Computer check-up

[tinner105]

My daughters computer is running fine now. So now i'm going to check out my personal computer( since the Gkids are on it when they are here.

I did a Hijack scan and here it is

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:05:58, on 6/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\TONY\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX5400] C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_cx5400097f\E_S4I2G1.EXE /P19 "EPSON Stylus CX5400" /O6 "USB001" /M "Stylus CX5400"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks\osCheck.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.70\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 3.70\MediaManager\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/downloads/tgctlcm.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite....x/qtplugin.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen10.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/zenpuzzlegar...GameLoader.dll
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - http://www.symantec.com/techsupp/act...a/nprdtinf.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1092960115328
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://register3.valueactive.com/mp...CX/FlashAX.cab
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe

--
End of file - 10303 bytes
Im going to run a panda scan and post it later
Thanks
Tony

[Ried]

Hi Tony,

I'm not seeing anything horrible here. Open HijackThis and click on 'Do a System Scan Only'. 'Check' the following entries:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - Startup: PowerReg Scheduler V3.exe
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen10.exe
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://register3.valueactive.com/mp...CX/FlashAX.cab



Click 'Fix Checked' and close HijackThis.

--------------------------------------------------------------------

Let's see what Panda has to say.

[tinner105]

Howdy the daughters computers running great. I just put a new cd player in it and its done. Thanks Again for helping me out.

heres a Panda scan for this system

NALYSIS: 2008-06-17 22:28:13
PROTECTIONS: 1
MALWARE: 21
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Norton AntiVirus 15.0.0.58 No Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00024343 adware/keenvalue Adware No 0 Yes No c:\windows\system32\drivers\etc\hosts.bho
00029258 application/altnet HackTools No 0 Yes No HKEY_CLASSES_ROOT\Interface\{582AB125-1403-42FB-9EFB-198690BA1496}
00032745 adware/sahagent Adware No 0 Yes No c:\windows\system32\shagentnew.dll
00064489 adware/rxtoolbar Adware No 1 Yes No HKEY_LOCAL_MACHINE\software\classes\protocols\filter\text/html\CLSID\{2AB289AE-4B90-4281-B2AE-1F4BB034B647}
00064489 adware/rxtoolbar Adware No 1 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{59879FA4-4790-461c-A1CC-4EC4DE4CA483}
00103103 Exploit/CodeBase.A HackTools No 0 Yes No C:\install.htm
00122168 Application/Restart HackTools No 0 Yes No C:\WINDOWS\system32\Tools\Restart.exe
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308245.TXT
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\TONY\Cookies\tony@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00309855.TXT
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308246.TXT
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\TONY\Cookies\tony@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00309854.TXT
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308483.TXT
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308261.TXT
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308484.TXT
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308485.TXT
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00309856.TXT
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308260.TXT
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308262.TXT
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\TONY\Cookies\tony@tribalfusion[1].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00309859.TXT
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00309864.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308400.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308454.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308352.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308353.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308354.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308361.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308362.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308364.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308366.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308367.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308368.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308369.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308370.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308372.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308374.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308375.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308376.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308378.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308380.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308382.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308383.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308384.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308385.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308386.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308387.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308426.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308389.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308390.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308388.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308401.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308402.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308403.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308404.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308405.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308406.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308407.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308408.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308410.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308412.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308414.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308415.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308416.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308417.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308418.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308421.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308422.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308423.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308424.TXT
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308425.TXT
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00309853.TXT
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308277.TXT
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308481.TXT
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308482.TXT
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308276.TXT
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308275.TXT
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00308274.TXT
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\RECYCLER\NPROTECT\00309852.TXT
00169752 application/need2find HackTools No 0 Yes No c:\program files\need2find
00169752 application/need2find HackTools No 0 Yes No hkey_current_user\software\need2find
00169752 application/need2find HackTools No 0 Yes No hkey_local_machine\software\need2find
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\TONY\Cookies\tony@questionmarket[1].txt
00172825 Joke/Stress Jokes No 0 Yes No C:\Documents and Settings\Chris\Desktop\dEsKtOp.EXE
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\TONY\Cookies\tony@adultfriendfinder[2].txt
00527204 Application/PRScheduler HackTools No 0 Yes No C:\RECYCLER\NPROTECT\00310155.EXE
00527204 Application/PRScheduler HackTools No 0 Yes No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1234\A0326389.EXE
00527204 Application/PRScheduler HackTools No 0 Yes No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1266\A0330308.exe
00527204 Application/PRScheduler HackTools No 0 Yes No C:\Documents and Settings\CONNIE\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
01176994 Bck/VB.XB Virus/Trojan No 0 No No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1259\A0328450.exe[327882R2FWJFW\NirCmdC.cfexe]
01176994 Bck/VB.XB Virus/Trojan No 0 No No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1259\A0328452.exe[327882R2FWJFW\NirCmdC.cfexe]
01176994 Bck/VB.XB Virus/Trojan No 0 No No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1260\A0329643.exe[327882R2FWJFW\NirCmdC.cfexe]
01176994 Bck/VB.XB Virus/Trojan No 0 No No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1257\A0328239.exe[327882R2FWJFW\NirCmdC.cfexe]
01176994 Bck/VB.XB Virus/Trojan No 0 No No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1257\A0328240.exe[327882R2FWJFW\NirCmdC.cfexe]
01176994 Bck/VB.XB Virus/Trojan No 0 No No C:\System Volume Information\_restore{8FEFE915-243F-46E8-AE63-8E63ACB73BA5}\RP1258\A0328415.exe[327882R2FWJFW\NirCmdC.cfexe]
;===================================================================================================================================================================================
SUSPECTS
Sent Location D
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description D
;===================================================================================================================================================================================
;===================================================================================================================================================================================
thanks for lookin

