|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
04-15-2007, 01:51 PM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 18
OS: Windows XP
|
Continuous Popups from IE
Hello Tech Support Forums, I seem to have bit of a problem here. Whenever I click on Mozilla Firefox or IE, I always get popups. These popups are continuous, and appear every 5 minutes or so. Sometimes it's only one, and other times there's three or four. I'm also told from time to time that "hoke.dll" has stopped working and that IE needs to close. There has also been instances when my taskbar disappears, along with my shortcuts on my desktop.
I have done a HijackThis scan and it has shown the following: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 2:44:47 PM, on 4/15/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe C:\WINDOWS\arservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\ARPWRMSG.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Azureus\Azureus.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\HP\KBD\KBD.EXE c:\windows\system\hpsysdrv.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\DISC\DISCover.exe C:\Program Files\DISC\DiscUpdMgr.exe C:\Program Files\DISC\DiscStreamHub.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\Explorer.exe C:\Program Files\iTunes\iTunes.exe C:\WINDOWS\TEMP\Rar$EX04.437\HiJackThis_v2.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Compaq_Administrator\My Documents\hijackthis\HiJackThis_v2.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link.../?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {36FD9987-785A-46E1-948E-080F799B69FA} - C:\Program Files\WindowsUpdate\hoke.dll O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\qfswitxt.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O2 - BHO: (no name) - {AE7970D6-C61D-44A5-BDE6-CA8243BE1665} - C:\WINDOWS\system32\ssqpo.dll O2 - BHO: (no name) - {B9697716-61E6-4FBC-89FD-EAC504D9EFE3} - C:\WINDOWS\system32\jkkklml.dll O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ms0506820-1200] C:\WINDOWS\ms0506820-1200.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rndolvgl.dll",setvm O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe O4 - HKCU\..\Run: [umqf] C:\Program Files\InetGet2\stub_109_4_0_4_0.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Policies\Explorer\Run: [{F8D8D75C-0AEF-1033-0622-060823060001}] "C:\Program Files\Common Files\{F8D8D75C-0AEF-1033-0622-060823060001}\Update.exe" mc-110-12-0000501 O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM') O4 - S-1-5-18 Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM') O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - .DEFAULT Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: MRI_DISABLED O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.trymedia.com (HKLM) O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...09/mcfscan.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL c:\windows\system32\ldcore.dll O20 - Winlogon Notify: jkkklml - C:\WINDOWS\SYSTEM32\jkkklml.dll O20 - Winlogon Notify: ssqpo - C:\WINDOWS\system32\ssqpo.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 13107 bytes Last edited by .Socrates : 04-15-2007 at 02:12 PM. |
|
     |
|
04-17-2007, 06:43 PM
|
#3 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,752
OS: 2000 Pro; XP Pro; XP Home
|
Re: Continuous Popups from IE
Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- I see you have more than one Anti-Virus program installed, AVAST! and AVG. While this may seem like greater protection, it can cause problems including slowdowns and system hangs. Choose one to keep and uninstall the other. Any antivirus program must be removed via add/remove program. For any program that doesn't have an add/remove entry, you will have to do this: re-install the program -> reboot -> uninstall-----------------------------------------------------------------------
Do not mouseclick combofix's window whilst it's running. That may cause it to stall --------------------------------------------------------------------------------------------- Please go to: VirusTotal
