|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-12-2006, 08:03 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 10
OS: WINDOWS XP
|
change homepage
Not sure if I am in theright place here - downloaded yahoo as homepage a few weeks ago - prefer google, but can't change.
Every time I change it, it changes back. I have tried system restore - won't let me restore ebeyond point where yahoo installed (also installed tool bar and yahoo messenger at time - have removed these successfully). I run AVG, Zone alarms, Ad-aware, Spybot and spyware blaster. I have changed default settings on ad-aware and all my scans are coming back clear. What will I do next? |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-12-2006, 12:20 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,453
OS: N/A
|
Download HiJackThis - this program will help determine if there's any malware on your computer.
1. Double-click on the file you just downloaded. 2. Click on the "Unzip" button to install the newer version. 3. It will by default install to the directory - C:\Program Files\HiJackThis\ 4. If it gives you an intro screen, just choose - Do a system scan and save a logfile. 5. If you don't get the intro screen, just hit [Scan] and then click on Save log. 6. Post the HiJackThis.log file
__________________
Question - what have you done for the community today? |
|
|
|
|
07-12-2006, 03:06 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 10
OS: WINDOWS XP
|
hijack this logfile
Logfile of HijackThis v1.99.1 Scan saved at 18:58:30, on 12/07/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\VIAudioi\SBADeck\ADeck.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ScanSoft\OmniPageSE\opware32.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Outlook Express\msimn.exe C:\Documents and Settings\David Blair\Desktop\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://ebanking.northernbank.co.uk/.../e-Safekey.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{55B7C673-B115-4412-894D-ACA977ECB03B}: NameServer = 80.225.255.50 80.225.255.58 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
|
|
|
07-12-2006, 03:41 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,453
OS: N/A
|
Is yahoo the only thing that's bothering you? If so, let's give it a cursory whack first. If that doesn't work, we'll take a deeper look at it.
Download ResetTeaTimer.bat. Double click ResetTeaTimer.bat to remove all entries set by SpyBot's TeaTimer. Please disable Ewido's real-time scanner, as it may hinder the removal To disable Ewido's real-time scanner:
Then, do a HijackThis scan & place a check next to these items and select "Fix checked": R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll Do another HJT scan & tell me if it's gone
__________________
Question - what have you done for the community today? |
|
|
|
|
07-12-2006, 04:18 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 10
OS: WINDOWS XP
|
New log - still can't change home page
Logfile of HijackThis v1.99.1 Scan saved at 23:17:35, on 12/07/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\VIAudioi\SBADeck\ADeck.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ScanSoft\OmniPageSE\opware32.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\David Blair\My Documents\hijack this\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://ebanking.northernbank.co.uk/.../e-Safekey.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{55B7C673-B115-4412-894D-ACA977ECB03B}: NameServer = 80.225.255.50 80.225.255.58 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
|
|
|
07-12-2006, 04:25 PM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,453
OS: N/A
|
Okies... time to dig deeper.
 Please download SilentRunners.vbs - Right click & choose Save As... SilentRunners.vbs Before proceeding, disable any anti-virus or anti-spyware programs that may block/disable scripts Launch SilentRunners by double-clicking the downloaded file. In the ensuing Window, select 'No' to avoid skipping supplementary searches. Please be patient as the script requires a few minutes to complete. When it's done, you'll receive the prompt "All Done!". It will create a file called "Startup Programs". Post ALL its contents here in your next reply. Download StartDreck Unzip to its own folder and start the program: Press 'Config' Press 'mark all' Uncheck the following box only: List Modules - (listed under 'Running Proceses') Press 'OK' Press 'Save' and select the location to save the log file (default is the same folder as the application) Go to HijackThis> Config> Misc Tools Checkmark/tick 'list also minor sections (full)' Checkmark/tick 'list empty sections (complete)' Click the 'Generate StartupList log' button Post the log in your next reply Download & extract this file to it's own folder - Registry Search Launch Registry Search In the search box, enter yahoo & click "Ok". Notepad will open with some text in it (the file will also be saved in the program's folder as well). Post this text in your next reply
__________________
Question - what have you done for the community today? |
|
|
|
|
07-12-2006, 04:54 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 10
OS: WINDOWS XP
|
As requested:
"Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "RealPlayer" = ""C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot" ["RealNetworks, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "VTTimer" = "VTTimer.exe" ["S3 Graphics, Inc."] "VTTrayp" = "VTtrayp.exe" ["S3 Graphics Co., Ltd."] "AudioDeck" = "C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 " ["VIA Technologies, Inc."] "RoxioEngineUtility" = ""C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"" ["Roxio"] "RoxioDragToDisc" = ""C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"" ["Roxio"] "RoxioAudioCentral" = ""C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"" ["Roxio, Inc."] "adiras" = "adiras.exe" [file not found] "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "EPSON Stylus C64 Series" = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"" ["SEIKO EPSON CORPORATION"] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."] "Omnipage" = "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"] "Zone Labs Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" [MS] "!ewido" = ""C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension" -> {HKLM...CLSID} = "Display Panning CPL Extension" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{5E44E225-A408-11CF-B581-008029601108}" = "Roxio DragToDisc Shell Extension" -> {HKLM...CLSID} = "Roxio DragToDisc Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll" ["Roxio"] "{A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC}" = "My Media" -> {HKLM...CLSID} = "My Media" \InProcServer32\(Default) = "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll" ["Roxio, Inc."] