Host Controller) - i:\windows\system32\drivers\mcdbus.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 ATKKeyboardService (ATK Keyboard Service) - i:\windows\atkkbservice.exe <Not Verified; ASUSTeK COMPUTER INC.; ASUS Keyboard Service> R2 UPHClean (User Profile Hive Cleanup) - i:\program files\uphclean\uphclean.exe <Not Verified; Microsoft Corporation; User Profile Hive Cleanup Service> S2 d2cs (d2cs service) - i:\documents and settings\joakim\desktop\pvpgn-1.8.2\d2csconsole.exe --service (file missing) S2 d2dbs (d2dbs service) - i:\documents and settings\joakim\desktop\pvpgn-1.8.2\d2dbsconsole.exe --service (file missing) S2 pvpgn (PvPGN service) - i:\documents and settings\joakim\desktop\pvpgn-1.8.2\pvpgnconsole.exe --service (file missing) S3 FLEXnet Licensing Service - "i:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> S4 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "i:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Hamachi Network Interface Device ID: ROOT\NET\0000 Manufacturer: LogMeIn, Inc. Name: Hamachi Network Interface PNP Device ID: ROOT\NET\0000 Service: hamachi -- Files created between 2008-01-13 and 2008-02-13 ----------------------------- 2008-02-12 23:50:44 0 d-------- I:\Documents and Settings\All Users\Application Data\ESET 2008-02-12 23:42:27 262144 --a------ I:\WINDOWS\system32\default_user_class.dat 2008-02-12 23:19:55 0 d-------- I:\WINDOWS\vbSkinner 2008-02-12 23:19:19 0 d-------- I:\Program Files\PFConfig 2008-02-12 21:44:13 0 d-------- I:\Program Files\DC++ 2008-02-12 19:22:32 4212 ---h----- I:\WINDOWS\system32\zllictbl.dat 2008-02-12 19:21:22 0 d-------- I:\WINDOWS\Internet Logs 2008-02-12 17:36:06 0 d-------- I:\Program Files\Conflict Denied Ops 2008-02-10 23:42:17 0 d-------- I:\Program Files\Malicious Software Removal Tool 2008-02-10 23:38:05 0 d-------- I:\Program Files\UPHClean 2008-02-10 23:37:33 0 d-------- I:\Program Files\HighMAT CD Writing Wizard 2008-02-10 23:37:28 0 d-------- I:\WINDOWS\Downloaded Installations 2008-02-10 23:35:20 0 d-------- I:\WINDOWS\system32\URTTEMP 2008-02-10 23:29:00 40960 --a------ I:\WINDOWS\system32\SSUBTMR6.DLL <Not Verified; vbAccelerator; SSubTmr6> 2008-02-10 23:29:00 10752 --a------ I:\WINDOWS\system32\aamd532.dll <Not Verified; Almeida & Andrade Ltda; MD5 Maker DLL> 2008-02-10 23:17:33 0 d-------- I:\Program Files\AutoPatcher 2008-02-10 20:55:25 0 d-------- I:\Program Files\WindowBlinds 2008-02-10 19:48:46 0 d-------- I:\Documents and Settings\Joakim\Application Data\Innovatools 2008-02-10 19:46:38 0 d-------- I:\Program Files\Desktop Commander 2008-02-10 19:18:47 0 d-------- I:\Documents and Settings\All Users\Application Data\Visual Styler 2008-02-10 19:17:48 2216448 --a------ I:\WINDOWS\system32\ntoskvs1.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-02-10 19:14:47 0 d-------- I:\WINDOWS\Icons 2008-02-10 19:10:01 0 d-------- I:\Program Files\AusLogics Visual Styler 2008-02-10 19:03:10 0 d-------- I:\Program Files\StarSkin 2008-02-10 18:56:01 0 d-------- I:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-02-10 18:43:36 0 d-------- I:\Program Files\CustomIcons 2008-02-10 18:14:11 0 dr-hs---- I:\Documents and Settings\Joakim\Recent 2008-02-10 16:46:00 0 d-------- I:\Documents and Settings\Joakim\Application Data\ExportTool 2008-02-10 15:52:20 0 