|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
06-15-2008, 07:57 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 2
OS: xp
|
Warning : Spyware threat has been detected on your PC.
Please help !!
--------- I got the "Warning spyware threat has been detected on your pc" malware . The task manager is also not working. Heres the main.txt and extra.txt , any help would be great. Thanks. main.txt ============================== Deckard's System Scanner v20071014.68 Run by deepak kulkarni on 2008-06-15 10:17:46 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 77: 2008-06-15 14:17:58 UTC - RP889 - Deckard's System Scanner Restore Point 76: 2008-06-15 07:01:33 UTC - RP888 - Software Distribution Service 3.0 75: 2008-06-14 20:12:01 UTC - RP887 - System Checkpoint 74: 2008-06-08 14:58:26 UTC - RP886 - Removed Windows Live Messenger 73: 2008-06-08 14:55:56 UTC - RP885 - Removed H&R Block Tax Offer -- First Restore Point -- 1: 2008-06-05 14:35:21 UTC - RP813 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 510 MiB (512 MiB recommended). -- HijackThis (run as deepak kulkarni.exe) ------------------------------------- Unable to find log (file not found); running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-15 10:19:14 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\SYSTEM32\SMSS.EXE C:\WINDOWS\SYSTEM32\CSRSS.EXE C:\WINDOWS\SYSTEM32\WINLOGON.EXE C:\WINDOWS\SYSTEM32\SERVICES.EXE C:\WINDOWS\SYSTEM32\LSASS.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\spoolsv.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe C:\WINDOWS\SYSTEM32\dla\tfswctrl.exe C:\WINDOWS\SYSTEM32\hkcmd.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\444.470 C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\SYSTEM32\CTFMON.EXE C:\Program Files\Veoh Networks\Veoh\VeohClient.exe C:\Documents and Settings\deepak kulkarni\Application Data\Smilebox\SmileboxTray.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\WINDOWS\SYSTEM32\VirtualExpander\VirtualExpander.exe C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\SYSTEM32\WSCNTFY.EXE C:\WINDOWS\SYSTEM32\ALG.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\deepak kulkarni\Local Settings\Temporary Internet Files\Content.IE5\VKZ934MW\dss[1].exe C:\WINDOWS\SYSTEM32\WBEM\WMIPRVSE.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.microsoft.com/isapi/redir...ie&ar=iesearch R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file) O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file) O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file) O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file) O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file) O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file) O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file) O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file) O2 - BHO: gooochi browser optimizer - {4d45da0d-f9ae-dd62-ad1e-501befb3d80f} - C:\WINDOWS\SYSTEM32\{afb46e38-aa02-fdd1-8ddf-91f0f90121ff}.dll O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file) O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file) O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file) O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file) O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file) O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file) O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file) O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file) O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file) O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file) O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file) O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file) O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file) O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file) O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar3.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKLM\..\Run: [BM7f23c9fd] Rundll32.exe "C:\WINDOWS\system32\ucjcohkm.dll",s O4 - HKLM\..\Run: [{6b483b13-4ed8-c5bc-361b-2775a2fe4d75}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{afb46e38-aa02-fdd1-8ddf-91f0f90121ff}.dll" DllStart O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SmileboxTray] "C:\Documents and Settings\deepak kulkarni\Application Data\Smilebox\SmileboxTray.exe" O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - Startup: DW_Start.lnk = C:\WINDOWS\SYSTEM32\rwwnw64d.exe O4 - Startup: VirtualExpander.lnk = C:\WINDOWS\SYSTEM32\VirtualExpander\VirtualExpander.