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\David Blair\Local Settings\Application Data\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\BLUEPL~1.SCR" (Blue Planet Shallow Seas.scr) [empty string] Startup items in "David Blair" & "All Users" startup folders: ------------------------------------------------------------- C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS] "VIA RAID TOOL" -> shortcut to: "C:\Program Files\VIA\RAID\raid_tool.exe" ["VIA Technologies"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVG7\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe" ["GRISOFT, s.r.o."] Canon Camera Access Library 8, CCALib8, "C:\Program Files\Canon\CAL\CALMAIN.exe" ["Canon Inc."] ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ EPSON V6 2KMonitor\Driver = "EBPMON24.DLL" ["SEIKO EPSON CORPORATION"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 31 seconds, including 18 seconds for message boxes) StartDreck (build 2.1.7 public stable) - 2006-07-12 @ 23:41:27 (GMT +01:00) Platform: Windows XP (Win NT 5.1.2600 Service Pack 2) Internet Explorer: 6.0.2900.2180 Logged in as David Blair at SHUTTLE-AD94BDD »Registry »Run Keys »Current User »Run *CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe *MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background *RealPlayer="C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot »RunOnce »Default User »Run *CTFMON.EXE=C:\WINDOWS\system32\CTFMON.EXE *AVG7_Run=C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE »RunOnce »Local Machine »Run *VTTimer=VTTimer.exe *VTTrayp=VTtrayp.exe *AudioDeck=C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 *RoxioEngineUtility="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" *RoxioDragToDisc="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" *RoxioAudioCentral="C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" *adiras=adiras.exe *AVG7_CC=C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP *EPSON Stylus C64 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64" *QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime *SunJavaUpdateSched=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe *TkBellExe="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot *Omnipage=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe *Zone Labs Client="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" *KernelFaultCheck=%systemroot%\system32\dumprep 0 -k *!ewido="C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized +OptionalComponents +MSFS *Installed=1 +MAPI *Installed=1 *NoChange=1 +MAPI *Installed=1 *NoChange=1 »RunOnce »RunServices »RunServicesOnce »RunOnceEx »RunServicesOnceEx »File Associations (CR) +.bat *batfile="%1" %* +.com *comfile="%1" %* +.disabled *SpybotSD.DisabledFile="C:\Program Files\Spybot - Search & Destroy\blindman.exe" "%1" +.exe *exefile="%1" %* +.hta *htafile=C:\WINDOWS\system32\mshta.exe "%1" %* +.htm *htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome +.html *htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome +.js *JSFile=%SystemRoot%\System32\WScript.exe "%1" %* +.jse *JSEFile=%SystemRoot%\System32\WScript.exe "%1" %* +.pif *piffile="%1" %* +.reg *regfile=regedit.exe "%1" +.scr *scrfile="%1" /S +.txt *txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1 +.vbs *VBSFile=%SystemRoot%\System32\WScript.exe "%1" %* +.vbe *VBEFile=%SystemRoot%\System32\WScript.exe "%1" %* +.wsh *WSHFile=%SystemRoot%\System32\WScript.exe "%1" %* +.wsf *WSFFile=%SystemRoot%\System32\WScript.exe "%1" %* +.lnk `lnkfile= [key or value does not exist] »Active Setup (LM) +Internet Explorer/>{26923b43-4d38-484f-9b9e-de460746276c} *StubPath=%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE +Browser Customizations/>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS *StubPath=RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP +Outlook Express/>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} *StubPath=%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE +Themes Setup/{2C7339CF-2B09-4501-B3F3-F3508C9228ED} *StubPath=%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll +Microsoft Outlook Express 6/{44BBA840-CC51-11CF-AAFA-00AA00B6015C} *StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install +NetMeeting 3.01/{44BBA842-CC51-11CF-AAFA-00AA00B6015B} *StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT +Internet Explorer/{4b218e3e-bc98-4770-93d3-2731b9329278} *StubPath=%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf +Windows Messenger 4.7/{5945c046-1e7d-11d1-bc44-00c04fd912be} *StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser +Microsoft Windows Media Player/{6BF52A52-394A-11d3-B153-00C04F79FAA6} *StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub +Address Book 6/{7790769C-0471-11d2-AF11-00C04FA35D02} *StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install +Windows Desktop Update/{89820200-ECBD-11cf-8B85-00AA005B4340} *StubPath=regsvr32.exe /s /n /i:U shell32.dll +Internet Explorer 6/{89820200-ECBD-11cf-8B85-00AA005B4383} *StubPath=%SystemRoot%\system32\ie4uinit.exe »Browser Helper Objects (LM) *AcroIEHelper.AcroIEHlprObj.1/{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} `InprocServer32=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\PROGRA~1\SPYBOT~1\SDHelper.dll *SSVHelper Class/{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} `InprocServer32=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll *Google Toolbar Helper/{AA58ED58-01DD-4d91-8333-CF10577473F7} `InprocServer32=c:\program files\google\googletoolbar2.dll »Internet Explorer »Current User *Local Page=C:\WINDOWS\system32\blank.htm *Search Bar=http://www.google.com/ie *Search Page=http://www.google.com *Start Page=http://www.yahoo.com/ +SearchUrl *provider=gogl »Default User »Local Machine *Default_Page_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome *Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Local Page=%SystemRoot%\system32\blank.htm *Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Start