--------------------------------------------------------------------------------------------- You're using the Beta version of HJT. We still prefer using v 1.99.1 See this thread: http://www.techsupportforum.com/secu...ion2-beta.html Please do this next, and allow Deckard's System Scanner to download and install HijackThis v 1.99.1 Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
What DSS will do:
---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Please do not ask for help via Private Message. |
|
|
|
|
04-18-2007, 06:49 PM
|
#4 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 18
OS: Windows XP
|
Re: Continuous Popups from IE
"Compaq_Administrator" - 07-04-18 19:53:56 Service Pack 2
ComboFix 07-04-19.1V - Running from: C:\Documents and Settings\Compaq_Administrator\My Documents\ (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\iqlvpxop.dll C:\WINDOWS\system32\opqss.bak1 C:\WINDOWS\system32\opqss.ini C:\WINDOWS\system32\ssqpo.dll C:\WINDOWS\system32\jkkklml.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\ipv6mons.dll C:\Program Files\ipwindows\UnInstall.exe C:\WINDOWS\system32\bund1\temp.txt C:\Program Files\Common Files\{38D8D~1\Bar888.dll C:\Program Files\Common Files\{38D8D~1\UnInstall.exe C:\WINDOWS\system32\ldinfo.ldr C:\Program Files\ipwindows C:\WINDOWS\system32\bund1 C:\Program Files\Common Files\{38D8D~1 C:\Program Files\Common Files\{F8D8D~1 ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_NETWORK_MONITOR ((((((((((((((((((((((((((((((( Files Created from 2007-03-18 to 2007-04-18 )))))))))))))))))))))))))))))))))) 2007-04-17 17:48 <DIR> d-------- C:\Program Files\Power Tab Software 2007-04-15 16:02 <DIR> d-------- C:\Deckard 2007-04-15 15:34 <DIR> d-------- C:\agnis-sites 2007-04-15 15:31 <DIR> d-------- C:\Program Files\SpywareGuard 2007-04-15 15:24 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-04-13 17:02 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-04-12 18:40 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-04-12 18:35 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\.housecall6.6 2007-04-12 18:34 <DIR> d-------- C:\WINDOWS\McAfee.com 2007-04-12 17:46 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-04-12 17:26 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-04-11 22:11 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\Ahead 2007-04-11 21:24 <DIR> d-------- C:\Program Files\Nero 2007-04-11 21:24 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-04-11 20:12 105,434 --a------ C:\WINDOWS\TTC.exe 2007-04-11 19:54 <DIR> d-------- C:\temp\tn3 2007-04-11 19:50 8,464 --a------ C:\WINDOWS\system32\sporder.dll 2007-04-11 19:50 72,320 --a------ C:\WINDOWS\system32\drivers\core.sys 2007-04-11 19:50 <DIR> d-------- C:\Program Files\DeskAlerts 2007-04-11 18:26 <DIR> d--hs---- C:\WINDOWS\IA 2007-04-11 18:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems 2007-04-11 18:06 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-04-11 18:04 0 --a------ C:\WINDOWS\system32\idleserv.exe 2007-04-11 18:03 80,384 --a------ C:\WINDOWS\winlog.exe 2007-04-11 18:03 4,669 --a------ C:\WINDOWS\efnc.exe 2007-04-11 18:03 0 --a------ C:\WINDOWS\system32\user_32.dll 2007-04-11 18:02 4,669 --a------ C:\efnc.exe 2007-04-11 18:02 11,612 --a------ C:\svhost.exe 2007-04-11 15:30 4 --a------ C:\WINDOWS\info147.sys 2007-04-11 15:20 <DIR> d-------- C:\Program Files\Vg 2007-04-11 15:20 <DIR> d-------- C:\Program Files\Common Files\Totem Shared 2007-04-09 13:04 184,320 --a------ C:\WINDOWS\ms0506820-1200.exe 2007-04-07 15:39 <DIR> d-------- C:\Program Files\The Sir. Community 2007-04-07 11:34 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\Help 2007-04-06 16:49 53,248 --a------ C:\WINDOWS\111uninst.exe 2007-03-25 20:00 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\AVSMedia 2007-03-25 19:58 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-03-25 19:58 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-03-25 19:58 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-03-25 19:58 <DIR> d-------- C:\Program Files\AVSMedia 2007-03-25 19:32 <DIR> d-------- C:\Program Files\Movavi Video Converter 5.1 2007-03-25 19:32 <DIR> d-------- C:\Program