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1 O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM32\msjava.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options Group: [TABS] Tabbed Browsing O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.aajtak.com/wfplayer/tdserver.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...8f/wvc1dmo.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () - http://download.mcafee.com/molbin/sh...0/mcinsctl.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.470 O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell -- End of file - 13180 bytes -- HijackThis Fixed Entries (C:\DOCUME~1\DEEPAK~1\LOCALS~1\TEMPOR~1\Content.IE5\VTR3GTPZ\backups\) -------------------------------------------------------------------------------- backup-20080614-192449-603 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe, -- File Associations ----------------------------------------------------------- .ini - inifile - shell\open\command - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1 .txt - txtfile - shell\open\command - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 MASPINT - c:\windows\system32\drivers\maspint.sys <Not Verified; MicroStaff Co.,Ltd.; Aspi32 Driver for WinNT> R2 paldrv - c:\windows\system32\pal_drv.sys <Not Verified; Mercury Interactive Corp.; Astra> R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> S2 DS1410D - c:\windows\system32\drivers\ds1410d.sys (file missing) S3 FarStoneFireWallDrive - c:\windows\system32\drivers\fardrive.sys (file missing) S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 MsSecurity1.209.4 (MsSecurity Updated) - c:\windows\444.470 service R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-15 09:49:15 468 --a------ C:\WINDOWS\Tasks\XoftSpySE 2.job 2008-06-15 09:49:15 458 --a------ C:\WINDOWS\Tasks\RegCure Program Check.job 2008-06-15 02:39:00 274 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job 2008-06-05 09:44:14 392 --a------ C:\WINDOWS\Tasks\RegCure.job 2008-06-03 10:08:47 382 --a------ C:\WINDOWS\Tasks\XoftSpySE.job -- Files created between 2008-05-15 and 2008-06-15 ----------------------------- 2008-06-14 19:31:07 19456 --a------ C:\WINDOWS\window.exe 2008-06-14 19:31:07 11776 --a------ C:\WINDOWS\svchost32.exe 2008-06-14 19:31:07 20224 --a------ C:\WINDOWS\rundll16.exe 2008-06-14 19:31:06 22528 --a------ C:\WINDOWS\quicken.exe 2008-06-14 19:31:06 12544 --a------ C:\WINDOWS\notepad32.exe 2008-06-14 19:31:06 13568 --a------ C:\WINDOWS\msupdate.exe 2008-06-14 19:31:06 26112 --a------ C:\WINDOWS\mssys.exe 2008-06-14 19:31:05 23040 --a------ C:\WINDOWS\msconfd.dll 2008-06-14 19:31:05 22528 --a------ C:\WINDOWS\internet.exe 2008-06-14 19:31:05 18688 --a------ C:\WINDOWS\iexplorer.exe 2008-06-14 19:31:04 27648 --a------ C:\WINDOWS\iedll.exe 2008-06-14 19:31:04 32256 --a------ C:\WINDOWS\editpad.exe 2008-06-08 11:17:18 0 d-------- C:\Documents and Settings\LocalService\Application Data\Real 2008-06-08 11:17:09 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia 2008-06-08 11  21 0 d-------- C:\Program Files\Spyware Doctor2008-06-08 11 21 0 d-------- C:\Documents and Settings\deepak kulkarni\Application Data\PC Tools2008-06-08 11:05:39 0 d-------- C:\Program Files\Common Files\Download Manager 2008-06-08 10:59:44 0 d-------- C:\WINDOWS\SxsCaPendDel 2008-06-08 10:02:01 2560 --a------ C:\WINDOWS\system32\xqdwgbxm.exe 2008-06-08 09:48:53 100864 --a------ C:\WINDOWS\system32\ucjcohkm.dll 2008-06-08 09:47:29 0 d-------- C:\WINDOWS\system32\7823 2008-06-08 09:46:43 55808 --a------ C:\WINDOWS\portsv.exe 2008-06-05 14:55:01 298311 --a------ C:\WINDOWS\system32\gside.exe 2008-06-05 14:21:29 26112 --a------ C:\WINDOWS\sistem.exe 2008-06-05 14:21:28 30976 --a------ C:\WINDOWS\qttasks.exe 2008-06-05 14:21:28 30208 --a------ C:\WINDOWS\olehelp.exe 2008-06-05 14:21:27 14080 --a------ C:\WINDOWS\loader.exe 2008-06-05 14:21:26 12288 --a------ C:\WINDOWS\explore.exe 2008-06-05 14:21:26 26368 --a------ C:\WINDOWS\ctrlpan.dll 2008-06-05 14:21:25 9472 --a------ C:\WINDOWS\avpcc.dll 2008-06-05 10:35:05 741177 --ahs---- C:\WINDOWS\system32\LTCIlUtv.ini2 