|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
05-03-2008, 09:53 AM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2007
Location: Indiana
Posts: 11
OS: Vista (Yeah)
|
Trogans-Virus found lop
Howdy,
AVG found these bugs on my PC. Virus found lop, KNIV four times Trogan Horse downloader. ZLOP, mjelshiv, once. All are in my virus vault. I am running Vista, and it seems to only affect my account, and not the other three. As I said AVG first found it, and I never noticed a problem until I put it in the vault, and then delete it. When I open an IE window, I get several more pop ups. This -------------------------------------------------------------------------------- -- Last 5 Restore Point(s) -- 12: 2008-05-03 14:54:01 UTC - RP69 - ADVANCED REGISTRY OPTIMIZER - FIRST RUN 11: 2008-05-03 04:24:45 UTC - RP67 - Installed iTunes 10: 2008-05-03 04:22:10 UTC - RP66 - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers 9: 2008-05-02 16:46:22 UTC - RP65 - Windows Update 8: 2008-04-29 20:53:05 UTC - RP64 - Scheduled Checkpoint -- First Restore Point -- 1: 2008-04-21 08:14:38 UTC - RP57 - Scheduled Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-05-03 12:27:58 Platform: Windows Vista Service Pack 1 (6.00.6001) MSIE: Internet Explorer (7.00.6000.16386) Boot mode: Normal Running processes: C:\Windows\System32\taskeng.exe C:\Windows\System32\dwm.exe C:\Windows\explorer.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\System32\WLTRAY.EXE C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Windows\StartupMonitor.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Boogie\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://partnerpage.google.com/smallb...mb&ibd=3080328 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aol.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://partnerpage.google.com/smallb...mb&ibd=3080328 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [DellAutomatedPCTuneUp] "C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe" /startup O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/...ploader4_5.cab O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\microsoft shared\Web Folders\PKMCDO.DLL O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\microsoft shared\Web Components\10\OWC10.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: avgwlntf - C:\Windows\system32\avgwlntf.dll O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\AEstSrv.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgrssvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe O23 - Service: dlcx_device - Unknown owner - C:\Windows\System32\dlcxcoms.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Unknown owner - C:\Program Files\Nero\Nero8\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\System32\IoctlSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\stacsv.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\System32\drivers\XAudio.exe -- End of file - 7808 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 datunidr (DellAutomatedPCTuneUp UniDriver) - c:\windows\system32\drivers\datunidr.sys <Not Verified; Gteko Ltd.; Gteko Diagnostics> R2 Packet (Auto Internet Protocol) - c:\windows\system32\drivers\packet.sys <Not Verified; SingleClick Systems; Auto IP Protocol Driver> R3 PTproct - \??\c:\program files\dellautomatedpctuneup\gtaction\triggers\ptproct.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> R2 Nero BackItUp Scheduler 3 - c:\program files\nero\nero8\nero backitup\nbservice.exe R2 PLFlash DeviceIoControl Service - c:\windows\system32\ioctlsvc.exe <Not Verified; Prolific Technology Inc.; IoctlSvc Application> R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2008-04-03 and 2008-05-03 ----------------------------- 2008-05-03 11:49:02 0 d-------- C:\ie-spyad_zo 2008-05-03 11:15:01 0 d-------- C:\Program Files\SpywareBlaster 2008-05-03 00:25:08 0 d-------- C:\Program Files\iPod 2008-05-03 00:25:06 0 d-------- C:\Program Files\iTunes 2008-05-03 00:24:39 0 d-------- C:\Program Files\Bonjour 2008-05-03 00:23:35 0 d-------- C:\Users\All Users\Apple Computer 2008-05-03 00:22:57 0 d-------- C:\Program Files\Apple Software Update 2008-05-03 00:21:56 0 d-------- C:\Users\All Users\Apple 2008-05-03 00:21:56 0 d-------- C:\Program Files\Common Files\Apple 2008-05-02 23:56:55 0 d-------- C:\Users\Boogie\New Folder 2008-05-02 23:52:27 0 d-------- C:\Program Files\QuickTime 2008-04-29 11:10:56 0 dr------- C:\Users\Boogie\Searches 2008-04-29 11:10:46 0 dr------- C:\Users\Boogie\Contacts 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\Templates 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\Start Menu 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\SendTo 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\Recent 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\PrintHood 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\NetHood 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\My Documents 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\Local Settings 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\Cookies 2008-04-29 11:10:37 0 