Files\MOVAVI 2007-03-25 19:12 <DIR> d-------- C:\Program Files\Aegisub 2007-03-25 19:11 <DIR> d-------- C:\Program Files\Webteh 2007-03-25 19:11 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\BSplayer Pro 2007-03-25 19:11 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\BSplayer 2007-03-25 19:03 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\Media Player Classic 2007-03-25 18:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\GRETECH 2007-03-25 18:47 <DIR> d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\GRETECH 2007-03-25 18:46 <DIR> d-------- C:\Program Files\GRETECH 2007-03-25 12:51 <DIR> d-------- C:\Program Files\Combined Community Codec Pack 2007-03-21 08:53 340,936 --a------ C:\WINDOWS\funnies.exe 2007-03-19 21:09 <DIR> d-------- C:\Program Files\PeerGuardian2 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-18 20:04 -------- d-------- C:\Program Files\microsoft intellipoint 2007-04-18 16:12 -------- d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\azureus 2007-04-17 20:23 -------- d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\xfire 2007-04-17 18:16 -------- d---s---- C:\Program Files\xfire 2007-04-12 22:29 -------- d-------- C:\Program Files\movie maker 2007-04-12 22:22 -------- d--h----- C:\Program Files\windowsupdate 2007-04-12 21:30 -------- d-------- C:\Program Files\alwil software 2007-04-12 15:12 -------- d-a------ C:\Program Files\Common Files\lightscribe 2007-04-11 20:11 -------- d-------- C:\Program Files\limewire 2007-04-07 20:29 -------- d-------- C:\Program Files\lucasarts 2007-04-07 12:48 -------- d--h----- C:\Program Files\installshield installation information 2007-04-07 12:48 -------- d-------- C:\Program Files\ea games 2007-04-06 21:10 -------- d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\hamachi 2007-04-04 21:09 48896 --a------ C:\DOCUME~1\COMPAQ~1\APPLIC~1\gdipfontcachev1.dat 2007-03-25 19:14 -------- d-------- C:\Program Files\avisynth 2.5 2007-03-18 21:45 -------- d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\gtk-2.0 2007-03-17 09:43 292864 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-16 21:42 -------- d-------- C:\Program Files\itunes 2007-03-16 21:42 -------- d-------- C:\Program Files\ipod 2007-03-15 10:46 57344 --a------ C:\WINDOWS\uni_eh10.exe 2007-03-11 23:49 -------- d-------- C:\Program Files\ffdshow 2007-03-11 20:34 -------- d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\divx 2007-03-11 12:16 -------- d-------- C:\Program Files\starcraft 2007-03-11 11:39 967 --a------ C:\WINDOWS\scunin.pif 2007-03-11 11:39 94208 --a------ C:\WINDOWS\scunin.exe 2007-03-11 11:39 35382 --a------ C:\WINDOWS\scunin.dat 2007-03-09 22:59 -------- d-------- C:\Program Files\quicktime 2007-03-08 11:36 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 11:36 40960 --------- C:\WINDOWS\system32\mf3216.dll 2007-03-08 11:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 09:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-04 10:27 -------- d-------- C:\Program Files\the sims 2 2007-03-02 22:38 -------- d-------- C:\Program Files\apple software update 2007-02-25 20:58 -------- d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\apple computer 2007-02-21 21:00 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-02-19 14:00 -------- d-------- C:\DOCUME~1\COMPAQ~1\APPLIC~1\europa barbarorum 2007-02-18 22:06 -------- d-------- C:\Program Files\azureus 2007-02-05 16:17 185344 --a------ C:\WINDOWS\system32\upnphost.dll 2007-01-24 18:27 1779 --a------ C:\WINDOWS\mozver.dat 2007-01-19 08:20 124401 --a------ C:\WINDOWS\hphins12.dat (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {36FD9987-785A-46E1-948E-080F799B69FA} C:\Program Files\WindowsUpdate\hoke.dll {4A368E80-174F-4872-96B5-0B27DDD11DB2} C:\Program Files\SpywareGuard\dlprotect.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ftutil2"="rundll32.exe ftutil2.dll,SetWriteCacheMode" "RTHDCPL"="RTHDCPL.EXE" "AlwaysReady Power Message APP"="ARPWRMSG.EXE" @="" "PCDrProfiler"="" "HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "ms0506820-1200"="C:\\WINDOWS\\ms0506820-1200.