d-------- I:\Program Files\Samurize 2008-02-10 15:36:59 0 d-------- I:\Program Files\Cyberlink 2008-02-10 15:35:50 0 d-------- I:\Program Files\PowerDVD 2008-02-10 15:10:03 0 d-------- I:\Documents and Settings\All Users\Application Data\Raxco 2008-02-10 15:10:02 0 d-------- I:\Program Files\PerfectDisk2008 2008-02-10 15:09:37 0 d-------- I:\Documents and Settings\All Users\Application Data\Avg7 2008-02-10 15:09:13 0 d-------- I:\Program Files\PerfectDisk2008Install 2008-02-10 14:48:49 0 d-------- I:\WINDOWS\Prefetch 2008-02-10 14:41:40 0 d-------- I:\WINDOWS\system32\en 2008-02-10 14:41:40 0 d-------- I:\WINDOWS\system32\bits 2008-02-10 14:38:48 0 d-------- I:\WINDOWS\ServicePackFiles 2008-02-07 20:30:20 0 d-------- I:\Program Files\Kali95 2008-02-07 20:05:00 0 d-a------ I:\Program Files\pvpgn-1.8.2 2008-02-07 15:51:24 0 d-------- I:\Program Files\Sins of a Solar Empire 2008-02-06 18:11:51 10752 --a------ I:\WINDOWS\system32\drivers\Video3D32.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Video3D driver> 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\nVivid.bin 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\nStandard.bin 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\nAsmedia.bin 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\nAdvanced.bin 2008-02-06 18:11:51 8704 --a------ I:\WINDOWS\system32\drivers\Bravo.sys <Not Verified; ASMT; Microsoft(R) Windows NT(R) Operating System> 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\aVivid.bin 2008-02-06 18:11:51 11008 --a------ I:\WINDOWS\system32\drivers\atkkbnt.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Help driver For Keyboard Service.> 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\aStandard.bin 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\aAsmedia.bin 2008-02-06 18:11:51 196608 --a------ I:\WINDOWS\system32\drivers\aAdvanced.bin 2008-02-06 18:11:51 110592 --a------ I:\WINDOWS\R5ClkLib.dll <Not Verified; ; Overclocker> 2008-02-06 18:11:51 114688 --a------ I:\WINDOWS\OneTouchVga.dll <Not Verified; ASUSTek; ASUS OneTouchVga> 2008-02-06 18:11:51 20480 --a------ I:\WINDOWS\HyperDrive.exe <Not Verified; ; HyperDrive Application> 2008-02-06 18:11:51 15360 --a------ I:\WINDOWS\EIO64.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Kernel Mode Driver for NT> 2008-02-06 18:11:51 12288 --a------ I:\WINDOWS\EIO.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Kernel Mode Driver for NT> 2008-02-06 18:11:51 90112 --a------ I:\WINDOWS\EIO.dll <Not Verified; ASUSTek Computer Inc.,; ASUS EIO.DLL> 2008-02-06 18:11:51 258560 --a------ I:\WINDOWS\ATKKBService.exe <Not Verified; ASUSTeK COMPUTER INC.; ASUS Keyboard Service> 2008-02-06 18:11:51 163840 --a------ I:\WINDOWS\atistclk.dll <Not Verified; ATI Technologies Inc.; ATI WinClk DLL> 2008-02-06 18:11:51 188416 --a------ I:\WINDOWS\atipdlxx.dll <Not Verified; ATI Technologies, Inc.; ATI Desktop Component> 2008-02-06 18:11:51 7680 --a------ I:\WINDOWS\atillk64.sys <Not Verified; Overclocking Tool; Overclocking Tool> 2008-02-06 18:11:51 15872 --a------ I:\WINDOWS\atikia64.sys <Not Verified; Overclocking Tool; Overclocking Tool> 2008-02-06 18:11:51 5376 --a------ I:\WINDOWS\atidgllk.sys <Not Verified; Overclocking Tool; Overclocking Tool> 2008-02-06 18:11:51 639046 --a------ I:\WINDOWS\aticlocklib.dll 2008-02-06 