d--hs---- C:\Users\Boogie\Application Data 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Videos 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Saved Games 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Pictures 2008-04-29 11:10:36 4718592 --ahs---- C:\Users\Boogie\NTUSER.DAT 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Music 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Links 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Favorites 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Downloads 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Documents 2008-04-29 11:10:36 0 dr------- C:\Users\Boogie\Desktop 2008-04-29 11:10:36 0 d--h----- C:\Users\Boogie\AppData 2008-04-29 07:35:33 0 d-------- C:\Program Files\Panda Security 2008-04-20 23:22:38 0 d-------- C:\Users\All Users\goaugwku 2008-04-20 23:22:34 0 d-------- C:\Users\All Users\yzszehgb 2008-04-20 23:22:34 0 d-------- C:\Users\All Users\iymkmwhs 2008-04-19 23:34:49 0 d-------- C:\Program Files\MSXML 4.0 2008-04-18 19:23:46 0 d-------- C:\Program Files\NeroInstall.bak 2008-04-18 19:03:15 0 d-------- C:\Users\All Users\Nero 2008-04-18 19:03:15 0 d-------- C:\Program Files\Nero 2008-04-18 19:03:15 0 d-------- C:\Program Files\Common Files\Nero 2008-04-13 22:45:51 0 d-------- C:\Program Files\Xilisoft 2008-04-13 21:47:53 0 d-------- C:\Program Files\WheresJames 2008-04-13 21:33:31 0 d-------- C:\Users\Randy\Church Diamond 2008-04-13 21:32:27 0 d-------- C:\Users\Randy\Sitzes08 2008-04-13 18:44:13 0 d-------- C:\Users\Randy\Bible Study 2008-04-07 21:25:38 0 dr-h----- C:\$VAULT$.AVG 2008-04-04 23  21 0 d-------- C:\Program Files\Microsoft Silverlight2008-04-04 22:35:54 0 d-------- C:\PerfLogs 2008-04-03 20:35:49 0 d-------- C:\Program Files\Imikimi 2008-04-03 15:11:09 0 d-------- C:\Program Files\Dell Photo AIO Printer 926 2008-04-03 15:10:57 274432 --a------ C:\Windows\system32\dlcxinst.dll 2008-04-03 15:10:57 323584 --a------ C:\Windows\system32\dlcxhcp.dll <Not Verified; ; Printer Communication System> 2008-04-03 07:13:14 0 d-------- C:\Program Files\Common Files\Adobe -- Find3M Report --------------------------------------------------------------- 2008-05-03 12:20:15 0 d-------- C:\Users\Boogie\AppData\Roaming\AVG7 2008-05-03 03:31:53 0 d--h----- C:\Users\Boogie\AppData\Roaming\GTek 2008-05-03 00:53:13 0 d-------- C:\Users\Boogie\AppData\Roaming\Adobe 2008-05-03 00:25:34 0 d-------- C:\Users\Boogie\AppData\Roaming\Apple Computer 2008-05-03 00:21:56 0 d-------- C:\Program Files\Common Files 2008-05-02 17:03:50 0 d-------- C:\Program Files\Dl_cats 2008-04-29 11:12:14 0 d-------- C:\Users\Boogie\AppData\Roaming\Macromedia 2008-04-29 11:11:03 0 d-------- C:\Users\Boogie\AppData\Roaming\Nero 2008-04-29 11:10:48 0 d-------- C:\Users\Boogie\AppData\Roaming\Identities 2008-04-18 21:22:57 0 d-------- C:\Program Files\Windows Mail 2008-04-13 23:41:50 0 d-------- C:\Program Files\Sigmatel 2008-04-04 22:44:32 174 --ahs---- C:\Program Files\desktop.ini 2008-04-04 22:40:02 0 d-------- C:\Program Files\Dell PC Fax 2008-04-04 22:38:01 0 d-------- C:\Program Files\Windows Sidebar 2008-04-04 22:38:01 0 d-------- C:\Program Files\Windows Calendar 2008-04-04 22:38:00 0 d-------- C:\Program Files\Movie Maker 2008-04-04 22:37:59 0 d-------- C:\Program Files\Windows Photo Gallery 2008-04-04 22:37:59 0 d-------- C:\Program Files\Windows Collaboration 2008-04-04 22:37:54 0 d-------- C:\Program Files\Windows Defender 2008-04-03 15:12:46 0 d-------- C:\Program Files\Dell 2008-04-03 14:58:30 0 d-------- C:\Program Files\Google 2008-04-03 14:58:29 0 d-------- C:\Program Files\Dell Network Assistant 2008-04-02 21:46:47 0 d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint 2008-04-02 21:33:45 0 d-------- C:\Program Files\Microsoft ActiveSync 2008-03-28 05:40:11 0 d-------- C:\Program Files\DellTPad 2008-03-27 22:07:47 0 d-------- C:\Program Files\Microsoft Works 2008-03-27 22 46 0 d-------- C:\Program Files\DellAutomatedPCTuneUp2008-03-27 22:04:47 0 d-------- C:\Program Files\CyberLink 2008-03-27 22:03:29 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-03-27 22:03:13 0 d-------- C:\Program Files\Dell Support Center 2008-03-27 22:03:11 0 d-------- C:\Program Files\Common Files\supportsoft 2008-03-27 22:03:02 0 d-------- C:\Program Files\Dell DataSafe Online 2008-03-27 22:00:18 0 d-------- C:\Program Files\Cisco 2008-03-27 21:59:59 22729 --a------ C:\newkey 2008-03-27 21:59:54 0 d-------- C:\Program Files\Broadcom 2008-03-27 21:58:13 0 d-------- C:\Program Files\Digital Line Detect 2008-03-27 21:57:44 0 d-------- C:\Program Files\NetWaiting 2008-03-27 21:57:13 0 d-------- C:\Program Files\Modem Diagnostic Tool 2008-03-27 21:57:10 0 d-------- C:\Program Files\Common Files\InstallShield 2008-03-27 21:56:58 0 d-------- C:\Program Files\Java 2008-03-27 21:56:58 0 d-------- C:\Program Files\Common Files\Java 2008-03-27 21:45:57 0 d-------- C:\Program Files\CONEXANT -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/19/2008 03:38 AM] "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [12/12/2007 02:02 AM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/15/2008 08:52 AM] "Run StartupMonitor"="StartupMonitor.exe" [05/20/2000 05:23 PM C:\Windows\StartupMonitor.exe] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [02/18/2008 04:29 PM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" [] "DellAutomatedPCTuneUp"="C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe" [10/11/2007 10:49 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableUIADesktopToggle"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf] avgwlntf.dll 04/02/2008 04:01 PM 9216 C:\Windows\System32\avgwlntf.