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "PeerGuardian"="C:\\Program Files\\PeerGuardian2\\pg2.exe" "umqf"="C:\\Program Files\\InetGet2\\stub_109_4_0_4_0.exe" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\"" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\MRI_DISABLED] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\ 63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\ 6d,73,73,74,79,6c,65,73,00 "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\ 73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSaveSettings"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "command"="C:\\Program Files\\HP\\HP Software Update\\HPwuSchd2.exe" "item"="HP Software Update" "inimapping"="0" "hkey"="HKLM" "key"="Software\\Microsoft\\Windows\\CurrentVersion\\Run" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] "command"="\"C:\\Windows\\Creator\\Remind_XP.exe\"" "item"="Reminder" "inimapping"="0" "hkey"="HKLM" "key"="Software\\Microsoft\\Windows\\CurrentVersion\\Run" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\MP Scheduled Scan.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-18 20:10:41 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 07-04-18 20:10 ----------------------------------- Here's the VirusTotal results (I hope I did them right): Antivirus Version Update Result AhnLab-V3 2007.4.19.0 04.18.2007 no virus found AntiVir 7.3.1.53 04.18.2007 ADSPY/TTC.A.2 Authentium 4.93.8 04.18.2007 no virus found Avast 4.7.981.0 04.18.2007 no virus found AVG 7.5.0.447 04.18.2007 no virus found BitDefender 7.2 04.19.2007 Adware.TTC.A CAT-QuickHeal 9.00 04.18.2007 no virus found ClamAV devel-20070416 04.18.2007 no virus found DrWeb 4.33 04.18.2007 no virus found eSafe 7.0.15.0 04.18.2007 no virus found eTrust-Vet 30.7.3578 04.19.2007 no virus found Ewido 4.0 04.18.2007 Adware.TTC FileAdvisor 1 04.19.2007 No threat detected Fortinet 2.85.0.0 04.18.2007 no virus found F-Prot 4.3.2.48 04.18.2007 no virus found F-Secure 6.70.13030.0 04.19.2007 no virus found Ikarus T3.1.1.5 04.18.2007 no virus found Kaspersky 4.0.2.24 04.19.2007 not-a-virus:AdWare.Win32.TTC.a McAfee 5012 04.18.2007 no virus found Microsoft 1.2405 04.18.2007 no virus found NOD32v2 2202 04.18.2007 no virus found Norman 5.80.02 04.18.2007 no virus found Panda 9.0.0.4 04.18.2007 Adware/TTC Prevx1 V2 04.19.2007 no virus found Sophos 4.16.0 04.17.2007 no virus found Sunbelt 2.2.907.0 04.14.2007 no virus found Symantec 10 04.19.2007 no virus found TheHacker 6.1.6.095 04.15.2007 no virus found VBA32 3.11.3 04.18.2007 no virus found VirusBuster 4.3.7:9 04.18.2007 no virus found Webwasher-Gateway 6.0.1 04.18.2007 Ad-Spyware.TTC.A.2 Aditional Information File size: 139264 bytes MD5: 5772663a5a4092c208f543baed9f2e75 SHA1: 9866182395315cab8a1272becaf91d46a0f4eaa3 Bit9 info: http://fileadvisor.bit9.com/services...f543baed9f2e75 ------------------------------- DSS results Deckard's System Scanner v20070411.38 Run by Compaq_Administrator on 2007-04-18 at 20:48:31 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Compaq_Administrator.exe) -------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 8:47:03 PM, on 4/18/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\arservice.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\ARPWRMSG.EXE C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\ms0506820-1200.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\HP\KBD\KBD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE c:\windows\system\hpsysdrv.exe C:\WINDOWS\notepad.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...RIO&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {36FD9987-785A-46E1-948E-080F799B69FA} - C:\Program Files\WindowsUpdate\hoke.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ms0506820-1200] C:\WINDOWS\ms0506820-1200.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [umqf] C:\Program Files\InetGet2\stub_109_4_0_4_0.