|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
05-08-2008, 07:20 PM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 3
OS: XP Home
|
IRC/Bot Virus, Rogers ISP shut me down
Desperately need help, Rogers shut off my Internet service saying I had an IRC/Bot virus, but neither my Norton nor PandaScan could find it. I have three computers in my household connected to a secure Wireless-G router, so I don't even know which computer it is (assuming they haven't all been infected). I've followed all the prescribed steps, except on "Computer 1", on which Panda Scan froze every time.
Logs for all three computers below. One roomate (Computer #3) said her anti-virus cleaned an MSN BOT virus a few weeks ago, and my Norton cleaned a Downloader.Trojan the other day. Huge thanks in advance to anyone who can help and tell me what I need to do. Computer #1 DSS log: Deckard's System Scanner v20071014.68 Run by Mike on 2008-05-05 21:38:27 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 71: 2008-05-06 01:38:30 UTC - RP466 - Deckard's System Scanner Restore Point 70: 2008-05-06 01:17:59 UTC - RP465 - Removed BlackBerry Desktop Software 4.2 69: 2008-05-05 05:19:21 UTC - RP464 - System Checkpoint 68: 2008-05-04 04:20:27 UTC - RP463 - System Checkpoint 67: 2008-05-03 03:19:22 UTC - RP462 - System Checkpoint -- First Restore Point -- 1: 2008-02-06 13:25:17 UTC - RP396 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Mike.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:41:25 PM, on 05/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Yahoo!\NAV\navapsvc.exe C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe C:\WINDOWS\Explorer.EXE C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Winamp\Winampa.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\PROGRA~1\Yahoo!\YOP\secstat.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe G:\dss.exe C:\Program Files\Messenger\msmsgs.exe C:\DOCUME~1\Mike\Desktop\Mike.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theglobeandmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\PROGRA~1\Yahoo!\Common\YIeTagBm.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Yahoo!\NAV\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Yahoo!\NPF\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 12779 bytes -- File Associations ----------------------------------------------------------- .scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1" -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 ANIO (ANIO Service) - c:\windows\system32\anio.sys <Not Verified; Alpha Networks Inc.; ANIO (NT5) Driver> S3 RimUsb (BlackBerry Device) - c:\windows\system32\drivers\rimusb.sys (file missing) S3 usbsermpt (Motorola USB Modem Driver for MPT) - c:\windows\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> S2 ANIWZCSdService (ANIWZCSd Service) - c:\program files\ani\aniwzcs2 service\aniwzcsds.exe <Not Verified; Alpha Networks Inc.; ANIWZCS2 Service Launcher (NT)> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: TI Technologies Inc. Description: RADEON X850 XT Platinum Edition Secondary Device ID: PCI\VEN_1002&DEV_5D6D&SUBSYS_03031002&REV_00\4&16EC1A1&0&0108 Manufacturer: ATI Technologies Inc. Name: RADEON X850 XT Platinum Edition Secondary PNP Device ID: PCI\VEN_1002&DEV_5D6D&SUBSYS_03031002&REV_00\4&16EC1A1&0&0108 Service: ati2mtag Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Cisco Systems VPN Adapter Device ID: ROOT\NET\0000 Manufacturer: Cisco Systems Name: Cisco Systems VPN Adapter PNP Device ID: ROOT\NET\0000 Service: CVirtA -- Scheduled Tasks ------------------------------------------------------------- 2008-05-03 10:12:53 532 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Mike.job 2008-04-29 15  01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job-- Files created between 2008-04-05 and 2008-05-05 ----------------------------- 2008-05-05 21:27:08 0 d-------- C:\ZonedOut 2008-05-05 21:22:33 0 d-------- C:\Program Files\SpywareGuard 2008-05-04 23:02:45 0 d-------- C:\Program Files\Alarm Clock 2008-04-28 20:52:31 0 d-------- C:\Documents and Settings\Mike\.housecall6.6 2008-04-23 23:08:56 0 d-------- C:\Program Files\Panda Security 2008-04-14 20:30:04 0 