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient SstpSvc LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc wlansvc EMDMgmt TabletInputService WPDBusEnum LocalServiceNoNetwork PLA DPS BFE mpssvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI End of Deckard's System Scanner: finished at 2008-05-03 12:30:17 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft® Windows Vista™ Home Basic (build 6001) SP 1.0 Architecture: X86; Language: English CPU 0: Intel(R) Core(TM)2 Duo CPU T5270 @ 1.40GHz Percentage of Memory in Use: 40% Physical Memory (total/avail): 2045.31 MiB / 1208.96 MiB Pagefile Memory (total/avail): 4335.91 MiB / 3203.34 MiB Virtual Memory (total/avail): 2047.88 MiB / 1876.38 MiB C: is Fixed (NTFS) - 136.46 GiB total, 92.9 GiB free. D: is Fixed (NTFS) - 10 GiB total, 6.13 GiB free. E: is CDROM (No Media) \\.\PHYSICALDRIVE0 - FUJITSU MHW2160BJ FFS G2 - 149.05 GiB - 4 partitions \PARTITION0 - Unknown - 86.26 MiB \PARTITION1 - Installable File System - 10 GiB - D: \PARTITION2 (bootable) - Installable File System - 136.46 GiB - C: \PARTITION3 - Extended w/Extended Int 13 - 2.5 GiB -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. AV: AVG 7.5.524 v7.5.524 (Grisoft) AS: Windows Defender v1.1.1505.0 (Microsoft Corporation) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\Boogie\AppData\Roaming CLASSPATH=.;C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=RANDY-PC ComSpec=C:\Windows\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\Boogie LOCALAPPDATA=C:\Users\Boogie\AppData\Local LOGONSERVER=\\RANDY-PC NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0f0d ProgramData=C:\ProgramData ProgramFiles=C:\Program Files PROMPT=$P$G PUBLIC=C:\Users\Public QTJAVA=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip SystemDrive=C: SystemRoot=C:\Windows TEMP=C:\Users\Boogie\AppData\Local\Temp TMP=C:\Users\Boogie\AppData\Local\Temp USERDOMAIN=Randy-PC USERNAME=Boogie USERPROFILE=C:\Users\Boogie windir=C:\Windows -- User Profiles --------------------------------------------------------------- Randy Tammy Jessica Jade Boogie -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL --> C:\Windows\UNNeroBackItUp.exe /UNINSTALL --> C:\Windows\UNNeroMediaHome.exe /UNINSTALL --> C:\Windows\UNNeroShowTime.exe /UNINSTALL --> C:\Windows\UNNeroVision.exe /UNINSTALL --> C:\Windows\UNRecode.exe /UNINSTALL 926plv32 --> MsiExec.exe /I{0FA7B858-E0E1-400B-B5C0-1285F7D6FE5E} ABBYY FineReader 6.0 Sprint --> MsiExec.exe /X{ACF60000-22B9-4CE9-98D6-2CCF359BAC07} Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} Adobe Shockwave Player --> C:\Windows\System32\Adobe\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Adobe\SHOCKW~1\Install.log Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4} AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3} Broadcom Management Programs --> MsiExec.exe /I{C99C0593-3B48-41D9-B42F-6E035B320449} Browser Address Error Redirector --> MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F} Business Tools Launcher --> MsiExec.exe /I{75685CA8-0B74-45BB-9C64-744A0FB79EDC} Cisco EAP-FAST Module --> MsiExec.exe /I{BF53252E-4AB2-4C7F-A0FD-6100755745E3} Cisco LEAP Module --> MsiExec.exe /I{76F9CF97-FC4B-4E20-B363-D127C888448F} Cisco PEAP Module --> MsiExec.exe /I{4E5386F5-C0F6-4532-A54A-374865AEAB71} Compatibility Pack for the 2007 Office system --> MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE} Conexant HDA D330 MDC V.92 Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F\HXFSETUP.EXE -U -Idel000fz.inf Dell Automated PC TuneUp --> MsiExec.exe /X{FE34691C-4298-4667-9758-D7F534DD0B94} Dell DataSafe Online --> MsiExec.exe /I{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED} Dell Getting Started Guide --> MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045} Dell Network Assistant --> MsiExec.exe /I{0240BDFB-2995-4A3F-8C96-18D41282B716} Dell PC Fax --> C:\Program Files\Dell PC Fax\Install\x86\Uninst.exe /R:faxunst Dell Photo AIO Printer 926 --> C:\Program Files\Dell Photo AIO Printer 926\Install\x86\Uninst.exe Dell Support Center --> MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1} Dell Touchpad --> C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE Dell Wireless WLAN Card --> "C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card" Digital Line Detect --> C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly DVD to iPod Converter 4 --> C:\Program Files\Xilisoft\DVD to iPod Converter 4\Uninstall.exe Google Desktop --> C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall Imikimi Plugin --> "C:\Program Files\Imikimi\uninstall.exe" iPod