Page=http://www.yahoo.com/ *CustomizeSearch=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm *SearchAssistant=http://www.google.com/ie »ShellServiceObjectDelayLoad (LM) *PostBootReminder={7849596a-48ea-486e-8937-a2a3009f31a9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *CDBurn={fbeb8a05-beee-4442-804e-409d6c4515e9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *WebCheck={E6FB5E20-DE35-11CF-9C87-00AA005127ED} `InprocServer32=%SystemRoot%\system32\webcheck.dll *SysTray={35CEC8A3-2BE6-11D2-8773-92E220524153} `InprocServer32=C:\WINDOWS\system32\stobject.dll »Special NT Values »Current User *Load= *Run= *Programs=com exe bat pif cmd *SHELL= »Default User *Load= *Run= *Programs=com exe bat pif cmd *SHELL= »Local Machine *AppInit_DLLs= *SHELL=Explorer.exe *Userinit=C:\WINDOWS\system32\userinit.exe, »Files »Autostart Folders »Current User *C:\Documents and Settings\David Blair\Start Menu\Programs\Startup\desktop.ini »Default User »Local Machine *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DSLMON.lnk *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk *C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk »INI-Files »WIN.INI\[windows] *LOAD= *RUN= »SYSTEM.INI\[boot] *SHELL=Explorer.exe »Text Files *C:\boot.ini `[boot loader] `timeout=30 `default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS `[operating systems] `multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect *C:\msdos.sys *C:\config.sys *C:\WINDOWS\system32\config.nt `dos=high, umb `device=%SystemRoot%\system32\himem.sys `files=40 *C:\autoexec.bat *C:\WINDOWS\system32\autoexec.nt `@echo off `lh %SystemRoot%\system32\mscdexnt.exe `lh %SystemRoot%\system32\redir `lh %SystemRoot%\system32\dosx `SET BLASTER=A220 I5 D1 P330 T3 *C:\WINDOWS\system32\drivers\etc\hosts `127.0.0.1 localhost »Program Files *C:\ntldr *C:\ntdetect.com *C:\io.sys *C:\WINDOWS\system32\win.com *C:\WINDOWS\explorer.exe »%PATH% Companion Files +C:\WINDOWS\system32\notepad.exe *C:\WINDOWS\NOTEPAD.EXE +C:\WINDOWS\system32\taskman.exe *C:\WINDOWS\TASKMAN.EXE +C:\WINDOWS\system32\winhlp32.exe *C:\WINDOWS\winhlp32.exe »System/Drivers »Running Processes +0=<idle> +4=<system> +608=\SystemRoot\System32\smss.exe +676=\??\C:\WINDOWS\system32\csrss.exe +700=\??\C:\WINDOWS\system32\winlogon.exe +744=C:\WINDOWS\system32\services.exe +756=C:\WINDOWS\system32\lsass.exe +896=C:\WINDOWS\system32\svchost.exe +956=C:\WINDOWS\system32\svchost.exe +992=C:\WINDOWS\System32\svchost.exe +1064=C:\WINDOWS\system32\svchost.exe +1172=C:\WINDOWS\system32\svchost.exe +1348=C:\WINDOWS\Explorer.EXE +1452=C:\WINDOWS\system32\spoolsv.exe +1548=C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe +1564=C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe +1576=C:\PROGRA~1\Grisoft\AVG7\avgemc.exe +1652=C:\Program Files\ewido anti-spyware 4.0\guard.exe +1892=C:\WINDOWS\system32\svchost.exe +168=C:\Program Files\Canon\CAL\CALMAIN.exe +176=C:\WINDOWS\system32\VTTimer.exe +164=C:\WINDOWS\system32\VTtrayp.exe +184=C:\Program Files\VIAudioi\SBADeck\ADeck.exe +460=C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe +472=C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe +520=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE +528=C:\Program Files\QuickTime\qttask.exe +576=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe +596=C:\Program Files\Common Files\Real\Update_OB\realsched.exe +660=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe +760=C:\Program Files\ewido anti-spyware 4.0\ewido.exe +848=C:\WINDOWS\system32\ctfmon.exe +904=C:\Program Files\Messenger\msmsgs.exe +1428=C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe +1676=C:\Program Files\VIA\RAID\raid_tool.exe +2076=C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe +2152=C:\WINDOWS\System32\alg.exe +2744=C:\Program Files\Internet Explorer\IEXPLORE.EXE +3520=C:\Program Files\Internet Explorer\IEXPLORE.EXE +1656=C:\WINDOWS\system32\wscntfy.exe +1240=C:\WINDOWS\system32\wuauclt.exe +3776=C:\Documents and Settings\David Blair\Local Settings\Temporary Internet Files\Content.IE5\FMSN3POD\StartDreck[1]\StartDreck.exe »NT Services *Alerter Alerter - disabled `binary: C:\WINDOWS\system32\svchost.exe -k LocalService *Application Layer Gateway Service ALG running on demand `binary: C:\WINDOWS\System32\alg.exe *Application Management AppMgmt - on demand `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Windows Audio AudioSrv running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *AVG7 Alert Manager Server Avg7Alrt running auto `binary: C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe *AVG7 Update Service Avg7UpdSvc running auto `binary: C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe *AVG E-mail Scanner AVGEMS running auto `binary: C:\PROGRA~1\Grisoft\AVG7\avgemc.exe *Background Intelligent Transfer Service BITS running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Computer Browser Browser running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Canon Camera Access Library 8 CCALib8 running auto `binary: C:\Program Files\Canon\CAL\CALMAIN.exe *Indexing Service CiSvc - on demand `binary: C:\WINDOWS\system32\cisvc.exe *ClipBook ClipSrv - disabled `binary: C:\WINDOWS\system32\clipsrv.exe *COM+ System Application COMSysApp - on demand `binary: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} *Cryptographic Services CryptSvc running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *DCOM Server Process Launcher DcomLaunch running auto `binary: C:\WINDOWS\system32\svchost -k DcomLaunch *DHCP Client Dhcp running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Logical Disk Manager Administrative Service dmadmin - on demand `binary: C:\WINDOWS\System32\dmadmin.exe /com *Logical Disk Manager dmserver - on demand `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *DNS Client Dnscache running auto `binary: C:\WINDOWS\system32\svchost.exe -k NetworkService *Error Reporting Service ERSvc running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Event Log Eventlog running auto `binary: C:\WINDOWS\system32\services.exe *COM+ Event System EventSystem running on demand `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *ewido anti-spyware 4.0 guard ewido anti-spyware 4 running auto `binary: C:\Program Files\ewido anti-spyware 4.0\guard.exe *Fast User Switching Compatibility FastUserSwitchingCom running on demand `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Help