d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink 2008-04-14 20:30:02 0 d-------- C:\Program Files\DVD Shrink -- Find3M Report --------------------------------------------------------------- 2008-05-05 21:23:00 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-05 21:18:07 0 d-------- C:\Program Files\Common Files 2008-05-05 07:50:03 384 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000004-00000000-00000001-00001102-00000004-20061102}.dat 2008-05-05 07:50:03 384 --a------ C:\WINDOWS\system32\DVCState-{00000004-00000000-00000001-00001102-00000004-20061102}.dat 2008-04-14 21 51 0 d-------- C:\Documents and Settings\Mike\Application Data\uTorrent2008-04-14 19:45:17 0 d-------- C:\Documents and Settings\Mike\Application Data\FrostWire 2008-04-08 21:01:14 0 d-------- C:\Program Files\FrostWire 2008-03-31 22:42:28 0 d-------- C:\Program Files\Java -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [19/11/2004 09:15 AM] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [22/10/2004 01:42 PM] "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [16/05/2006 05:34 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [12/04/2006 11:30 AM] "CTSysVol"="C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [17/09/2003 10:43 AM] "CTDVDDET"="C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [18/06/2003 01:00 AM] "CTHelper"="CTHELPER.EXE" [10/03/2004 09:50 PM C:\WINDOWS\system32\CTHELPER.EXE] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [11/05/2000 01:00 AM] "WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [26/04/2002 01:53 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11 AM] "WatchDog"="C:\Program Files\mobile PhoneTools\WatchDog.exe" [] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 11:50 AM] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [09/02/2006 09:05 PM] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [14/12/2004 02:12 AM] "@"="" [] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [12/10/2004 05:54 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [11/12/2007 11:56 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [11/12/2007 01:10 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [12/08/2004 09:56 AM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [14/06/2007 06:48 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "DJSNetCN"=C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe C:\Documents and Settings\Mike\Start Menu\Programs\Startup\ SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [29/08/2003 7:05:35 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [04/09/2006 4:27:27 PM] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [30/12/2006 2:11:18 AM] AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [05/03/2006 6:43:54 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 1:01:04 AM] VPN Client.lnk - C:\WINDOWS\Installer\{3E5562ED-69AB-4CEC-91E2-64E18EC5ACC6}\Icon3E5562ED7.ico [03/11/2007 8:29:13 PM] -- End of Deckard's System Scanner: finished at 2008-05-05 21:42:55 ------------ Computer #2 DSS log: Deckard's System Scanner v20071014.68 Run by HP_Administrator on 2008-05-06 22:43:59 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 70: 2008-05-07 02:44:04 UTC - RP436 - Deckard's System Scanner Restore Point 69: 2008-05-06 13:08:10 UTC - RP435 - System Checkpoint 68: 2008-05-05 08:46:26 UTC - RP434 - System Checkpoint 67: 2008-05-04 07:40:30 UTC - RP433 - System Checkpoint 66: 2008-05-03 04:55:56 UTC - RP432 - System Checkpoint -- First Restore Point -- 1: 2008-02-06 16 06 UTC - RP367 - System CheckpointBacked up registry hives. Performed disk cleanup. -- HijackThis (run as HP_Administrator.exe) ------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:46:31 PM, on 06/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\arservice.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Yahoo!\NAV\navapsvc.exe C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\ARPWRMSG.EXE C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Netscape Accelerator\slipcore.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe C:\PROGRA~1\Yahoo!\YOP\secstat.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\HP\KBD\KBD.EXE c:\windows\system\hpsysdrv.