2008-06-05 10:31:16 18944 --a------ C:\WINDOWS\y.exe 2008-06-05 10:31:15 23040 --a------ C:\WINDOWS\xplugin.dll 2008-06-05 10:31:15 13824 --a------ C:\WINDOWS\x.exe 2008-06-05 10:31:15 22528 --a------ C:\WINDOWS\winmgnt.exe 2008-06-05 10:31:15 19456 --a------ C:\WINDOWS\winajbm.dll 2008-06-05 10:31:15 9216 --a------ C:\WINDOWS\win64.exe 2008-06-05 10:31:14 31488 --a------ C:\WINDOWS\win32e.exe 2008-06-05 10:31:14 24064 --a------ C:\WINDOWS\waol.exe 2008-06-05 10:31:14 13568 --a------ C:\WINDOWS\users32.exe 2008-06-05 10:31:14 32512 --a------ C:\WINDOWS\time.exe 2008-06-05 10:31:13 23552 --a------ C:\WINDOWS\systemcritical.exe 2008-06-05 10:31:13 14336 --a------ C:\WINDOWS\systeem.exe 2008-06-05 10:31:13 18944 --a------ C:\WINDOWS\svcinit.exe 2008-06-05 10:31:13 18688 --a------ C:\WINDOWS\searchword.dll 2008-06-05 10:31:12 32512 --a------ C:\WINDOWS\mtwirl32.dll 2008-06-05 10:31:11 20480 --a------ C:\WINDOWS\mswsc20.dll 2008-06-05 10:31:11 14336 --a------ C:\WINDOWS\mswsc10.dll 2008-06-05 10:31:11 32256 --a------ C:\WINDOWS\msspi.dll 2008-06-05 10:31:10 9216 --a------ C:\WINDOWS\inetinf.exe 2008-06-05 10:31:10 32000 --a------ C:\WINDOWS\helpcvs.exe 2008-06-05 10:31:09 23808 --a------ C:\WINDOWS\gfmnaaa.dll 2008-06-05 10:31:09 30720 --a------ C:\WINDOWS\funny.exe 2008-06-05 10:31:09 26880 --a------ C:\WINDOWS\funniest.exe 2008-06-05 10:31:08 17920 --a------ C:\WINDOWS\explorer32.exe 2008-06-05 10:31:08 24320 --a------ C:\WINDOWS\dnsrelay.dll 2008-06-05 10:31:08 13568 --a------ C:\WINDOWS\directx32.exe 2008-06-05 10:31:08 13056 --a------ C:\WINDOWS\ctfmon32.exe 2008-06-05 10:31:07 13824 --a------ C:\WINDOWS\cpan.dll 2008-06-05 10:31:07 22528 --a------ C:\WINDOWS\clrssn.exe 2008-06-05 10:31:07 14080 --a------ C:\WINDOWS\accesss.exe 2008-06-05 10:30:11 861 --a------ C:\WINDOWS\system32\winpfz33.sys 2008-06-05 10:29:29 49168 --a------ C:\WINDOWS\system32\jnwnw64n.exe <Not Verified; ; Browser Driver> 2008-06-05 10:26:11 0 d-------- C:\Documents and Settings\LocalService\Application Data\Google 2008-06-05 10:25:12 0 d-------- C:\Program Files\??pPatch 2008-06-05 10:24:45 135168 --a------ C:\WINDOWS\TEK76.exe 2008-06-05 10:24:05 200768 --a------ C:\WINDOWS\system32\ncntokdm.exe 2008-06-05 10:24:01 401972 --a------ C:\WINDOWS\system32\g5.exe 2008-06-05 10:23:59 4 --a------ C:\WINDOWS\system32\hljwugsf.bin 2008-06-05 10:23:08 87513 --a------ C:\WINDOWS\lfn.exe <Not Verified; Microsoft; XML Media> 2008-06-05 10:22:47 0 d--hs---- C:\WINDOWS\YXJ0aSBhZHlh 2008-06-05 10:22:29 0 d-------- C:\WINDOWS\system32\xrem 2008-06-05 10:22:29 0 d-------- C:\WINDOWS\system32\NMP 2008-06-05 10:22:29 0 d-------- C:\WINDOWS\system32\inet2 2008-06-05 10:22:29 0 d-------- C:\WINDOWS\system32\expo 2008-06-05 10:22:29 0 d-------- C:\WINDOWS\system32\105772 2008-06-05 10:22:28 0 d-------- C:\WINDOWS\system32\btz 2008-06-05 10:22:28 0 d-------- C:\Program Files\T?sks 2008-06-05 10:22:19 0 d-------- C:\WINDOWS\system32\vntiho01 2008-05-27 09:40:06 371712 --a------ C:\WINDOWS\system32\{afb46e38-aa02-fdd1-8ddf-91f0f90121ff}.dll -- Find3M Report --------------------------------------------------------------- 2008-06-08 14:30:33 0 d-------- C:\Documents and Settings\deepak kulkarni\Application Data\Adobe 2008-06-08 14:26:07 0 d-------- C:\Program Files\Windows NT 2008-06-08 11:05:39 0 d-------- C:\Program Files\Common Files 2008-06-08 10:59:22 0 d-------- C:\Program Files\Windows Live 2008-06-05 10:25:12 0 d-------- C:\Program Files\??pPatch 2008-06-05 10:22:35 0 d-------- C:\Program Files\Online Services 2008-06-05 10:22:28 0 d-------- C:\Program Files\T?sks 2008-05-09 14:38:45 0 d-------- C:\Documents and Settings\deepak kulkarni\Application Data\AdobeUM 2008-04-25 09:49:28 0 d-------- C:\Documents and Settings\deepak kulkarni\Application Data\Real -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4d45da0d-f9ae-dd62-ad1e-501befb3d80f}] 05/27/2008 09:40 AM 371712 --a------ C:\WINDOWS\system32\{afb46e38-aa02-fdd1-8ddf-91f0f90121ff}.