18:11:51 73728 --a------ I:\WINDOWS\ASUSRC.dll <Not Verified; ASUS; ASUSRC> 2008-02-06 18:11:50 944128 --a------ I:\WINDOWS\system32\ATKOSDX32.dll <Not Verified; ASUSTeK COMPUTER INC.; ASUS On-Screen Display For 3D Game> 2008-02-06 18:11:50 11136 --a------ I:\WINDOWS\system32\ATKOSDMini.DLL 2008-02-06 18:11:50 1695744 --a------ I:\WINDOWS\system32\ATKDispCPL.dll <Not Verified; ASUSTeK COMPUTER INC.; ASUS Display Property Page> 2008-02-06 18:11:50 249216 --a------ I:\WINDOWS\system32\ATKDISP.dll <Not Verified; ASUSTeK Computer Inc.; ASUS Windows 2000/XP Display Driver> 2008-02-06 18:11:50 46080 --a------ I:\WINDOWS\system32\aseng.dll 2008-02-06 18:11:49 39424 --a------ I:\WINDOWS\system32\ATKOGL32.dll <Not Verified; ASUSTeK COMPUTER INC.; ASUSTeK Computer Inc. AsusOGL> 2008-02-05 23:04:09 0 d-------- I:\Program Files\ASUS SmartDoctor 2008-02-05 17:21:56 0 d--h----- I:\WINDOWS\PIF 2008-02-05 17:00:34 0 d-------- I:\Program Files\EVEREST Corporate + Ultimate Edition 2008-02-05 16:21:34 0 d-------- I:\Documents and Settings\All Users\Application Data\ATI 2008-02-05 16:16:58 593920 -----n--- I:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart> 2008-02-05 16:16:35 0 d-------- I:\Program Files\ATI Technologies 2008-02-05 16:15:23 0 d-------- I:\ATIDriver 2008-02-05 16:04:52 4096 --a------ I:\WINDOWS\system32\crash 2008-02-05 15:14:23 0 d-------- I:\Program Files\RivaTuner v2.06 2008-02-03 15:49:57 0 d-------- I:\Program Files\Doom 3 2008-02-03 14:13:21 286720 -----n--- I:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows> 2008-02-03 14:13:18 73216 --a------ I:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows> 2008-02-02 21:34:55 0 d-------- I:\WINDOWS\Options 2008-01-31 20:02:51 0 d-------- I:\Program Files\Rainbow Six Vegas 2008-01-29 20:04:15 0 d-------- I:\Program Files\Serious Sam - The Second Encounter 2008-01-29 15:26:53 0 d-------- I:\Program Files\Lego Star Wars II 2008-01-29 12:30:00 0 d-------- I:\WINDOWS\CSC 2008-01-27 18:43:34 0 d-------- I:\WINDOWS\system32\XPSViewer 2008-01-27 18:43:29 0 d-------- I:\Program Files\Reference Assemblies 2008-01-27 16:57:51 0 d-------- I:\Swsetup2 2008-01-27 15:14:10 0 d-------- I:\WINDOWS\SxsCaPendDel 2008-01-26 23:45:42 0 d-------- I:\Program Files\Splinter Cell Double Agent 2008-01-26 23:07:51 0 d-------- I:\Documents and Settings\Joakim\Application Data\InstallShield Installation Information 2008-01-26 22:52:57 0 d-------- I:\Program Files\Unreal Tournament 3 2008-01-26 22:03:14 0 d-------- I:\Program Files\Medieval II Total War 2008-01-25 15:16:32 0 d-------- I:\Documents and Settings\All Users\Application Data\Ubisoft 2008-01-25 01:41:55 0 d-------- I:\Documents and Settings\All Users\Application Data\TrackMania United 2008-01-24 22:28:13 0 d-------- I:\WINDOWS\system32\Defaults 2008-01-24 22:26:46 3072 --a------ I:\WINDOWS\CTXFIRES.DLL <Not Verified; ; CTxfiRes Dynamic Link Library> 2008-01-24 22:26:46 10240 --a------ I:\WINDOWS\CTDCRES.DLL <Not Verified; Creative Technology Ltd; Creative Audio Product> 2008-01-24 22:26:45 0 d-------- I:\Program Files\Creative 2008-01-24 22:04:22 0 d-------- I:\Program Files\TrackMania United 2008-01-24 19:01:04 0 d-------- I:\WINDOWS\pss 2008-01-24 13:55:29 0 --a------ I:\WINDOWS\ativpsrm.bin 2008-01-24 13:27:58 0 d-------- I:\Program Files\Kane and Lynch