and Support helpsvc running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Human Interface Device Access HidServ - disabled `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *HTTP SSL HTTPFilter - on demand `binary: C:\WINDOWS\System32\svchost.exe -k HTTPFilter *IMAPI CD-Burning COM Service ImapiService - on demand `binary: C:\WINDOWS\system32\imapi.exe *Server lanmanserver running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Workstation lanmanworkstation running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *TCP/IP NetBIOS Helper LmHosts running auto `binary: C:\WINDOWS\system32\svchost.exe -k LocalService *Messenger Messenger - disabled `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *NetMeeting Remote Desktop Sharing mnmsrvc - on demand `binary: C:\WINDOWS\system32\mnmsrvc.exe *Distributed Transaction Coordinator MSDTC - on demand `binary: C:\WINDOWS\system32\msdtc.exe *Windows Installer MSIServer - on demand `binary: C:\WINDOWS\system32\msiexec.exe /V *Network DDE NetDDE - disabled `binary: C:\WINDOWS\system32\netdde.exe *Network DDE DSDM NetDDEdsdm - disabled `binary: C:\WINDOWS\system32\netdde.exe *Net Logon Netlogon - on demand `binary: C:\WINDOWS\system32\lsass.exe *Network Connections Netman running on demand `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Network Location Awareness (NLA) Nla running on demand `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *NT LM Security Support Provider NtLmSsp - on demand `binary: C:\WINDOWS\system32\lsass.exe *Removable Storage NtmsSvc - on demand `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Plug and Play PlugPlay running auto `binary: C:\WINDOWS\system32\services.exe *IPSEC Services PolicyAgent running auto `binary: C:\WINDOWS\system32\lsass.exe *Protected Storage ProtectedStorage running auto `binary: C:\WINDOWS\system32\lsass.exe *Remote Access Auto Connection Manager RasAuto - on demand `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Remote Access Connection Manager RasMan running on demand `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Remote Desktop Help Session Manager RDSessMgr - on demand `binary: C:\WINDOWS\system32\sessmgr.exe *Routing and Remote Access RemoteAccess - disabled `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Remote Procedure Call (RPC) Locator RpcLocator - on demand `binary: C:\WINDOWS\system32\locator.exe *Remote Procedure Call (RPC) RpcSs running auto `binary: C:\WINDOWS\system32\svchost -k rpcss *QoS RSVP RSVP - on demand `binary: C:\WINDOWS\system32\rsvp.exe *Security Accounts Manager SamSs running auto `binary: C:\WINDOWS\system32\lsass.exe *Smart Card SCardSvr - on demand `binary: C:\WINDOWS\System32\SCardSvr.exe *Task Scheduler Schedule running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Secondary Logon seclogon running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *System Event Notification SENS running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Windows Firewall/Internet Connection Sharing (I SharedAccess running auto `CS) `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Shell Hardware Detection ShellHWDetection running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Print Spooler Spooler running auto `binary: C:\WINDOWS\system32\spoolsv.exe *System Restore Service srservice running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *SSDP Discovery Service SSDPSRV running on demand `binary: C:\WINDOWS\system32\svchost.exe -k LocalService *Windows Image Acquisition (WIA) stisvc running auto `binary: C:\WINDOWS\system32\svchost.exe -k imgsvc *MS Software Shadow Copy Provider SwPrv - on demand `binary: C:\WINDOWS\system32\dllhost.exe /Processid:{90CFF155-4AF7-40DB-B5A3-7E812034AEBB} *Performance Logs and Alerts SysmonLog - on demand `binary: C:\WINDOWS\system32\smlogsvc.exe *Telephony TapiSrv running on demand `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Terminal Services TermService running on demand `binary: C:\WINDOWS\System32\svchost -k DComLaunch *Themes Themes running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Distributed Link Tracking Client TrkWks running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Universal Plug and Play Device Host upnphost - on demand `binary: C:\WINDOWS\system32\svchost.exe -k LocalService *Uninterruptible Power Supply UPS - on demand `binary: C:\WINDOWS\System32\ups.exe *TrueVector Internet Monitor vsmon - auto `binary: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service *Volume Shadow Copy VSS - on demand `binary: C:\WINDOWS\System32\vssvc.exe *Windows Time W32Time running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *WebClient WebClient running auto `binary: C:\WINDOWS\system32\svchost.exe -k LocalService *Windows Management Instrumentation winmgmt running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Portable Media Serial Number Service WmdmPmSN - on demand `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *WMI Performance Adapter WmiApSrv - on demand `binary: C:\WINDOWS\system32\wbem\wmiapsrv.exe *Security Center wscsvc running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Automatic Updates wuauserv running auto `binary: C:\WINDOWS\system32\svchost.exe -k netsvcs *Wireless Zero Configuration WZCSVC running auto `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs *Network Provisioning Service xmlprov - on demand `binary: C:\WINDOWS\System32\svchost.exe -k netsvcs »NT Kernel- and FS-drivers *Abiosdsk Abiosdsk - disabled `binary: *abp480n5 abp480n5 - disabled `binary: *Microsoft ACPI Driver ACPI running boot `binary: \SystemRoot\system32\DRIVERS\ACPI.sys *ACPIEC ACPIEC - disabled `binary: *General Purpose USB Driver (adildr.sys) ADILOADER - auto `binary: System32\Drivers\adildr.sys *USB ADSL WAN Adapter adiusbaw running on demand `binary: system32\DRIVERS\adiusbaw.sys *adpu160m adpu160m - disabled `binary: *Microsoft Kernel Acoustic Echo Canceller aec - on demand `binary: system32\drivers\aec.sys *AFD AFD running system `binary: \SystemRoot\System32\drivers\afd.sys *Aha154x Aha154x - disabled `binary: *aic78u2 aic78u2 - disabled `binary: *aic78xx aic78xx - disabled `binary: *AliIde AliIde - disabled `binary: *amsint amsint - disabled `binary: *1394 ARP Client Protocol Arp1394 running on demand `binary: system32\DRIVERS\arp1394.sys *asc asc - disabled `binary: *asc3350p asc3350p - disabled `binary: *asc3550 