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [10/14/2004 03:42 PM] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [11/19/2003 06:48 PM] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [01/07/2004 02:01 AM] "MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [01/17/2006 01:03 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [04/14/2005 01:07 PM] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [11/16/2004 01:05 AM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [09/20/2005 10:32 AM] "mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [01/17/2006 01:03 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/23/2007 07:35 AM] "dwStart"="" [] "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [01/01/2007 05:22 PM] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [11/15/2007 10:24 AM] "SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [01/23/2008 03:47 PM] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [11/15/2007 10:23 AM] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [06/08/2008 11:13 AM] "BM7f23c9fd"="C:\WINDOWS\system32\ucjcohkm.dll" [06/08/2008 09:48 AM] "{6b483b13-4ed8-c5bc-361b-2775a2fe4d75}"="C:\WINDOWS\system32\{afb46e38-aa02-fdd1-8ddf-91f0f90121ff}.dll" [05/27/2008 09:40 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 06:00 AM] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [01/19/2007 01:49 PM] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [10/17/2007 01:29 AM] "@"="" [] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [] "SmileboxTray"="C:\Documents and Settings\deepak kulkarni\Application Data\Smilebox\SmileboxTray.exe" [12/04/2007 08:04 PM] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [11/15/2007 10:23 AM] -- End of Deckard's System Scanner: finished at 2008-06-15 10:21:06 ------------ ======================== extra.txt Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel(R) Pentium(R) 4 CPU 2.80GHz Percentage of Memory in Use: 61% Physical Memory (total/avail): 509.98 MiB / 197.58 MiB Pagefile Memory (total/avail): 1247.3 MiB / 605.9 MiB Virtual Memory (total/avail): 2047.88 MiB / 1914.31 MiB C: is Fixed (NTFS) - 33.94 GiB total, 23.33 GiB free. \\.\PHYSICALDRIVE0 - ST340014A - 37.25 GiB - 3 partitions \PARTITION0 - Unknown - 39.19 MiB \PARTITION1 (bootable) - Installable File System - 33.94 GiB - C: \PARTITION2 - Unknown - 3.27 GiB -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"="C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe:*:Enabled:Veoh Client" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\deepak kulkarni\Application Data CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=DEEPAKANDARTI ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOME=C:\Documents and Settings\deepak kulkarni HOMEDRIVE=C: HOMEPATH=\Documents and Settings\deepak kulkarni LOGONSERVER=\\DEEPAKANDARTI NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0401 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\DEEPAK~1\LOCALS~1\Temp TMP=C:\DOCUME~1\DEEPAK~1\LOCALS~1\Temp TMPDIR=C:\DOCUME~1\DEEPAK~1\LOCALS~1\Temp USERDOMAIN=DEEPAKANDARTI USERNAME=deepak kulkarni USERPROFILE=C:\Documents and Settings\deepak kulkarni windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- arti adya (admin) deepak kulkarni (admin) Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> C:\Program Files\Yahoo!\Yahoo! Music Jukebox\oggcodecs\uninst.exe --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu --> C:\WINDOWS\system32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6} --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19} --> MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095} --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{25EF00C6-F17B-11D6-88EA-000476CD2443}\Setup.exe" -l0x9 UNINSTALL --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{25EF00D1-F17B-11D6-88EA-000476CD2443}\Setup.exe" -l0x9 UNINSTALL --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{25EF03FD-F17B-11D6-88EA-000476CD2443}\Setup.exe" -l0x9 UNINSTALL --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002} Comcast High-Speed Internet Install Wizard --> C:\Program Files\support.com\uninstall\chsi_uninstaller.exe Dell Digital Jukebox Driver --> C:\Program Files\Dell\Digital Jukebox Drivers\DrvUnins.exe /s Dell Driver Reset Tool --> MsiExec.exe /I{5905F42D-3F5F-4916-ADA6-94A3646AEE76} Dell Picture Studio v3.0 --> MsiExec.exe /I{AF06CAE4-C134-44B1-B699-14FBDB63BD37} Dell Support Center --> MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1} DellSupport --> MsiExec.exe /X{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D} DivX Content Uploader --> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN EarthLink setup files --> MsiExec.exe /X{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE} Google Talk (remove only) --> "C:\Program Files\Google\Google Talk\uninstall.exe" Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar3.dll" Grand Master Chess OnLine --> C:\Program Files\Alawar\GMChess\uninstal.exe Highlight Viewer (Windows Live Toolbar) --> MsiExec.exe /X{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF} HijackThis 1.99.1 --> C:\Documents and Settings\deepak kulkarni\Local Settings\Temporary Internet Files\Content.IE5\VTR3GTPZ\HijackThis.exe /uninstall Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Image Transfer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{564A8DD3-70BC-4018-A5C3-7CEB10BBB6E9}\Setup.exe" -l0x9 UNINSTALL ImageMixer for Sony --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1B4AA674-F5CA-4BB5-831A-CD37B4021959}\setup.exe" Intel(R) Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572 Intel(R) PRO Network Adapters and Drivers --> Prounstl.exe Intel(R) PROSet for Wired Connections --> MsiExec.exe /I{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7} Internet Explorer Default Page --> MsiExec.exe /I{35BDEFF1-A610-4956-A00D-15453C116395} Jasc Paint Shop Photo Album 5 --> MsiExec.exe /I{4192EAC0-6B36-4723-B216-D0E86E7757AC} Jasc Paint Shop Pro Studio, Dell Editon --> MsiExec.exe /I{78C496B9-5A6B-4692-8C2E-AFFFC34E4961} Java 2 Runtime Environment, SE v1.4.2_03 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030} Macromedia Flash Player --> MsiExec.exe /X{0456ebd7-5f67-4ab6-852e-63781e3f389c} Map Button (Windows Live Toolbar) --> MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA} MetaFrame Presentation Server Web Client for Win32 --> RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wficat.inf,DefaultUninstall Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9} Microsoft Office XP Small Business --> MsiExec.exe /I{91130409-6000-11D3-8CFE-0050048383C9} Microsoft Plus! Digital Media Edition Installer --> MsiExec.exe /X{6E45BA47-383C-4C1E-8ED0-0D4845C293D7} Microsoft Plus! Photo Story 2 LE --> MsiExec.exe /X{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B} Microsoft Text-to-Speech Engine 4.0 (English) --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msTTSf22.inf, Uninstall Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" MicroStaff WINASPI --> C:\MWASPI\uninst.exe Musicmatch® Jukebox --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8EF1122E-E90C-4EE9-AB0C-7FDE2BA42C26}\setup.exe" -l0x9 -uninst QuickTime --> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 RegCure 1.5.0.0 --> C:\Program Files\RegCure\uninst.exe Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe" Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe" Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D} Smilebox --> "C:\Documents and Settings\deepak kulkarni\Application Data\Smilebox\uninstall.exe" Sonic DLA --> MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6} Sonic RecordNow! --> MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19} Sonic Update Manager --> MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3} Sony USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}\Setup.exe" UNINSTALL SopCast 2.0.4 --> C:\Program Files\SopCast\uninst.exe SpyHunter --> "C:\Program Files\Enigma Software Group\SpyHunter\Uninstall.exe" "C:\Program Files\Enigma Software Group\SpyHunter\install.log" -u Spyware Doctor 5.1 --> C:\Program Files\Spyware Doctor\unins000.exe /LOG VB 5.0 / 6.0 AddIn for WinRunner --> C:\WINDOWS\uninst.exe -fC:\WINDOWS\DeIsL2.isu Verizon Online --> C:\WINDOWS\system32\VerizonUninstaller.exe Windows Live Favorites for Windows Live Toolbar --> MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66} Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750} Windows Live Toolbar --> MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750} Windows Live Toolbar Extension (Windows Live Toolbar) --> MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe WinRunner --> C:\WINDOWS\miuninst.exe "C:\Program Files\Mercury Interactive\WinRunner\dat\miuninst.ini" XoftSpySE --> C:\Program Files\XoftSpySE\uninstall.exe Yahoo! Browser Services --> C:\PROGRA~1\Yahoo!