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\DISC\DISCover.exe C:\Program Files\DISC\DiscUpdMgr.exe C:\Program Files\DISC\DiscStreamHub.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\XoftSpySE\xoftspy.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\HPZipm12.exe C:\Documents and Settings\HP_Administrator\Desktop\dss.exe C:\DOCUME~1\HP_ADM~1\Desktop\HP_Administrator.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.globeandmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.globeandmail.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Netscape Accelerator\PBHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Netscape Accelerator\components\NOWImaging.dll O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Yahoo!\NAV\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (file missing) O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Netscape Accelerator\slipcore.exe" O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - Startup: Netscape Setup Wizard.lnk = C:\Program Files\Netscape Internet Service\SetupWd.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet7_22.dll' missing O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (Lotus Quickr Class) - https://place.ddb.ca/qp2.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1163206040832 O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://tor.ddb.ca/dwa7W.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Yahoo!\NPF\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 13269 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 ANIO (ANIO Service) - c:\windows\system32\anio.sys <Not Verified; Alpha Networks Inc.; ANIO (NT5) Driver> S0 ftsata2 - c:\windows\system32\drivers\ftsata2.sys (file missing) S1 intelppm (Intel Processor Driver) - c:\windows\system32\drivers\intelppm.sys (file missing) S3 PRISM_A02 (D-Link Wireless 802.11b/g Driver (USB)) - c:\windows\system32\drivers\prisma02.sys <Not Verified; Conexant Systems, Inc.; PRISM 802.11 Wireless LAN> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- All services whitelisted. -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-05-04 17:00:00 470 --a------ C:\WINDOWS\Tasks\XoftSpySE 2.job 2008-04-29 21:24:10 384 --a------ C:\WINDOWS\Tasks\XoftSpySE.job 2008-04-19 03:56:21 556 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - HP_Administrator.job -- Files created between 2008-04-06 and 2008-05-06 ----------------------------- 2008-05-06 22:41:07 0 d-------- C:\ZonedOut 2008-05-06 22:40:29 0 d-------- C:\Program Files\SpywareGuard 2008-04-29 21:24:07 0 d-------- C:\Program Files\XoftSpySE 2008-04-23 23:18:23 0 d-------- C:\Program Files\Panda Security 2008-04-22 20:53:43 0 d-------- C:\WINDOWS\CSC -- Find3M Report --------------------------------------------------------------- 2008-04-29 21:01:56 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-04-29 20:54:48 0 d-------- C:\Program Files\DNA 2008-04-23 23:18:32 0 d-------- C:\Program Files\Symantec 2008-04-18 00:02:29 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\FrostWire 2008-04-13 04:58:55 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\uTorrent 2008-04-10 18:28:00 0 d-------- C:\Program Files\FrostWire 2008-04-05 09:16:10 0 d-------- C:\Program Files\ms word 2008-03-31 00:33:21 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\.BitTornado 2008-03-29 11:04:49 0 d-------- C:\Program Files\PartyGaming -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}] C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [30/09/2005 12:01 AM] "ftutil2"="ftutil2.dll" [07/06/2004 05:05 PM C:\WINDOWS\system32\ftutil2.dll] "RTHDCPL"="RTHDCPL.EXE" [13/06/2006 11:05 PM C:\WINDOWS\RTHDCPL.EXE] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [03/08/2005 02:19 AM C:\WINDOWS\arpwrmsg.