Dead Men 2008-01-24 13:25:42 0 d-------- I:\WINDOWS\system32\xlive 2008-01-22 20:14:08 0 d-------- I:\Program Files\BroodWar_Ai_Project 2008-01-22 18:52:43 0 d-------- I:\Documents and Settings\All Users\Application Data\Lavasoft 2008-01-22 18:49:22 0 d-------- I:\Program Files\Windows Doctor 2008-01-21 22:20:03 32768 --a------ I:\WINDOWS\system32\mf.dll 2008-01-21 13:20:23 0 d-------- I:\Documents and Settings\Joakim\My Games 2008-01-21 13:19:59 0 d-------- I:\Documents and Settings\All Users\Microsoft 2008-01-21 12:26:28 0 d-------- I:\Program Files\Ubisoft 2008-01-20 21:39:32 0 d-------- I:\Documents and Settings\Joakim\Application Data\DAEMON Tools Pro 2008-01-20 21:39:02 0 d-------- I:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro 2008-01-20 21:33:27 0 d-------- I:\Program Files\DAEMON Tools Pro 2008-01-20 21:24:56 32949 --a------ I:\WINDOWS\scunin.dat 2008-01-20 21:24:53 967 --a------ I:\WINDOWS\ScUnin.pif 2008-01-20 21:24:53 94208 --a------ I:\WINDOWS\ScUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller> 2008-01-20 21:24:45 0 d-------- I:\Program Files\Starcraft 2008-01-20 19:39:25 16 --a------ I:\WINDOWS\popcinfo.dat 2008-01-20 19:37:47 720896 --a------ I:\WINDOWS\iun6002ev.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2008-01-20 19:37:41 0 d-------- I:\Program Files\Bejeweled 2 Deluxe 2008-01-20 19:05:05 0 d-------- I:\Documents and Settings\Joakim\Application Data\DAEMON Tools 2008-01-20 15:51:30 0 d-------- I:\Scenario 2008-01-18 13:38:27 0 d-------- I:\Documents and Settings\Joakim\Logs 2008-01-18 00:59:46 0 d-------- I:\Documents and Settings\Joakim\Application Data\Microsoft Games 2008-01-18 00:54:34 0 d-------- I:\Program Files\Microsoft Games -- Find3M Report --------------------------------------------------------------- 2008-02-13 01:20:57 0 d-------- I:\Documents and Settings\Joakim\Application Data\uTorrent 2008-02-12 20:31:43 0 d-------- I:\Program Files\MSN Messenger 2008-02-10 18:55:58 0 d-------- I:\Program Files\Common Files\Wise Installation Wizard 2008-02-10 17:30:58 0 d-------- I:\Program Files\Winamp 2008-02-10 15:38:26 0 d--h----- I:\Program Files\InstallShield Installation Information 2008-02-10 15:23:50 0 d-------- I:\Program Files\CoD 4 - Modern Warfare 2008-02-10 14:42:10 0 d-------- I:\Program Files\Messenger 2008-02-10 14:41:39 0 d-------- I:\Program Files\Movie Maker 2008-02-10 14:38:30 0 d-------- I:\Program Files\Windows NT 2008-02-09 20:05:09 0 d-------- I:\Program Files\uTorrent 2008-02-07 23:26:05 0 d-------- I:\Documents and Settings\Joakim\Application Data\Hamachi 2008-02-03 15:33:32 0 d-------- I:\Program Files\DiRT 2008-01-27 18:43:39 0 d-------- I:\Program Files\MSBuild 2008-01-25 23:59:45 0 d-------- I:\Program Files\Civilization 4 2008-01-24 22:27:36 0 d-------- I:\Documents and Settings\Joakim\Application Data\Creative 2008-01-24 15:09:12 0 d-------- I:\Documents and Settings\Joakim\Application Data\ATI 2008-01-22 13:44:13 0 d-------- I:\Program Files\Common Files 2008-01-22 12:17:26 0 d-------- I:\Program Files\Fraps3 2008-01-20 20:31:37 0 d-------- I:\Documents and Settings\Joakim\Application Data\Adobe 2008-01-20 19:21:23 0 d-------- I:\Program Files\Age of Empires III 2008-01-10 21:46:16 0 d-------- I:\Program Files\Need for Speed Most Wanted - Black Edition 2008-01-10 19:30:16 