asc3550 - disabled `binary: *RAS Asynchronous Media Driver AsyncMac - on demand `binary: system32\DRIVERS\asyncmac.sys *Standard IDE/ESDI Hard Disk Controller atapi running boot `binary: \SystemRoot\system32\DRIVERS\atapi.sys *Atdisk Atdisk - disabled `binary: *ATM ARP Client Protocol Atmarpc - on demand `binary: system32\DRIVERS\atmarpc.sys *Audio Stub Driver audstub running on demand `binary: system32\DRIVERS\audstub.sys *AVG7 Kernel Avg7Core running system `binary: \SystemRoot\System32\Drivers\avg7core.sys *AVG7 Wrap Driver Avg7RsW running system `binary: \SystemRoot\System32\Drivers\avg7rsw.sys *AVG7 Resident Driver XP Avg7RsXP running system `binary: \SystemRoot\System32\Drivers\avg7rsxp.sys *AVG Network Redirector AvgTdi running auto `binary: \SystemRoot\System32\Drivers\avgtdi.sys *Beep Beep running system `binary: *cbidf2k cbidf2k - disabled `binary: *cd20xrnt cd20xrnt - disabled `binary: *Cdaudio Cdaudio - system `binary: *Cdfs Cdfs running disabled `binary: *Cdr4_xp Cdr4_xp running system `binary: *Cdralw2k Cdralw2k running system `binary: *CD-ROM Driver Cdrom running system `binary: system32\DRIVERS\cdrom.sys *cdudf_xp cdudf_xp running system `binary: *Changer Changer - system `binary: *CmdIde CmdIde - disabled `binary: *Cpqarray Cpqarray - disabled `binary: *dac960nt dac960nt - disabled `binary: *Disk Driver Disk running boot `binary: \SystemRoot\system32\DRIVERS\disk.sys *dmboot dmboot - disabled `binary: System32\drivers\dmboot.sys *dmio dmio - disabled `binary: System32\drivers\dmio.sys *dmload dmload - disabled `binary: System32\drivers\dmload.sys *Microsoft Kernel DLS Syntheiszer DMusic - on demand `binary: system32\drivers\DMusic.sys *dpti2o dpti2o - disabled `binary: *Microsoft Kernel DRM Audio Descrambler drmkaud - on demand `binary: system32\drivers\drmkaud.sys *dvd_2K dvd_2K running on demand `binary: *ewido anti-spyware 4.0 driver ewido anti-spyware 4 running system `binary: \??\C:\Program Files\ewido anti-spyware 4.0\guard.sys *Fastfat Fastfat running disabled `binary: *Floppy Disk Controller Driver Fdc running on demand `binary: system32\DRIVERS\fdc.sys *VIA Rhine-Family Fast Ethernet Adapter Driver S FETND5BV running on demand `ervice `binary: system32\DRIVERS\fetnd5bv.sys *VIA PCI 10/100Mb Fast Ethernet Adapter NT Drive FETNDIS - on demand `r `binary: system32\DRIVERS\fetnd5.sys *Fips Fips running system `binary: *Floppy Disk Driver Flpydisk running on demand `binary: system32\DRIVERS\flpydisk.sys *FltMgr FltMgr running boot `binary: \SystemRoot\system32\DRIVERS\fltMgr.sys *Volume Manager Driver Ftdisk running boot `binary: \SystemRoot\system32\DRIVERS\ftdisk.sys *Microsoft Generic AGPv3.0 Filter for K8 Process gagp30kx running boot `or Platforms `binary: \SystemRoot\system32\DRIVERS\gagp30kx.sys *Generic Packet Classifier Gpc running on demand `binary: system32\DRIVERS\msgpc.sys *Microsoft HID Class Driver HidUsb - on demand `binary: system32\DRIVERS\hidusb.sys *hpn hpn - disabled `binary: *HTTP HTTP running on demand `binary: System32\Drivers\HTTP.sys *i2omgmt i2omgmt - system `binary: *i2omp i2omp - disabled `binary: *i8042 Keyboard and PS/2 Mouse Port Driver i8042prt running system `binary: system32\DRIVERS\i8042prt.sys *CD-Burning Filter Driver Imapi running system `binary: system32\DRIVERS\imapi.sys *ini910u ini910u - disabled `binary: *IntelIde IntelIde - disabled `binary: *IPv6 Windows Firewall Driver Ip6Fw - on demand `binary: system32\DRIVERS\Ip6Fw.sys *IP Traffic Filter Driver IpFilterDriver - on demand `binary: system32\DRIVERS\ipfltdrv.sys *IP in IP Tunnel Driver IpInIp - on demand `binary: system32\DRIVERS\ipinip.sys *IP Network Address Translator IpNat running on demand `binary: system32\DRIVERS\ipnat.sys *IPSEC driver IPSec running system `binary: system32\DRIVERS\ipsec.sys *IR Enumerator Service IRENUM - on demand `binary: system32\DRIVERS\irenum.sys *PnP ISA/EISA Bus Driver isapnp running boot `binary: \SystemRoot\system32\DRIVERS\isapnp.sys *Keyboard Class Driver Kbdclass running system `binary: system32\DRIVERS\kbdclass.sys *Microsoft Kernel Wave Audio Mixer kmixer running on demand `binary: system32\drivers\kmixer.sys *KSecDD KSecDD running boot `binary: *lbrtfdc lbrtfdc - system `binary: *mmc_2K mmc_2K - on demand `binary: *mnmdd mnmdd running system `binary: *Modem Modem - on demand `binary: *Mouse Class Driver Mouclass running system `binary: system32\DRIVERS\mouclass.sys *MountMgr MountMgr running boot `binary: *mraid35x mraid35x - disabled `binary: *WebDav Client Redirector MRxDAV running on demand `binary: system32\DRIVERS\mrxdav.sys *MRxSmb MRxSmb running system `binary: system32\DRIVERS\mrxsmb.sys *Msfs Msfs running system `binary: *Microsoft Streaming Service Proxy MSKSSRV - on demand `binary: system32\drivers\MSKSSRV.sys *Microsoft Streaming Clock Proxy MSPCLOCK - on demand `binary: system32\drivers\MSPCLOCK.sys *Microsoft Streaming Quality Manager Proxy MSPQM - on demand `binary: system32\drivers\MSPQM.sys *Microsoft System Management BIOS Driver mssmbios running on demand `binary: system32\DRIVERS\mssmbios.sys *Mup Mup running boot `binary: *NDIS System Driver NDIS running boot `binary: *Remote Access NDIS TAPI Driver NdisTapi running on demand `binary: system32\DRIVERS\ndistapi.sys *NDIS Usermode I/O Protocol Ndisuio running on demand `binary: system32\DRIVERS\ndisuio.sys *Remote Access NDIS WAN Driver NdisWan running on demand `binary: system32\DRIVERS\ndiswan.sys *NDIS Proxy NDProxy running on demand `binary: *NetBIOS Interface NetBIOS running system `binary: system32\DRIVERS\netbios.sys *NetBios over Tcpip NetBT running system `binary: system32\DRIVERS\netbt.sys *1394 Net Driver NIC1394 running on demand `binary: system32\DRIVERS\nic1394.sys *Npfs Npfs running system `binary: *Ntfs Ntfs running disabled `binary: *Null Null running system `binary: *IPX Traffic Filter Driver NwlnkFlt - on demand `binary: system32\DRIVERS\nwlnkflt.sys *IPX Traffic Forwarder Driver NwlnkFwd - on demand `binary: system32\DRIVERS\nwlnkfwd.sys *VIA OHCI Compliant IEEE 1394 Host Controller ohci1394 running boot `binary: \SystemRoot\system32\DRIVERS\ohci1394.sys *Parallel port driver Parport running on demand `binary: system32\DRIVERS\parport.sys *PartMgr PartMgr running boot `binary: *ParVdm ParVdm running auto `binary: *PCI Bus Driver PCI running boot `binary: \SystemRoot\system32\DRIVERS\pci.sys *PCIDump PCIDump - system `binary: *PCIIde PCIIde running boot `binary: \SystemRoot\system32\DRIVERS\pciide.sys *Pcmcia Pcmcia - disabled `binary: *PDCOMP PDCOMP - on demand `binary: *PDFRAME PDFRAME - on demand `binary: *PDRELI PDRELI - on demand `binary: *PDRFRAME PDRFRAME - on demand `binary: *perc2 perc2 - disabled `binary: *perc2hib perc2hib - disabled `binary: *pohci13F pohci13F - on demand `binary: \??