Tony

[Ried]

Hi Tony,

Open HijackThis
*Click on the "Configure" button on the bottom right
*Click on the tab "Misc Tools"
*Click on the Box that says "Open Uninstall Manager"
*Click on the button "Save list"
The list will automatically be saved in your HijackThis folder.

Please copy and paste the uninstall_list.txt here.

[tinner105]

Im getting a litttle better at this
32 Bit HP CIO Components Installer
Adobe Flash Player ActiveX
Adobe Reader 7.0.9
Adobe Shockwave Player
AppCore
Apple Mobile Device Support
Apple Software Update
ArcSoft Software Suite
Bonjour
ccCommon
ccCommon
CCScore
Component Framework
Connection Keep Alive
Counter-Strike(TM)
DivX
DivX Player
EPSON Printer Software
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSTOOLS
essvatgt
essvcpt
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Gore
HijackThis 2.0.2
HLPPDOCK
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP Officejet Pro All-In-One Series
HP Photosmart Essential
HP Solution Center 8.0
HP Update
ieSpell
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.1
Java 2 Runtime Environment, SE v1.4.2_04
Java Web Start
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) SE Runtime Environment 6 Update 1
kgcbase
Kodak EasyShare software
Kool Kart Racers
KSU
LimeWire 4.14.12
LiveReg (Symantec Corporation)
LiveUpdate (Symantec Corporation)
LiveUpdate (Symantec Corporation)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.11)
MP3 Player Utilities 3.70
MSRedist
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
NetJet 2.0
Norton AntiVirus
Norton AntiVirus (Symantec Corporation)
Norton AntiVirus Help
Norton Cleanup
Norton Protection Center
Norton Protection Center
Norton SystemWorks
Norton SystemWorks
Norton SystemWorks
Norton SystemWorks (Symantec Corporation)
Norton Utilities
Notifier
NVIDIA Display Driver
OfotoXMI
OTtBP
OTtBPSDK
Panda ActiveScan 2.0
Peak Performance Snowboarding
Power MP3 WMA Converter 1.14
QuickTime
RealPlayer
RoadRunner
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
SFR
SFR2
SHASTA
Shockwave
SKIN0001
SKINXSDK
SPAMfighter
SPBBC 32bit
staticcr
Steam(TM)
Symantec Technical Support Web Controls
SymNet
TomTom HOME
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
VC_MergeModuleToMSI
VIA Audio Driver Setup Program
VIA Rhine-Family Fast-Ethernet Adapter
VPRINTOL
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
WinZip
WIRELESS
yepp Driver

Thanks
Tony

[Ried]

Im getting a litttle better at this

You sure are.


You may want to copy these instructions to Notepad and save to your desktop for reference.

Open notepad and copy/paste the entire text in the code box below: (don't forget to copy and paste REGEDIT4)

REGEDIT4

[-hkey_current_user\software\need2find]

[-hkey_local_machine\software\need2find]

Save the file as "delete.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

--------------------------------------------------------------------

Delete the following folder:

c:\program files\ need2find

--------------------------------------------------------------------


Uninstall the older versions of Java as they are no longer needed and taking up hard drive space unnecessarily.

Click Start->Control Panel->Add/Remove Programs and uninstall all of these:

J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.1
Java 2 Runtime Environment, SE v1.4.2_04
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6 Update 1

**Leave this one intact - Java(TM) 6 Update 5

You may receive notice that they've been uninstalled already, or otherwise corrupted, would you like to remove them from the list. Click on OK, or Yes.

--------------------------------------------------------------------

Reboot the system.

You should be all set now. Is everything running fine?

[tinner105]

Ried, Thanks once again for all of your help.
The computer was running ok, but i just wanted to make sure there wasn't anything wrong that was hidden.
So I guess this one good to go too :)

Thanks Again
Tony

[Ried]

You're welcome, Tony.


Nice work on your daughter's machine, by the way.


Take care.