\Common\unyext.exe Yahoo! Install Manager --> C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG Yahoo! Music Jukebox --> MsiExec.exe /X{EC3B8CA2-49B8-4D38-BE9C-ABD0F6029168} Yahoo! Photos Easy Upload Tool 1v7 --> C:\WINDOWS\system32\regsvr32 /u /s "C:\WINDOWS\cache\YDropper.dll" Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe -- Application Event Log ------------------------------------------------------- Event Record #/Type7479 / Warning Event Submitted/Written: 06/15/2008 09:48:40 AM Event ID/Source: 32068 / Microsoft Fax Event Description: The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly. Country/region code: '*' Area code: '*' Event Record #/Type7478 / Warning Event Submitted/Written: 06/15/2008 09:48:40 AM Event ID/Source: 32026 / Microsoft Fax Event Description: Fax Service failed to initialize any assigned fax devices (virtual or TAPI). No faxes can be sent or received until a fax device is installed. Event Record #/Type7475 / Error Event Submitted/Written: 06/14/2008 07:44:38 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application iexplore.exe, version 7.0.6000.16640, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea. Processing media-specific event for [iexplore.exe!ws!] Event Record #/Type7473 / Warning Event Submitted/Written: 06/14/2008 07:29:17 PM Event ID/Source: 32068 / Microsoft Fax Event Description: The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly. Country/region code: '*' Area code: '*' Event Record #/Type7472 / Warning Event Submitted/Written: 06/14/2008 07:29:17 PM Event ID/Source: 32026 / Microsoft Fax Event Description: Fax Service failed to initialize any assigned fax devices (virtual or TAPI). No faxes can be sent or received until a fax device is installed. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type29101 / Error Event Submitted/Written: 06/15/2008 09:48:40 AM Event ID/Source: 7000 / Service Control Manager Event Description: The DS1410D service failed to start due to the following error: %%2 Event Record #/Type29066 / Error Event Submitted/Written: 06/14/2008 07:29:17 PM Event ID/Source: 7000 / Service Control Manager Event Description: The DS1410D service failed to start due to the following error: %%2 Event Record #/Type29054 / Error Event Submitted/Written: 06/14/2008 06:55:16 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} Event Record #/Type29053 / Error Event Submitted/Written: 06/14/2008 06:39:00 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} Event Record #/Type29052 / Error Event Submitted/Written: 06/14/2008 05:39:00 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} -- End of Deckard's System Scanner: finished at 2008-06-15 10:21:06 ------------ |
|
     
|
|
06-16-2008, 08:52 PM
|
#3 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Location: BC, Canada
Posts: 2,727
OS: XP
|
Re: Warning : Spyware threat has been detected on your PC.
Hi. welcome to tsf!
it seems that you're not running any antivirus programs. Having no antivirus programs installed is an open invitation for malware to enter your system. I will have you download one later when we get some of these cleaned up. Please visit this webpage for download links, and instructions for running combofixl: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed. Please continue as follows:
_________ Please click Here to download HijackThis to your desktop. Click the Download button. When the Trend Micro HJT install box appears, double click on the HJTInstall.exe. Click on Install. It will be installed by default here: C:\Program Files\Trend Micro\HijackThis A shortcut to the application will also be placed on your Desktop. The program will open automatically after installation. You can double-click the icon that was placed on the Desktop to run subsequent HijackThis scans or you can use the icon inside the folder. The folder HijackThis is where you will find the HJT logs that you save. When you use the application to remove anything, you will also find the backup copies made by HJT inside this folder. Click on "Do a system scan and save logfile" When the log pops up in Notepad, copy and paste that file back here. Please include the following reports for further review, and so we may continue cleansing the system: C:\ComboFix.txt New HijackThis log.
__________________
Proud member of UNITE and ASAP since 2006  If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
| Thread Tools | |
|
|