0 d-------- I:\Program Files\Common Files\Adobe 2008-01-06 03:03:10 0 d-------- I:\Program Files\Black & White 2 2008-01-05 23:48:24 0 d-------- I:\Documents and Settings\Joakim\Application Data\Skype 2008-01-05 21:54:04 0 d-------- I:\Program Files\Valve 2008-01-05 15:31:37 0 d-------- I:\Program Files\Skype 2008-01-05 15:31:34 0 d-------- I:\Program Files\Common Files\Skype 2008-01-05 02:22:51 0 d-------- I:\Program Files\OpenAL 2007-12-28 16:41:25 0 d-------- I:\Program Files\The All-Seeing Eye 2007-12-27 19:08:28 0 d-------- I:\Program Files\Zeus 2007-12-27 16:17:31 0 d-------- I:\Program Files\Sierra On-Line 2007-12-25 17:27:53 0 d-------- I:\Program Files\AGEIA Technologies 2007-12-23 13:03:39 0 d-------- I:\Program Files\Hamachi 2007-12-21 12:10:10 0 d-------- I:\Program Files\Caesar IV 2007-12-20 13:49:04 0 d-------- I:\Documents and Settings\Joakim\Application Data\InstallShield 2007-12-18 19:05:13 2065 --a------ I:\WINDOWS\mozver.dat 2007-12-18 19:04:23 0 d-------- I:\Documents and Settings\Joakim\Application Data\Sun 2007-12-18 19:04:12 0 d-------- I:\Program Files\Java 2007-12-18 19:02:41 0 d-------- I:\Program Files\Common Files\Java 2007-12-17 18:14:36 0 d-------- I:\Program Files\7-Zip 2007-12-16 15:48:14 0 d-------- I:\Documents and Settings\Joakim\Application Data\mIRC 2007-12-16 14:20:27 0 d-------- I:\Program Files\mIRC 2007-11-21 19:23:54 81920 --a------ I:\WINDOWS\system32\frapsvid.dll <Not Verified; Beepa P/L; FRAPS> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35] "egui"="I:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-11-14 15:05] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="I:\WINDOWS\system32\ctfmon.exe" [2008-01-26 06:57] "MsnMsgr"="I:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55] "ASUS SmartDoctor"="I:\Program Files\ASUS SmartDoctorSmartDoctor.exe" [] "DAEMON Tools Pro Agent"="I:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08] "MSMSGS"="I:\Program Files\Messenger\msmsgs.exe" [2008-01-26 06:57] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "ShowDeskFix"=regsvr32 /s /n /i:u shell32 I:\Documents and Settings\Joakim\Start Menu\Programs\Startup\ Client Default.lnk - I:\Program Files\Samurize\Client.exe [2007-04-07 21:02:08] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] I:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] I:\Program Files\WindowBlinds\wbsrv.dll 2008-02-10 20:57 229376 I:\Program Files\WindowBlinds\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion] I:\Program Files\Cyberlink\Shared Files\brs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] "I:\Program Files\PowerDVD\Language\Language.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "I:\Program Files\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "usnjsvc"=3 (0x3) "PnkBstrB"=2 (0x2) "PnkBstrA"=2 (0x2) "IDriverT"=3 (0x3) "Bonjour Service"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cde84454-c797-11dc-a653-00112f8d20f1}] AutoRun\command- J:\autorun.exe autorun.hta [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3414ab5-b97c-11dc-a626-00112f8d20f1}] AutoRun\command- M:\CDCheck.