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [09/05/2006 06:50 PM] "nwiz"="nwiz.exe" [09/05/2006 06:50 PM C:\WINDOWS\system32\nwiz.exe] "DMAScheduler"="c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" [13/04/2006 12:05 PM] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [23/07/2005 01:14 AM] "@"="" [] "PCDrProfiler"="" [] "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [16/02/2006 01:34 AM] "Reminder"="C:\Windows\Creator\Remind_XP.exe" [14/12/2004 05:23 AM] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [19/02/2006 03:41 AM] "D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [14/09/2004 03:16 PM] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [16/08/2004 05:45 PM] "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [31/08/2006 05:01 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [22/01/2007 10:19 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/08/2006 10:29 AM] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [14/12/2004 03:12 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [27/04/2007 09:41 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [01/06/2007 04:51 PM] "SlipStream"="C:\Program Files\Netscape Accelerator\slipcore.exe" [06/04/2006 10:55 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [04/06/2007 06:03 PM] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [19/01/2007 12:54 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "DJSNetCN"=C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\ Netscape Setup Wizard.lnk - C:\Program Files\Netscape Internet Service\SetupWd.exe [15/08/2007 6:29:15 PM] SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [29/08/2003 7:05:35 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [23/01/2007 11:58:23 PM] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [19/02/2006 5:21:22 AM] Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [11/08/2006 10:46:11 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{006905a1-711b-11db-b121-806d6172696f}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a7a706a-e0c9-11db-b154-001195dbbd1d}] AutoRun\command- J:\LaunchU3.exe -a -- End of Deckard's System Scanner: finished at 2008-05-06 22:46:56 ------------ Computer # 3 log Deckard's System Scanner v20071014.68 Run by Marie on 2008-05-08 20:47:05 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 19: 2008-05-08 18:47:13 UTC - RP19 - Deckard's System Scanner Restore Point 18: 2008-04-29 15:18:44 UTC - RP18 - Installé iTunes 17: 2008-04-28 19:13:31 UTC - RP17 - Installed VeohTV BETA 16: 2008-04-27 18:29:44 UTC - RP16 - SPTD setup V1.53 15: 2008-04-27 11:30:07 UTC - RP15 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2008-04-24 17:59:39 UTC - RP1 - Point de vérification système Backed up registry hives. Performed disk cleanup. Total Physical Memory: 503 MiB (512 MiB recommended). -- HijackThis (run as Marie.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:49:12, on 08/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Acer\eManager\anbmServ.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\acer\epm\epm-dm.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\PowerKey.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\OSDCtrl.exe C:\Program Files\Launch Manager\Wbutton.exe C:\Program Files\Acer\eRecovery\Monitor.exe C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\AdVantage\AdVantage.exe C:\Program Files\Veoh Networks\Veoh\VeohClient.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe C:\WINDOWS\system32\wuauclt.exe G:\dss.exe C:\DOCUME~1\Marie\Bureau\Marie.exe C:\Program Files\Messenger\msmsgs.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe" O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe" O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe" O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe" O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe" O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe -- End of file - 10715 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 UBHelper - c:\windows\system32\drivers\ubhelper.sys R1 Hotkey - c:\windows\system32\drivers\hotkey.sys R2 EpmPsd (Acer EPM Power Scheme Driver) - c:\windows\system32\drivers\epm-psd.sys <Not Verified; Acer Value Labs, USA; Acer EPM Power Scheme Driver> R2 EpmShd (Acer EPM System Hardware Driver) - c:\windows\system32\drivers\epm-shd.sys <Not Verified; Acer Value Labs, USA; Acer EPM System Hardware Driver> R2 int15.sys - c:\program files\acer\erecovery\int15.sys R2 osaio - c:\windows\system32\drivers\osaio.sys <Not Verified; Avocent/OSA Technologies Inc.; Windows (R) Server 2003 DDK driver> R2 osanbm - c:\windows\system32\drivers\osanbm.sys <Not Verified; Windows (R) 2000 DDK provider; OSA int15 