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O15 - Trusted Zone: http://*.trymedia.com (HKLM) O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...09/mcfscan.cab O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- Files created between 2007-03-18 and 2007-04-18 ----------------------------- 2007-04-17 17:48:45 0 d-------- C:\Program Files\Power Tab Software<POWERT~1> 2007-04-15 15:34:21 0 d-------- C:\agnis-sites<AGNIS-~1> 2007-04-15 15:31:33 0 d-------- C:\Program Files\SpywareGuard<SPYWAR~2> 2007-04-15 15:24:58 0 d-------- C:\WINDOWS\system32\ActiveScan<ACTIVE~1> 2007-04-13 17:02:09 626688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-04-12 18:40:46 76560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-04-12 18:35:30 0 d-------- C:\Documents and Settings\Compaq_Administrator\.housecall6.6<HOUSEC~1.6> 2007-04-12 18:34:55 0 d-------- C:\WINDOWS\McAfee.com 2007-04-12 17:46:14 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-04-12 17:26:19 0 d-------- C:\Program Files\SpywareBlaster<SPYWAR~1> 2007-04-11 22:11:21 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Ahead 2007-04-11 21:24:47 0 d-------- C:\Program Files\Nero 2007-04-11 21:24:44 0 d-------- C:\Program Files\Common Files\Ahead 2007-04-11 20:12:46 105434 --a------ C:\WINDOWS\TTC.exe 2007-04-11 19:50:56 8464 --a------ C:\WINDOWS\system32\sporder.dll 2007-04-11 19:50:35 0 d-------- C:\Program Files\DeskAlerts<DESKAL~1> 2007-04-11 19:50:26 72320 --a------ C:\WINDOWS\system32\drivers\core.sys 2007-04-11 18:26:12 0 d--hs---- C:\WINDOWS\IA 2007-04-11 18:20:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems<ADOBES~1> 2007-04-11 18  02 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared<ADOBES~1>2007-04-11 18:04:07 0 --a------ C:\WINDOWS\system32\idleserv.exe 2007-04-11 18:03:45 1 --a------ C:\WINDOWS\stat 2007-04-11 18:03:45 4669 --a------ C:\WINDOWS\efnc.exe 2007-04-11 18:03:41 80384 --a------ C:\WINDOWS\winlog.exe 2007-04-11 18:03:10 0 --a------ C:\WINDOWS\system32\user_32.dll 2007-04-11 18:02:39 11612 --a------ C:\svhost.exe 2007-04-11 18:02:22 0 --a------ C:\-120006820<-12000~1> 2007-04-11 18:02:20 4669 --a------ C:\efnc.exe 2007-04-11 15:30:07 4 --a------ C:\WINDOWS\info147.sys 2007-04-11 15:20:28 0 d-------- C:\Program Files\Common Files\Totem Shared<TOTEMS~1> 2007-04-11 15:20:09 0 d-------- C:\Program Files\Vg 2007-04-09 13:04:23 184320 --a------ C:\WINDOWS\ms0506820-1200.exe<MS0506~1.EXE> 2007-04-07 15:39:49 0 d-------- C:\Program Files\The Sir. Community<THESIR~1.COM> 2007-04-07 11:34:13 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Help 2007-04-06 16:49:43 53248 --a------ C:\WINDOWS\111uninst.exe<111UNI~1.EXE> 2007-03-25 20:00:50 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\AVSMedia 2007-03-25 19:58:16 0 d-------- C:\Program Files\Common Files\AVSMedia 2007-03-25 19:58:15 24576 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-03-25 19:58:14 261632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-03-25 19:58:14 0 d-------- C:\Program Files\AVSMedia 2007-03-25 19:32:15 0 d-------- C:\Program Files\MOVAVI 2007-03-25 19:32:06 0 d-------- C:\Program Files\Movavi Video Converter 5.1<MOVAVI~1.1> 2007-03-25 19:12:26 0 d-------- C:\Program Files\Aegisub 2007-03-25 19:11:14 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\BSplayer 2007-03-25 19:11:14 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\BSplayer Pro<BSPLAY~1> 2007-03-25 19:11:13 0 d-------- C:\Program Files\Webteh 2007-03-25 19:03:19 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Media Player Classic<MEDIAP~1> 2007-03-25 18:48:33 0 d-------- C:\Documents and Settings\All Users\Application Data\GRETECH 2007-03-25 18:47:34 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\GRETECH 2007-03-25 18:46:39 0 d-------- C:\Program Files\GRETECH 2007-03-25 12:51:43 0 d-------- C:\Program Files\Combined Community Codec Pack<COMBIN~1> 2007-03-22 07:09:59 1778 --a------ C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache<QTSBAN~1> 2007-03-21 08:53:30 340936 --a------ C:\WINDOWS\funnies.exe 2007-03-19 21:09:57 0 d-------- C:\Program Files\PeerGuardian2<PEERGU~1> -- Find3M Report --------------------------------------------------------------- 2007-04-18 20:04:22 0 d-------- C:\Program Files\Microsoft IntelliPoint<MIFB84~1> 2007-04-18 16:12:48 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Azureus 2007-04-18 08:00:22 