Video Converter 3 --> C:\Program Files\Xilisoft\iPod Video Converter 3\Uninstall.exe iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} Java(TM) SE Runtime Environment 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000} MediaDirect --> C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0009 -cluninstall Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9} Microsoft Office XP Professional --> MsiExec.exe /I{91110409-6000-11D3-8CFE-0050048383C9} Microsoft Publisher 2002 --> MsiExec.exe /I{91190409-6000-11D3-8CFE-0050048383C9} Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Works --> MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8} Modem Diagnostic Tool --> MsiExec.exe /I{F63A3748-B93D-4360-9AD4-B064481A5C7B} MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} Nero 8 Trial --> MsiExec.exe /X{BE282C23-5484-47FF-B2C1-EBEA5C891033} neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NetWaiting --> C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI OutlookAddinSetup --> MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56} Panda ActiveScan 2.0 --> C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe Personal Entertainment Launcher --> MsiExec.exe /I{37F964E4-9C3F-4066-B933-1747D3AC6737} Product Support Launcher --> MsiExec.exe /I{B8ABB25D-1E30-4ED7-A3CE-0F8BED439647} QuickSet --> MsiExec.exe /I{7F0C4457-8E64-491B-8D7B-991504365D1E} QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD} SpywareBlaster 4.0 --> "C:\Program Files\SpywareBlaster\unins000.exe" StartupMonitor --> MsiExec.exe /I{76EFAC4F-1712-401F-B2AE-590B170C9BCE} User's Guides --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.exe" WheresJames Startup Manager 2.22 --> C:\Program Files\WheresJames\StartupMgr\Uninstall.exe -- Application Event Log ------------------------------------------------------- Event Record #/Type3276 / Error Event Submitted/Written: 05/03/2008 00:17:33 PM Event ID/Source: 1002 / Application Hang Event Description: The program ZonedOut.exe version 3.1.0.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: ef0 Start Time: 01c8ad38cf755a01 Termination Time: 5 Event Record #/Type3274 / Error Event Submitted/Written: 05/03/2008 00:14:37 PM Event ID/Source: 1002 / Application Hang Event Description: The program ZonedOut.exe version 3.1.0.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 4c8 Start Time: 01c8ad3783c739d1 Termination Time: 6 Event Record #/Type3266 / Success Event Submitted/Written: 05/03/2008 11:35:21 AM Event ID/Source: 5617 / WinMgmt Event Description: Event Record #/Type3265 / Success Event Submitted/Written: 05/03/2008 11:35:19 AM Event ID/Source: 5615 / WinMgmt Event Description: Event Record #/Type3256 / Success Event Submitted/Written: 05/03/2008 11:35:07 AM Event ID/Source: 902 / Software Licensing Service Event Description: The Software Licensing service has started. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type19645 / Warning Event Submitted/Written: 05/03/2008 00:28:23 PM Event ID/Source: 3004 / WinDefend Event Description: %Randy-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Randy-PC27 can't undo changes that you allow. For more information please see the following: %Randy-PC275 Scan ID: {CB6BFC3A-7291-402B-BFE1-AF977F546005} User: Randy-PC\Boogie Name: %Randy-PC271 ID: %Randy-PC272 Severity ID: %Randy-PC273 Category ID: %Randy-PC274 Path Found: %Randy-PC276 Alert Type: %Randy-PC278 Detection Type: 1.1.1600.02 Event Record #/Type19644 / Warning Event Submitted/Written: 05/03/2008 00:28:23 PM Event ID/Source: 3004 / WinDefend Event Description: %Randy-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Randy-PC27 can't undo changes that you allow. For more information please see the following: %Randy-PC275 Scan ID: {B8CD11DA-A44C-4A6E-9BE1-8825C837AB41} User: Randy-PC\Boogie Name: %Randy-PC271 ID: %Randy-PC272 Severity ID: %Randy-PC273 Category ID: %Randy-PC274 Path Found: %Randy-PC276 Alert Type: %Randy-PC278 Detection Type: 1.1.1600.02 Event Record #/Type19643 / Warning Event Submitted/Written: 05/03/2008 00:28:23 PM Event ID/Source: 3004 / WinDefend Event Description: %Randy-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Randy-PC27 can't undo changes that you allow. For more information please see the following: %Randy-PC275 Scan ID: {71B9B2A8-0C11-4563-BCCC-85DAA9AF89ED} User: Randy-PC\Boogie Name: %Randy-PC271 ID: %Randy-PC272 Severity ID: %Randy-PC273 Category ID: %Randy-PC274 Path Found: %Randy-PC276 Alert Type: %Randy-PC278 Detection Type: 1.1.1600.02 Event Record #/Type19642 / Warning Event Submitted/Written: 05/03/2008 00:28:20 PM Event ID/Source: 3004 / WinDefend Event Description: %Randy-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Randy-PC27 can't undo changes that you allow. For more information please see the following: %Randy-PC275 Scan ID: {C6A10935-440A-44A8-969B-66EB54CE4F4F} User: Randy-PC\Boogie Name: %Randy-PC271 ID: %Randy-PC272 Severity ID: %Randy-PC273 Category ID: %Randy-PC274 Path Found: %Randy-PC276 Alert Type: %Randy-PC278 Detection Type: 1.1.1600.02 Event Record #/Type19641 / Warning Event