Driver> R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; > R3 POWERKEY - c:\program files\launch manager\powerkey.sys S1 Wbutton - c:\windows\system32\drivers\wbutton.sys (file missing) S3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 anbmService (Notebook Manager Service) - c:\acer\emanager\anbmserv.exe <Not Verified; OSA Technologies Inc.; Acer eManager for Notebook> R2 Apple Mobile Device - "c:\program files\fichiers communs\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 Bonjour Service (Service Bonjour) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Carte réseau Broadcom 802.11g Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_03121468&REV_02\4&AD1B67F&0&28F0 Manufacturer: Broadcom Name: Carte réseau Broadcom 802.11g PNP Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_03121468&REV_02\4&AD1B67F&0&28F0 Service: BCM43XX -- Scheduled Tasks ------------------------------------------------------------- 2008-04-29 17:16:04 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-04-25 20:15:00 566 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Analyser mon ordinateur - Marie.job 2008-04-24 21:19:48 364 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job -- Files created between 2008-04-08 and 2008-05-08 ----------------------------- 2008-05-08 20:43:59 0 d-------- C:\Program Files\SpywareGuard 2008-05-08 20:09:56 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-08 18:34:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Christmasville 2008-05-08 18:33:59 0 d-------- C:\WINDOWS\Christmasville 2008-05-06 22:26:00 1160 --a------ C:\WINDOWS\mozver.dat 2008-05-05 12:32:29 0 d-------- C:\Documents and Settings\Marie\Application Data\skypePM 2008-05-05 12:32:29 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-04-30 21:58:04 0 d-------- C:\WINDOWS\system32\LogFiles 2008-04-29 17:20:12 0 d-------- C:\Documents and Settings\Marie\Application Data\Apple Computer 2008-04-29 17:19:36 0 d-------- C:\Program Files\iPod 2008-04-29 17:18:48 0 d-------- C:\Program Files\iTunes 2008-04-29 17:17:53 0 d-------- C:\Program Files\Bonjour 2008-04-29 17:16:20 0 d-------- C:\Program Files\QuickTime 2008-04-29 17:16:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-04-29 17:15:20 0 d-------- C:\Program Files\Fichiers communs\Apple 2008-04-29 17:15:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-04-28 21:13:45 0 d-------- C:\Program Files\Veoh Networks 2008-04-28 13:44:31 0 d-------- C:\Favoris 2008-04-27 20:39:45 0 d-------- C:\Program Files\AdVantage 2008-04-27 20:39:02 0 d-------- C:\Documents and Settings\Marie\Application Data\DAEMON Tools 2008-04-27 20:38:56 0 d-------- C:\Program Files\DAEMON Tools Lite 2008-04-27 20:29:45 715248 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-04-27 20:23:11 0 d-------- C:\Documents and Settings\Marie\Application Data\WinRAR 2008-04-27 12:36:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Logishrd 2008-04-27 12:36:15 0 d-------- C:\Program Files\Logitech 2008-04-27 12:36:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2008-04-27 12:33:53 0 d-------- C:\Program Files\Fichiers communs\logishrd 2008-04-27 11:20:52 0 d-------- C:\Documents and Settings\Marie\Application Data\Skype 2008-04-27 00:41:41 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-04-26 20:17:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2008-04-26 20:16:43 0 d-------- C:\Program Files\Fichiers communs\Adobe 2008-04-26 20:09:49 0 d-------- C:\Documents and Settings\Marie\Application Data\U3 2008-04-26 20:09:31 0 d-------- C:\Program Files\Fichiers communs\Skype 2008-04-26 20:08:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Skype 2008-04-26 20:07:26 0 d-------- C:\Program Files\Fichiers communs\xing shared 2008-04-26 20 54 0 d-------- C:\Program Files\Real2008-04-26 20 50 0 d-------- C:\Program Files\Fichiers communs\Real2008-04-26 20 46 0 d-------- C:\Documents and Settings\Marie\Application Data\Real2008-04-26 20:03:39 0 d-------- C:\Program Files\Picasa2 2008-04-26 20:02:55 0 d-------- C:\Program Files\Norton Security Scan 2008-04-26 19:53:42 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-04-26 19:53:40 0 d-------- C:\Program Files\Google 2008-04-26 18:23:28 0 