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\AVG7 2007-04-17 20:23:53 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Xfire 2007-04-17 18:16:19 0 d---s---- C:\Program Files\Xfire 2007-04-12 22:29:15 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1> 2007-04-12 22:22:04 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~4> 2007-04-12 21:30:17 0 d-------- C:\Program Files\Alwil Software<ALWILS~1> 2007-04-12 16:23:42 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Adobe 2007-04-12 15:12:24 0 d-a------ C:\Program Files\Common Files\LightScribe<LIGHTS~1> 2007-04-11 20:15:12 0 d---s---- C:\Documents and Settings\Compaq_Administrator\Application Data\Microsoft<MICROS~1> 2007-04-11 20:11:06 0 d-------- C:\Program Files\LimeWire 2007-04-11 18 36 0 d-------- C:\Program Files\Common Files\Adobe2007-04-07 20:29:42 0 d-------- C:\Program Files\LucasArts<LUCASA~1> 2007-04-07 12:48:33 0 d-------- C:\Program Files\EA GAMES<EAGAME~1> 2007-04-07 12:48:31 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-04-06 21:10:17 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Hamachi 2007-04-04 21:09:26 48896 --a------ C:\Documents and Settings\Compaq_Administrator\Application Data\GDIPFONTCACHEV1.DAT<GDIPFO~1.DAT> 2007-03-25 19:14:08 0 d-------- C:\Program Files\AviSynth 2.5<AVISYN~1.5> 2007-03-23 15:54:09 0 d-------- C:\Program Files\Activision<ACTIVI~1> 2007-03-18 21:45:15 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\gtk-2.0 2007-03-17 09:43:01 292864 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-16 21:42:14 0 d-------- C:\Program Files\iTunes 2007-03-16 21:42:04 0 d-------- C:\Program Files\iPod 2007-03-15 10:46:35 57344 --a------ C:\WINDOWS\uni_eh10.exe 2007-03-11 23:49:38 0 d-------- C:\Program Files\ffdshow 2007-03-11 20:34:19 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\DivX 2007-03-11 12:16:25 0 d-------- C:\Program Files\Starcraft<STARCR~1> 2007-03-11 11:39:31 35382 --a------ C:\WINDOWS\scunin.dat 2007-03-11 11:39:30 967 --a------ C:\WINDOWS\ScUnin.pif 2007-03-11 11:39:30 94208 --a------ C:\WINDOWS\ScUnin.exe 2007-03-09 22:59:04 0 d-------- C:\Program Files\QuickTime<QUICKT~1> 2007-03-08 11:36:28 577536 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 11:36:28 40960 -----n--- C:\WINDOWS\system32\mf3216.dll 2007-03-08 11:36:28 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 09:47:48 1843584 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-04 10:27:54 0 d-------- C:\Program Files\The Sims 2<THESIM~1> 2007-03-02 22:38:16 0 d-------- C:\Program Files\Apple Software Update<APPLES~1> 2007-02-25 20:58:03 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Apple Computer<APPLEC~1> 2007-02-21 21:00:28 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-02-19 14:00:38 0 d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Europa Barbarorum<EUROPA~1> 2007-02-18 22 49 0 d-------- C:\Program Files\Azureus2007-02-05 16:17:02 185344 --a------ C:\WINDOWS\system32\upnphost.dll 2007-01-24 18:27:11 1779 --a------ C:\WINDOWS\mozver.dat 2007-01-19 08:20:07 124401 --a------ C:\WINDOWS\HPHins12.dat -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "PeerGuardian"="C:\\Program Files\\PeerGuardian2\\pg2.exe" "umqf"="C:\\Program Files\\InetGet2\\stub_109_4_0_4_0.exe" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\"" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\MRI_DISABLED] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ftutil2"="rundll32.exe ftutil2.dll,SetWriteCacheMode" "RTHDCPL"="RTHDCPL.EXE" "AlwaysReady Power Message APP"="ARPWRMSG.EXE" @="" "PCDrProfiler"="" "HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "ms0506820-1200"="C:\\WINDOWS\\ms0506820-1200.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "command"="C:\\Program Files\\HP\\HP Software Update\\HPwuSchd2.exe" "item"="HP Software Update" "inimapping"="0" "hkey"="HKLM" "key"="Software\\Microsoft\\Windows\\CurrentVersion\\Run" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] "command"="\"C:\\Windows\\Creator\\Remind_XP.exe\"" "item"="Reminder" "inimapping"="0" "hkey"="HKLM" "key"="Software\\Microsoft\\Windows\\CurrentVersion\\Run" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook" "{81559C35-8464-49F7-BB0E-07A383BEF910}"="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\ 63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\ 6d,73,73,74,79,6c,65,73,00 "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\ 73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSaveSettings"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 -- End of Deckard's System Scanner: finished at 2007-04-18 at 20:48:54 --------- |