Submitted/Written: 05/03/2008 00:28:20 PM Event ID/Source: 3004 / WinDefend Event Description: %Randy-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Randy-PC27 can't undo changes that you allow. For more information please see the following: %Randy-PC275 Scan ID: {01D9CA85-4559-45E5-8536-2B69A8EC2E75} User: Randy-PC\Boogie Name: %Randy-PC271 ID: %Randy-PC272 Severity ID: %Randy-PC273 Category ID: %Randy-PC274 Path Found: %Randy-PC276 Alert Type: %Randy-PC278 Detection Type: 1.1.1600.02 -- End of Deckard's System Scanner: finished at 2008-05-03 12:30:17 ------------ Panda ;*********************************************************************************************************************************************************************************** ANALYSIS: 2008-05-03 10:41:31 PROTECTIONS: 1 MALWARE: 11 SUSPECTS: 1 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== AVG 7.5.524 7.5.524 Yes Yes ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Users\Tammy\AppData\Roaming\Microsoft\Windows\Cookies\Low\tammy@clickbank[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Jade\AppData\Roaming\Microsoft\Windows\Cookies\Low\jade@apmebf[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Tammy\AppData\Roaming\Microsoft\Windows\Cookies\Low\tammy@apmebf[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Cookies\Low\jessica@apmebf[2].txt 00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Cookies\Low\jessica@weborama[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Tammy\AppData\Roaming\Microsoft\Windows\Cookies\Low\tammy@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Randy\AppData\Roaming\Microsoft\Windows\Cookies\Low\randy@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Jade\AppData\Roaming\Microsoft\Windows\Cookies\Low\jade@advertising[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Boogie\AppData\Roaming\Microsoft\Windows\Cookies\Low\boogie@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Cookies\Low\jessica@advertising[1].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Cookies\Low\jessica@go[1].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Users\Jade\AppData\Roaming\Microsoft\Windows\Cookies\Low\jade@go[2].txt 00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Cookies\Low\jessica@searchportal.information[1].txt 00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Users\Tammy\AppData\Roaming\Microsoft\Windows\Cookies\Low\tammy@searchportal.information[1].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Users\Jessica\AppData\Roaming\Microsoft\Windows\Cookies\Low\jessica@target[1].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Users\Tammy\AppData\Roaming\Microsoft\Windows\Cookies\Low\tammy@target[1].txt 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0000e53f 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0000c38c 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0000edc7 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0000f9c8 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp005271c7 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp00c83e2c 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp01ff046d 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp04d5ebbe 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp09235cde 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0c223725 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp1004ee19 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\ddcBSLEV.dll 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0000bfa6 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0000a0d0 02929991 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\tmp0000ed79 02932564 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\urqRLbax.dll 02936549 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\hbjtfqii.dll 02936973 Spyware/Virtumonde Spyware No 1 Yes No C:\Users\Randy\AppData\Local\Temp\nbcdrouk.dll ;=================================================================================================================================================================================== SUSPECTS Sent Location *�u��� 3 ;=================================================================================================================================================================================== No C:\PROGRAM FILES\WHERESJAMES\STARTUPMGR\STARTUPMGR.EXE *�u��� 3 ;=================================================================================================================================================================================== VULNERABILITIES Id Severity Description *�u��� 3 ;=================================================================================================================================================================================== ;========================================================================================================================================== |
|
     
|
|
05-03-2008, 12:11 PM
|
#2 (permalink) |
|
Registered User
Join Date: Nov 2007
Location: Indiana
Posts: 11
OS: Vista (Yeah)
|
Re: Trogans-Virus found lop
For some reason, part of my first post did not show up. So here it is again.