d--hs---- C:\FOUND.000 2008-04-26 07:10:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2008-04-26 07:10:10 0 d---s---- C:\Documents and Settings\Marie\UserData 2008-04-25 22:16:57 0 d-------- C:\WINDOWS\system32\PreInstall 2008-04-25 22:16:55 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-04-25 22:15:17 0 d-------- C:\Documents and Settings\Marie\Application Data\vlc 2008-04-25 21:27:24 0 d-------- C:\Documents and Settings\Marie\Application Data\OpenOffice.org2 2008-04-25 21:24:47 0 d-------- C:\Program Files\OpenOffice.org 2.4 2008-04-25 21:00:52 0 d-------- C:\Program Files\Alwil Software 2008-04-25 20:54:35 0 d-------- C:\Documents and Settings\Marie\Application Data\Talkback 2008-04-25 20:54:18 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-25 20:54:09 0 d-------- C:\Documents and Settings\Marie\Application Data\Mozilla 2008-04-25 20:52:34 0 d-------- C:\Program Files\VideoLAN 2008-04-25 20:45:46 0 d-------- C:\Documents and Settings\Marie\Application Data\Macromedia 2008-04-25 20:45:45 0 d-------- C:\Documents and Settings\Marie\Application Data\Adobe 2008-04-25 20:39:22 0 d-------- C:\Documents and Settings\Marie\Contacts 2008-04-25 20:37:00 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-04-25 20:36:51 0 d-------- C:\WINDOWS\system32\DRVSTORE 2008-04-25 20:34:13 0 d--hs---- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-04-25 20:33:58 0 d-------- C:\Program Files\Windows Live 2008-04-25 20:33:49 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-04-25 20:13:32 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-04-24 21:07:56 0 dr------- C:\Mes documents 2008-04-24 21 36 0 d-------- C:\Bureau2008-04-24 21:04:48 0 d-------- C:\Program Files\Agatha Christie - Death on the Nile 2008-04-24 21:04:46 0 d-------- C:\Program Files\Alice Greenfingers 2008-04-24 21:04:44 0 d-------- C:\Program Files\Apple Software Update 2008-04-24 21:04:43 0 d-------- C:\Program Files\bfgclient 2008-04-24 21:04:42 0 d-------- C:\Program Files\Big City Adventure - San Francisco 2008-04-24 21:04:36 0 d-------- C:\Program Files\Boonty 2008-04-24 21:04:35 0 d-------- C:\Program Files\BoontyGames 2008-04-24 21:01:56 0 d-------- C:\Program Files\eMule 2008-04-24 21:01:21 0 d-------- C:\Program Files\Samsung 2008-04-24 21:01:17 0 d-------- C:\Program Files\Skype 2008-04-24 20:09:36 0 d-------- C:\Program Files\Norton AntiVirus 2008-04-24 20:09:11 0 d-------- C:\Documents and Settings\Marie\Application Data\Symantec 2008-04-24 20:09:03 0 d-------- C:\Program Files\Symantec 2008-04-24 20:09:03 0 d-------- C:\Program Files\Fichiers communs\Symantec Shared 2008-04-24 20:09:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-04-24 20:03:24 4010 --a------ C:\WINDOWS\system32\drivers\osanbm.sys <Not Verified; Windows (R) 2000 DDK provider; OSA int15 Driver> 2008-04-24 20:03:24 8704 --a------ C:\WINDOWS\system32\drivers\osaio.sys <Not Verified; Avocent/OSA Technologies Inc.; Windows (R) Server 2003 DDK driver> 2008-04-24 20:03:16 0 d-------- C:\WINDOWS\Downloaded Installations 2008-04-24 20:01:55 253952 --a------ C:\WINDOWS\system32\Uninstall_eRecovery.exe <Not Verified; Acer Inc.; Uninstall_eRecovery.exe> 2008-04-24 20:01:52 0 d-------- C:\Program Files\acer 2008-04-24 20:01:45 0 d-------- C:\Program Files\Launch Manager 2008-04-24 20:01:23 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink 2008-04-24 20:00:13 0 d--h----- C:\Documents and Settings\Marie\Voisinage réseau 2008-04-24 20:00:13 0 d--h----- C:\Documents and Settings\Marie\Voisinage d'impression 2008-04-24 20:00:13 0 dr-h----- C:\Documents and Settings\Marie\SendTo 2008-04-24 20:00:13 0 dr-h----- C:\Documents and Settings\Marie\Recent 2008-04-24 20:00:13 0 d--h----- C:\Documents and Settings\Marie\Modèles 2008-04-24 20:00:13 0 dr------- C:\Documents and Settings\Marie\Mes documents 2008-04-24 20:00:13 0 dr------- C:\Documents and Settings\Marie\Menu Démarrer 2008-04-24 20:00:13 0 d--h----- C:\Documents and Settings\Marie\Local Settings 2008-04-24 20:00:13 0 dr------- C:\Documents and Settings\Marie\Favoris 2008-04-24 20:00:13 0 d---s---- C:\Documents and Settings\Marie\Cookies 2008-04-24 20:00:13 0 d-------- C:\Documents and Settings\Marie\Bureau 2008-04-24 20:00:13 0 