\C:\DOCUME~1\DAVIDB~1\LOCALS~1\Temp\pohci13F.sys *WAN Miniport (PPTP) PptpMiniport running on demand `binary: system32\DRIVERS\raspptp.sys *Processor Driver Processor running system `binary: system32\DRIVERS\processr.sys *QoS Packet Scheduler PSched running on demand `binary: system32\DRIVERS\psched.sys *Direct Parallel Link Driver Ptilink running on demand `binary: system32\DRIVERS\ptilink.sys *pwd_2k pwd_2k running system `binary: *ql1080 ql1080 - disabled `binary: *Ql10wnt Ql10wnt - disabled `binary: *ql12160 ql12160 - disabled `binary: *ql1240 ql1240 - disabled `binary: *ql1280 ql1280 - disabled `binary: *Remote Access Auto Connection Driver RasAcd running system `binary: system32\DRIVERS\rasacd.sys *WAN Miniport (L2TP) Rasl2tp running on demand `binary: system32\DRIVERS\rasl2tp.sys *Remote Access PPPOE Driver RasPppoe running on demand `binary: system32\DRIVERS\raspppoe.sys *Direct Parallel Raspti running on demand `binary: system32\DRIVERS\raspti.sys *Rdbss Rdbss running system `binary: system32\DRIVERS\rdbss.sys *RDPCDD RDPCDD running system `binary: System32\DRIVERS\RDPCDD.sys *RDPWD RDPWD - on demand `binary: *Digital CD Audio Playback Filter Driver redbook running system `binary: system32\DRIVERS\redbook.sys *Secdrv Secdrv - on demand `binary: system32\DRIVERS\secdrv.sys *Serenum Filter Driver serenum running on demand `binary: system32\DRIVERS\serenum.sys *Serial port driver Serial running system `binary: system32\DRIVERS\serial.sys *Sfloppy Sfloppy - system `binary: *Simbad Simbad - disabled `binary: *Sparrow Sparrow - disabled `binary: *Microsoft Kernel Audio Splitter splitter - on demand `binary: system32\drivers\splitter.sys *System Restore Filter Driver sr running boot `binary: \SystemRoot\system32\DRIVERS\sr.sys *srescan srescan running boot `binary: \SystemRoot\system32\ZoneLabs\srescan.sys *Srv Srv running on demand `binary: system32\DRIVERS\srv.sys *Software Bus Driver swenum running on demand `binary: system32\DRIVERS\swenum.sys *Microsoft Kernel GS Wavetable Synthesizer swmidi - on demand `binary: system32\drivers\swmidi.sys *symc810 symc810 - disabled `binary: *symc8xx symc8xx - disabled `binary: *sym_hi sym_hi - disabled `binary: *sym_u3 sym_u3 - disabled `binary: *Microsoft Kernel System Audio Device sysaudio running on demand `binary: system32\drivers\sysaudio.sys *TCP/IP Protocol Driver Tcpip running system `binary: system32\DRIVERS\tcpip.sys *TDPIPE TDPIPE - on demand `binary: *TDTCP TDTCP - on demand `binary: *Terminal Device Driver TermDD running system `binary: system32\DRIVERS\termdd.sys *TosIde TosIde - disabled `binary: *UdfReadr_xp UdfReadr_xp running system `binary: *Udfs Udfs - disabled `binary: *ultra ultra - disabled `binary: *Microcode Update Driver Update running on demand `binary: system32\DRIVERS\update.sys *Microsoft USB 2.0 Enhanced Host Controller Mini usbehci running on demand `port Driver `binary: system32\DRIVERS\usbehci.sys *USB2 Enabled Hub usbhub running on demand `binary: system32\DRIVERS\usbhub.sys *Microsoft USB PRINTER Class usbprint - on demand `binary: system32\DRIVERS\usbprint.sys *USB Scanner Driver usbscan - on demand `binary: system32\DRIVERS\usbscan.sys *USB Mass Storage Driver USBSTOR - on demand `binary: system32\DRIVERS\USBSTOR.SYS *Microsoft USB Universal Host Controller Minipor usbuhci running on demand `t Driver `binary: system32\DRIVERS\usbuhci.sys *VgaSave VgaSave running system `binary: \SystemRoot\System32\drivers\vga.sys *VIA AGP Filter viaagp1 running boot `binary: \SystemRoot\system32\DRIVERS\viaagp1.sys *viagfx viagfx running on demand `binary: system32\DRIVERS\vtmini.sys *ViaIde ViaIde running boot `binary: \SystemRoot\system32\DRIVERS\viaide.sys *viasraid viasraid running boot `binary: \SystemRoot\system32\DRIVERS\viasraid.sys *Vinyl AC'97 Audio Controller (WDM) VIAudio running on demand `binary: system32\drivers\vinyl97.sys *VolSnap VolSnap running boot `binary: *vsdatant vsdatant running system `binary: System32\vsdatant.sys *VIA USB Host Controller Lower Filter vulfnths - on demand `binary: \SystemRoot\System32\Drivers\vulfnth.sys *VIA USB Roothub Lower Filter vulfntrs running on demand `binary: \SystemRoot\System32\Drivers\vulfntr.sys *Remote Access IP ARP Driver Wanarp running on demand `binary: system32\DRIVERS\wanarp.sys *WDICA WDICA - on demand `binary: *Microsoft WINMM WDM Audio Compatibility Driver wdmaud running on demand `binary: system32\drivers\wdmaud.sys »VMM32Files (LM) »%System%\VMM32 »%System%\IOSUBSYS »Application specific »MS Office 97/8.0 STARTUP-PATH »Current User »Default User »Local Machine »ICQ NetDetect »Current User »Default User StartupList report, 12/07/2006, 23:43:38 StartupList version: 1.52.2 Started from : C:\Documents and Settings\David Blair\My Documents\hijack this\HijackThis.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options * Including empty and uninteresting sections * Showing rarely important sections ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\VIAudioi\SBADeck\ADeck.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ScanSoft\OmniPageSE\opware32.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\David Blair\My Documents\hijack this\HijackThis.