Thanks.........Randy B. Howdy, AVG found these bugs on my PC. Virus found lop, KNIV four times Trogan Horse downloader. ZLOP, mjelshiv, once. All are in my virus vault. I am running Vista, and it seems to only affect my account, and not the other three. As I said AVG first found it, and I never noticed a problem until I put it in the vault, and then delete it. When I open an IE window, I get several more pop ups. This is the only problem I have seen. I created another account and ran to you guys for help. Thanks in advance. |
|
|
|
|
05-07-2008, 05:04 AM
|
#3 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 19,025
OS: WinXP and Vista
|
Re: Trogans-Virus found lop
Hi Randy,
Panda is showing infections in your Temp folder, but those would have been cleaned out when you ran dss.exe. Are you still getting pop ups? It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html Answer Yes, when prompted to install an ActiveX component.
**Note** To optimize scanning time and produce a more sensible report for review:
--------------------------------------------------------------- Run a new scan with HijackThis and save the log. --------------------------------------------------------------- Please include the following in your next reply: Kaspersky results New HijackThis log Update on system behavior |
|
|
|
|
05-08-2008, 08:09 PM
|
#4 (permalink) |
|
Registered User
Join Date: Nov 2007
Location: Indiana
Posts: 11
OS: Vista (Yeah)
|
Re: Trogans-Virus found lop
Reid,
Thanks for the reply. My system is still running the same. One thing I forgot to post was the fact that when I log on, my start up manager, WheresJames, is showing a startup called MSServer. It will not let me click no, so I clicked yes. Here are the reports. KASPERSKY ONLINE SCANNER REPORT Thursday, May 08, 2008 10:30:58 PM Operating System: Microsoft Windows Vista Home Edition, Service Pack 1 (Build 6001) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 9/05/2008 Kaspersky Anti-Virus database records: 748659 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 93762 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 00:48:28 Infected Object Name / Virus Name / Last Action C:\Boot\BCD Object is locked skipped C:\Boot\BCD.LOG Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\284E6D36-66EA-4B44-B5B3-A90DF2331F17 Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\8B93D840-E1B1-446F-BBF6-3F1946F7AE9D Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\ASPNETSetup_00000.log Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\C7BF0171-EBAA-4072-9F25-A612B42C8998 Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\DMI11CB.tmp Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\DMIDA87.tmp Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\E8178B02-122C-4211-B8D8-2E3887C02549 Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\F340EABE-6302-4A67-B52E-1356627DC16F Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\hnm_svc-04-13-2008-231322-382-1416-1444.dmp Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\lpksetup-20080403-145645-0.log Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\lpksetup-20080403-145659-0.log Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\lpksetup-20080403-151443-0.log Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\lpksetup-20080403-151556-0.log Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\MpCmdRun.log Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\MpSigStub.log Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\VistaSP1_InstallPerf_142855.sqm Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\WinSAT_DX.etl Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\WinSAT_KernelLog.etl Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\WinSAT_StorageAsmt.etl Object is locked skipped C:\Deckard\System Scanner\backup\Windows\temp\wmsetup.log Object is locked skipped C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.ilg Object is locked skipped C:\Program Files\Nero\Nero8\Nero BackItUp\BIU9FE6.txt Object is locked skipped C:\ProgramData\avg7\Log\emc.log Object is locked skipped C:\ProgramData\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\ProgramData\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\dell.txt Object is locked skipped C:\ProgramData\Microsoft\User Account Pictures\Jade.dat Object is locked skipped C:\ProgramData\Microsoft\User Account Pictures\Jessica.dat Object is locked skipped C:\ProgramData\Microsoft\User Account Pictures\Randy.dat Object is locked skipped C:\ProgramData\Microsoft\User Account Pictures\Tammy.dat Object is locked skipped C:\ProgramData\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped C:\ProgramData\SingleClick Systems\HomeNet Manager\Logs\hnm_svc.log Object is locked skipped C:\ProgramData\SupportSoft\DellSupportCenter\SYSTEM\state\logs\sprtcmd.log Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\UsrClass.dat{cf521dce-15f9-11dd-aef7-001d09c8eec7}.TM.blf Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\UsrClass.dat{cf521dce-15f9-11dd-aef7-001d09c8eec7}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows\UsrClass.dat{cf521dce-15f9-11dd-aef7-001d09c8eec7}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Users\Boogie\AppData\Local\Microsoft\Windows