|
|
|
|
04-18-2007, 08:17 PM
|
#5 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 26,752
OS: 2000 Pro; XP Pro; XP Home
|
Re: Continuous Popups from IE
Before begining the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Please download the Suspicious File Packer http://www.safer-networking.org/files/sfp.zip Unzip it to the desktop and run it. Paste the following list of bad files into the Suspicious File Packer window: C:\WINDOWS\TTC.exeAllow SFP to pack the files. This will generate a CAB archive on your desktop. Please submit it to this site http://www.bleepingcomputer.com/subm....php?channel=4 Please include a link to this topic in the message. Please download the OTMoveIt by OldTimer.
Please post the log from OTMoveIt in your next reply, it's located here: c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log Where mmddyyyy_hhmmss is the date of the tool run. --------------------------------------------------------------------------------------------- Download AVG Anti-Spyware from HERE
--------------------------------------------------------------------------------------------- Please download Brute Force Uninstaller to your desktop.
Save it in the same folder you made earlier (c:\BFU). Do not do anything with these yet! Download and install CleanUp! NOTE: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Do NOT run this program if you have XP Professional 64 bit edition. If you're unsure please do not run it! If you don't already know, you're probably not using XP64, but you can download & run this tool to find out for sure.....http://www.kellys-korner-xp.com/regs...p_whichcpu.exe --------------------------------------------------------------------------------------------- Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {36FD9987-785A-46E1-948E-080F799B69FA} - C:\Program Files\WindowsUpdate\hoke.dll O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - (no file) O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - O4 - HKCU\..\Run: [umqf] C:\Program Files\InetGet2\stub_109_4_0_4_0.exe O15 - Trusted Zone: http://*.trymedia.com (HKLM) Close HijackThis now. --------------------------------------------------------------------------------------------- Run Cleanup! using the following configuration: Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: Click "Options..." Move the arrow down to "Custom CleanUp!" Put a check next to the following (Make sure nothing else is checked!):
Press the CleanUp! button to start the program.. Do NOT Reboot/logoff when prompted. * CleanUp! will not create any backups!! --------------------------------------------------------------------------------------------- Run AVG Anti-Spyware with it's updated definitions:(...it's important that all windows must be closed)
--------------------------------------------------------------------------------------------- Then, please go to Start > My Computer and navigate to the C:\BFU folder.
--------------------------------------------------------------------------------------------- Perform an online scan with Internet Explorer with Panda ActiveScan Click on the "Free To Use ActiveScan" located on the top right hand corner
--------------------------------------------------------------------------------------------- Run DSS again, and post it's log. --------------------------------------------------------------------------------------------- Create an uninstall list:
Please return with results from: AVG Anti-Spyware Panda DSS (main.txt) HJT uninstall list
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. Last edited by tetonbob : 04-18-2007 at 08:21 PM. |
|
|
|
and select alcanshorty.bfu by double clicking on it.