dr-h----- C:\Documents and Settings\Marie\Application Data 2008-04-24 20:00:13 0 d-------- C:\Documents and Settings\Marie\Application Data\Identities 2008-04-24 20:00:12 7340032 --ah----- C:\Documents and Settings\Marie\NTUSER.DAT 2008-04-24 19:59:34 262144 --a------ C:\Documents and Settings\All Users\NTUSER.DAT 2008-04-24 19:59:32 0 d-------- C:\Documents and Settings\Default User\Application Data\Identities -- Find3M Report --------------------------------------------------------------- 2008-04-26 18:26:36 369864 --a------ C:\WINDOWS\system32\perfh00C.dat 2008-04-26 18:26:36 49924 --a------ C:\WINDOWS\system32\perfc00C.dat 2008-04-26 07:38:10 16384 ---h----- C:\WINDOWS\$NtUninstallKB905414$ 2008-04-24 20:04:10 1024 -r-h----- C:\WINDOWS\system32\NTIBUN4.dll 2008-04-24 20:03:44 1024 -r-h----- C:\WINDOWS\system32\NTIMPEG2.dll 2008-04-24 20:03:44 1024 -r-h----- C:\WINDOWS\system32\NTIMP3.dll 2008-04-24 20:03:44 1024 -r-h----- C:\WINDOWS\system32\NTIFCD3.dll 2008-04-24 20:03:44 1024 -r-h----- C:\WINDOWS\system32\NTICDMK7.dll -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "preload"="C:\Windows\RUNXMLPL.exe" [19/05/2005 17:09] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [23/01/2005 10:36] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [23/01/2005 10:31] "SoundMan"="SOUNDMAN.EXE" [15/04/2005 11:01 C:\WINDOWS\SOUNDMAN.EXE] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [04/02/2005 11:12] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [04/02/2005 11:11] "EPM-DM"="c:\acer\epm\epm-dm.exe" [01/06/2005 14:17] "ePowerManagement"="C:\Acer\ePM\ePM.exe" [15/03/2005 10:03] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [05/08/2004 05:00] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [05/08/2004 05:00] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [05/08/2004 05:00] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [05/08/2004 05:00] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [15/07/2004 01:07] "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [25/07/2005 13:36] "PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [30/08/2002 15:02] "LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [06/06/2005 11:52] "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [16/09/2003 14:28] "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [25/07/2005 10:45] "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [25/07/2005 13:34] "eRecoveryService"="C:\Program Files\Acer\eRecovery\Monitor.exe" [29/06/2005 17:26] "ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [24/08/2004 23:23] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [29/03/2008 19:37] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [26/04/2008 20:06] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 22:16] "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [25/10/2007 16:33] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [25/10/2007 16:37] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [28/03/2008 23:37] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [05/08/2004 05:00] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 11:34] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [12/02/2008 20:10] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [15/12/2007 12:02] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [05/11/2007 11:12] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [18/04/2008 14:30] "@"="" [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{59dd1372-13b2-11dd-9383-0014a4433c19}] AutoRun\command- G:\LaunchU3.exe -- End of Deckard's System Scanner: finished at 2008-05-08 20:50:20 ------------ |
|
     
|
|
05-12-2008, 03:15 PM
|
#2 (permalink) |
|
Registered User
Join Date: Apr 2008
Posts: 3
OS: XP Home
|
Re: IRC/Bot Virus, Rogers ISP shut me down
BUMP
Does anyone have any ideas? I realize it's a pain that there are three computers involved but if there is a way to detect which computer(s) is trying to send out the large volumes virus/spam data that Rogers detected without my network having Internet connectivity I would be happy to try that first so potentially there would only be one set of logs to sift through. Thanks |
|
|
|
|
| Thread Tools | |
|
|
Re: IRC/Bot Virus, Rogers ISP shut me down