Defender\FileTracker\{FFDE04FB-3C45-4637-9DD5-B01463689261} Object is locked skipped C:\Users\Boogie\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped C:\Users\Boogie\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat Object is locked skipped C:\Users\Boogie\AppData\Roaming\Nero\Nero8\Nero BackItUp\Cache\NBKeyScan.txt Object is locked skipped C:\Users\Boogie\NTUSER.DAT Object is locked skipped C:\Users\Boogie\ntuser.dat.LOG1 Object is locked skipped C:\Users\Boogie\ntuser.dat.LOG2 Object is locked skipped C:\Users\Boogie\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf Object is locked skipped C:\Users\Boogie\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Boogie\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Users\Tammy\AppData\Local\Temp\wmplog00.sqm Object is locked skipped C:\Users\Tammy\AppData\Local\Temp\wmplog01.sqm Object is locked skipped C:\Users\Tammy\AppData\Local\Temp\wmplog02.sqm Object is locked skipped C:\Users\Tammy\NTUSER.DAT Object is locked skipped C:\Users\Tammy\ntuser.dat.LOG1 Object is locked skipped C:\Users\Tammy\ntuser.dat.LOG2 Object is locked skipped C:\Users\Tammy\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf Object is locked skipped C:\Users\Tammy\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Tammy\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\Debug\PASSWD.LOG Object is locked skipped C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped C:\Windows\Logs\CBS\CBS.log Object is locked skipped C:\Windows\Logs\DPX\setupact.log Object is locked skipped C:\Windows\Logs\DPX\setuperr.log Object is locked skipped C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config Object is locked skipped C:\Windows\Panther\setupact.log Object is locked skipped C:\Windows\Panther\setuperr.log Object is locked skipped C:\Windows\Panther\UnattendGC\diagerr.xml Object is locked skipped C:\Windows\Panther\UnattendGC\diagwrn.xml Object is locked skipped C:\Windows\Panther\UnattendGC\setupact.bld Object is locked skipped C:\Windows\Panther\UnattendGC\setupact.log Object is locked skipped C:\Windows\Panther\UnattendGC\setuperr.bld Object is locked skipped C:\Windows\Panther\UnattendGC\setuperr.log Object is locked skipped C:\Windows\security\database\secedit.sdb Object is locked skipped C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\catroot2\edb.log Object is locked skipped C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\Windows\System32\restore\MachineGuid.txt Object is locked skipped C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped C:\Windows\System32\sysprep\Panther\diagerr.xml Object is locked skipped C:\Windows\System32\sysprep\Panther\diagwrn.xml Object is locked skipped C:\Windows\System32\sysprep\Panther\setupact.bld Object is locked skipped C:\Windows\System32\sysprep\Panther\setupact.log Object is locked skipped C:\Windows\System32\sysprep\Panther\setuperr.bld Object is locked skipped C:\Windows\System32\sysprep\Panther\setuperr.log Object is locked skipped C:\Windows\System32\wbem\AutoRecover\0296C47314AB746EC35476488248FCD9.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\040270F850D5C3C91057DDDA2DA294D8.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\0A9DBC92D554324656F61F9862679F27.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\0DF617D6737A7561E732F853792261C3.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\1E2E58C73053C7775EB226DB5E739137.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\26C097A9392F8C541AD42E89B7909073.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2A811E5CCC22CC9D7AE2B04EF0402688.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2AA23BB86A5EBD8BC2D820944E55B233.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2CE523184A801AA7361A7039E2D6B41D.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2D57A7682ACD19214C258D31A06D008F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\376786241A5443E41378D25CF812FCC1.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\3DC0BABDCA20E5E319117C21BD4BD795.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\494C62FAA08CD5217399BAA555FF491B.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\4A01E0F376B5833EBA98F0D1D5F60CD1.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\4B471F64BAF831EC7945C820FD5A16E5.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\4CB32C0A77CD4D9B0C9618F73F786C32.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\5774C77265BE4C55B5C6C9718979E015.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\5966D45C7B25EACA46E87DD8E5703964.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\5B5D21CF62E70BACF9D085E6AA6CE143.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\69554D930FCA40B0304B9A43A8036F2D.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\72F867EF62976CE9F70993FF3E68A4EB.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\75054C3771DF289038069A9BB1C1FB6E.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\7851AF96EA828F912853F32DB0D96138.