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup: [C:\Documents and Settings\David Blair\Start Menu\Programs\Startup] *No files* Shell folders AltStartup: *Folder not found* User shell folders Startup: *Folder not found* User shell folders AltStartup: *Folder not found* Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe Shell folders Common AltStartup: *Folder not found* User shell folders Common Startup: *Folder not found* User shell folders Alternate Common Startup: *Folder not found* -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon] *Registry key not found* [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] *Registry value not found* [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon] *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run VTTimer = VTTimer.exe VTTrayp = VTtrayp.exe AudioDeck = C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 RoxioEngineUtility = "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" RoxioDragToDisc = "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" RoxioAudioCentral = "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" adiras = adiras.exe AVG7_CC = C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP EPSON Stylus C64 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64" QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot Omnipage = C:\Program Files\ScanSoft\OmniPageSE\opware32.exe Zone Labs Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" !ewido = "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce *No values found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No values found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background RealPlayer = "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No values found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\Run [OptionalComponents] *No values found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\Run *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- File association entry for .EXE: HKEY_CLASSES_ROOT\exefile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .COM: HKEY_CLASSES_ROOT\comfile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .BAT: HKEY_CLASSES_ROOT\batfile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .PIF: HKEY_CLASSES_ROOT\piffile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .SCR: HKEY_CLASSES_ROOT\scrfile\shell\open\command (Default) = "%1" /S -------------------------------------------------- File association entry for .HTA: HKEY_CLASSES_ROOT\htafile\shell\open\command (Default) = C:\WINDOWS\system32\mshta.exe "%1" %* -------------------------------------------------- File association entry for .TXT: HKEY_CLASSES_ROOT\txtfile\shell\open\command (Default) = %SystemRoot%\system32\NOTEPAD.EXE %1 -------------------------------------------------- Enumerating Active Setup stub paths: HKLM\Software\Microsoft\Active Setup\Installed Components (* = disabled by HKCU twin) [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP [>{26923b43-4d38-484f-9b9e-de460746276c}] * StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] * StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] * StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] * StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] * StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install [{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT [{4b218e3e-bc98-4770-93d3-2731b9329278}] * StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf [{5945c046-1e7d-11d1-bc44-00c04fd912be}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub [{7790769C-0471-11d2-AF11-00C04FA35D02}] * StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install [{89820200-ECBD-11cf-8B85-00AA005B4340}] * StubPath = regsvr32.exe /s /n /i:U shell32.dll [{89820200-ECBD-11cf-8B85-00AA005B4383}] * StubPath = %SystemRoot%\system32\ie4uinit.exe -------------------------------------------------- Enumerating ICQ Agent Autostart apps: HKCU\Software\Mirabilis\ICQ\Agent\Apps *Registry key not found* -------------------------------------------------- Load/Run keys from C:\WINDOWS\WIN.INI: load=*INI section not found* run=*INI section not found* Load/Run keys from Registry: HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found* HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found* HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found* HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found* HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found* HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found* HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found* HKCU\..\Windows NT\CurrentVersion\Windows: load= HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs= -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\BLUEPL~1.SCR drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry value not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Checking for EXPLORER.EXE instances: C:\WINDOWS\Explorer.exe: PRESENT! C:\Explorer.exe: not present C:\WINDOWS\Explorer\Explorer.exe: not present C:\WINDOWS\System\Explorer.exe: not present C:\WINDOWS\System32\Explorer.exe: not present C:\WINDOWS\Command\Explorer.exe: not present C:\WINDOWS\Fonts\Explorer.exe: not present -------------------------------------------------- Checking for superhidden extensions: .lnk: HIDDEN! (arrow overlay: yes) .pif: HIDDEN! (arrow overlay: yes) .exe: not hidden .com: not hidden .bat: not hidden .hta: not hidden .scr: not hidden .shs: HIDDEN! .shb: HIDDEN! .vbs: not hidden .vbe: not hidden .wsh: not hidden .scf: HIDDEN! (arrow overlay: NO!) .url: HIDDEN! (arrow overlay: yes) .js: not hidden .jse: not hidden -------------------------------------------------- Verifying REGEDIT.EXE integrity: - Regedit.exe found in C:\WINDOWS - .reg open command is normal (regedit.exe %1) - Company name OK: 'Microsoft Corporation' - Original filename OK: 'REGEDIT.EXE' - File description: 'Registry Editor' Registry check passed -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F} (no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (no name) - c:\program files\google\googletoolbar2.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7} -------------------------------------------------- Enumerating Task Scheduler jobs: *No jobs found* -------------------------------------------------- Enumerating Download Program Files: [CKAVWebScan Object] InProcServer32 = C:\WINDOWS\system32\Kaspersky Lab\Kaspersky On-line Scanner\kavwebscan.dll CODEBASE = http://www.kaspersky.com/kos/english...an_unicode.cab [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\system32\macromed\Director\SwDir.dll CODEBASE = http://fpdownload.macromedia.com/get...irector/sw.cab [Java Plug-in] InProcServer32 = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll CODEBASE = http://java.sun.com/update/1.5.0/jin...ndows-i586.cab [Java Plug-in] InProcServer32 = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll CODEBASE = http://java.sun.com/update/1.5.0/jin...ndows-i586.cab [Java Plug-in 1.5.0_06] InProcServer32 = C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll CODEBASE = http://java.sun.com/update/1.5.0/jin...ndows-i586.