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3414ab6-b97c-11dc-a626-00112f8d20f1}] AutoRun\command- N:\autorun.exe directx\command- N:\DirectX9\dxsetup.exe setup\command- N:\setup.exe -- Hosts ----------------------------------------------------------------------- 127.0.0.1 cohlive-1.quazal.net 127.0.0.1 cohlive.quazal.net -- End of Deckard's System Scanner: finished at 2008-02-13 01:21:39 ------------ And from Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:36:24, on 2008-02-13 Platform: Windows XP SP3, v.3300 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20696) Boot mode: Normal Running processes: I:\WINDOWS\System32\smss.exe I:\WINDOWS\system32\winlogon.exe I:\WINDOWS\system32\services.exe I:\WINDOWS\system32\lsass.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\svchost.exe I:\WINDOWS\System32\svchost.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\spoolsv.exe I:\WINDOWS\ATKKBService.exe I:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe I:\Program Files\PerfectDisk2008\PD91Agent.exe I:\Program Files\Cyberlink\Shared files\RichVideo.exe I:\Program Files\UPHClean\uphclean.exe I:\WINDOWS\Explorer.EXE I:\WINDOWS\system32\WgaTray.exe I:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE I:\WINDOWS\system32\ctfmon.exe I:\Program Files\DAEMON Tools Pro\DTProAgent.exe I:\Program Files\Messenger\msmsgs.exe I:\Program Files\Samurize\Client.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe I:\WINDOWS\System32\svchost.exe I:\Program Files\ASUS SmartDoctor\SmartDoctor.exe I:\PROGRA~1\Mozilla Firefox\firefox.exe I:\WINDOWS\system32\rundll32.exe I:\WINDOWS\system32\wuauclt.exe I:\WINDOWS\system32\msiexec.exe I:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe I:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Länkhjälp till Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - I:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [egui] "I:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ASUS SmartDoctor] I:\Program Files\ASUS SmartDoctorSmartDoctor.exe /start O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "I:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user') O4 - Startup: Client Default.lnk = I:\Program Files\Samurize\Client.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: i:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A770C839-C234-4E55-B4D0-CA1D962F0612}: NameServer = 195.67.199.42,195.67.199.43 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - I:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - I:\WINDOWS\ATKKBService.exe O23 - Service: d2cs service (d2cs) - Unknown owner - I:\Documents and Settings\Joakim\Desktop\pvpgn-1.8.2\d2csConsole.exe (file missing) O23 - Service: d2dbs service (d2dbs) - Unknown owner - I:\Documents and Settings\Joakim\Desktop\pvpgn-1.8.2\d2dbsConsole.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - I:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - I:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: PD91Agent - Raxco Software, Inc. - I:\Program Files\PerfectDisk2008\PD91Agent.exe O23 - Service: PD91Engine - Raxco Software, Inc. - I:\Program Files\PerfectDisk2008\PD91Engine.exe O23 - Service: PvPGN service (pvpgn) - Unknown owner - I:\Documents and Settings\Joakim\Desktop\pvpgn-1.8.2\PvPGNConsole.exe (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - I:\Program Files\Cyberlink\Shared files\RichVideo.exe -- End of file - 6872 bytes and the "extra.txt" is attached. Thanks in advance! |
|
|
|
![]() |
| Thread Tools | |
|
|