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\7F417E1A6D819A9B2FEB55DA6858EA0A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\87AA2A001CE3E89926688B93E4DC2992.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\8C718B5AFD373885B68D2836088CAF9A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\903E49C444C46FEF5F2C3A189C9CEF71.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\96ABB1671705F680578FE240427CBD4F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9A72EE7775E8021F75961342B8AFD1B4.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9AD3182A2F39A3E091E15109132EC6CC.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9CD33F0956942860B50AA1B9330DEFAF.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9E06E4FE97F0CBB8D659894823F805D7.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\A80FF2DC09487ECD60AFB147B262BDD7.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\AA6E0E396C238977CA909EFD82299737.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\AA742824DCADA846BA4B665D686DD5D6.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\BBF206490BAA431B592F9A13534F43F6.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\BE81B2C0741907C1FC1C42B6223E59AD.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\D1A1B12A7DA3F9675C01397A26DBF4B3.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\D4C4BA54B6A8FA6211E60E2ADFF7426A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\DE391013DA56ABA39FFF40A9ABDF052F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\DF80FD3849FFF74B4BF43E2EA8ADEC8A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\DFB9AD54AC2D3B8122567AAD3BF3EB7F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\E04DE4CDFEC284A342159BB920976701.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\E737DE61441445E1FDFCA45EF5E7D987.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\EC45C70F2A3D9DED718E71631C38E2FE.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\F01326692CC5736EBAC31B9FC2381CF2.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\F81E6BEBC3067C406E6C491608474198.mof Object is locked skipped C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped C:\Windows\System32\wbem\Repository\INDEX.BTR Object is locked skipped C:\Windows\System32\wbem\Repository\MAPPING1.MAP Object is locked skipped C:\Windows\System32\wbem\Repository\MAPPING2.MAP Object is locked skipped C:\Windows\System32\wbem\Repository\OBJECTS.DATA Object is locked skipped C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Broadcom Wireless LAN.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DateTimeControlPanel%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PLA%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnostic%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Forwarding%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Help%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WDI%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Metrics.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wired-AutoConfig%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Setup.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped C:\Windows\WindowsUpdate.log Object is locked skipped C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6000.16386_none_cef7ceb03914a67f\dnary.xsd Object is locked skipped C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6001.18000_none_d12e90ac35ffb753\dnary.xsd Object is locked skipped D:\Windows\security\database\secedit.sdb Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:55:11 PM, on 5/8/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\System32\WLTRAY.EXE C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Windows\StartupMonitor.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://partnerpage.google.com/smallb...mb&ibd=3080328 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.techsupportforum.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://partnerpage.google.com/smallb...mb&ibd=3080328 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [DellAutomatedPCTuneUp] "C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe" /startup O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-21-867194620-2441590725-3094763908-1000\..\Run: [WheresJames Startup Manager] C:\Program Files\WheresJames\StartupMgr\StartupMgr.exe (User 'Randy') O4 - HKUS\S-1-5-21-867194620-2441590725-3094763908-1001\..\Run: [WheresJames Startup Manager] C:\Program Files\WheresJames\StartupMgr\StartupMgr.exe (User 'Tammy') O4 - HKUS\S-1-5-21-867194620-2441590725-3094763908-1002\..\Run: [DellAutomatedPCTuneUp] "C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe" /startup (User 'Jessica') O4 - HKUS\S-1-5-21-867194620-2441590725-3094763908-1003\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Jade') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O13 - Gopher Prefix: O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/...ploader4_5.cab O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe O23 - Service: dlcx_device - - C:\Windows\system32\dlcxcoms.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 8038 bytes |
|
|
|