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx CODEBASE = http://fpdownload.macromedia.com/get...nt/swflash.cab [e-Safekey] InProcServer32 = C:\WINDOWS\Downloaded Program Files\e-Safekey.dll CODEBASE = https://ebanking.northernbank.co.uk/.../e-Safekey.cab -------------------------------------------------- Enumerating Winsock LSP files: NameSpace #1: C:\WINDOWS\System32\mswsock.dll NameSpace #2: C:\WINDOWS\System32\winrnr.dll NameSpace #3: C:\WINDOWS\System32\mswsock.dll Protocol #1: C:\WINDOWS\system32\mswsock.dll Protocol #2: C:\WINDOWS\system32\mswsock.dll Protocol #3: C:\WINDOWS\system32\mswsock.dll Protocol #4: C:\WINDOWS\system32\rsvpsp.dll Protocol #5: C:\WINDOWS\system32\rsvpsp.dll Protocol #6: C:\WINDOWS\system32\mswsock.dll Protocol #7: C:\WINDOWS\system32\mswsock.dll Protocol #8: C:\WINDOWS\system32\mswsock.dll Protocol #9: C:\WINDOWS\system32\mswsock.dll Protocol #10: C:\WINDOWS\system32\mswsock.dll Protocol #11: C:\WINDOWS\system32\mswsock.dll Protocol #12: C:\WINDOWS\system32\mswsock.dll Protocol #13: C:\WINDOWS\system32\mswsock.dll Protocol #14: C:\WINDOWS\system32\mswsock.dll Protocol #15: C:\WINDOWS\system32\mswsock.dll Protocol #16: C:\WINDOWS\system32\mswsock.dll Protocol #17: C:\WINDOWS\system32\mswsock.dll -------------------------------------------------- Enumerating Windows NT/2000/XP services Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system) General Purpose USB Driver (adildr.sys): System32\Drivers\adildr.sys (autostart) USB ADSL WAN Adapter: system32\DRIVERS\adiusbaw.sys (manual start) Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start) AFD: \SystemRoot\System32\drivers\afd.sys (system) Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled) Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start) Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) 1394 ARP Client Protocol: system32\DRIVERS\arp1394.sys (manual start) RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start) Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system) ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start) Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start) AVG7 Alert Manager Server: C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe (autostart) AVG7 Kernel: \SystemRoot\System32\Drivers\avg7core.sys (system) AVG7 Wrap Driver: \SystemRoot\System32\Drivers\avg7rsw.sys (system) AVG7 Resident Driver XP: \SystemRoot\System32\Drivers\avg7rsxp.sys (system) AVG7 Update Service: C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe (autostart) AVG E-mail Scanner: C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (autostart) AVG Network Redirector: \SystemRoot\System32\Drivers\avgtdi.sys (autostart) Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Canon Camera Access Library 8: C:\Program Files\Canon\CAL\CALMAIN.exe (autostart) CD-ROM Driver: system32\DRIVERS\cdrom.sys (system) Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start) ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled) COM+ System Application: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start) Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart) DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Disk Driver: system32\DRIVERS\disk.sys (system) Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start) dmboot: System32\drivers\dmboot.sys (disabled) dmio: System32\drivers\dmio.sys (disabled) dmload: System32\drivers\dmload.sys (disabled) Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start) DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart) Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start) Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Event Log: %SystemRoot%\system32\services.exe (autostart) COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start) ewido anti-spyware 4.0 driver: \??\C:\Program Files\ewido anti-spyware 4.0\guard.sys (system) ewido anti-spyware 4.0 guard: C:\Program Files\ewido anti-spyware 4.0\guard.exe (autostart) Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Floppy Disk Controller Driver: system32\DRIVERS\fdc.sys (manual start) VIA Rhine-Family Fast Ethernet Adapter Driver Service: system32\DRIVERS\fetnd5bv.sys (manual start) VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver: system32\DRIVERS\fetnd5.sys (manual start) Floppy Disk Driver: system32\DRIVERS\flpydisk.sys (manual start) FltMgr: system32\DRIVERS\fltMgr.sys (system) Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system) Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms: system32\DRIVERS\gagp30kx.sys (system) Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start) Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Human Interface Device Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled) Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start) HTTP: System32\Drivers\HTTP.sys (manual start) HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start) i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system) CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system) IMAPI CD-Burning COM Service: C:\WINDOWS\system32\imapi.exe (manual start) IPv6 Windows Firewall Driver: system32\DRIVERS\Ip6Fw.sys (manual start) IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start) IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start) IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start) IPSEC driver: system32\DRIVERS\ipsec.sys (system) IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start) PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system) Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system) Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start) Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart) Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled) NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start) Mouse Class Driver: system32\DRIVERS\mouclass.sys (system) WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start) MRXSMB: system32\DRIVERS\mrxsmb.sys (system) Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start) Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start) Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start) Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start) Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start) Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start) Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start) NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start) Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start) NetBIOS Interface: system32\DRIVERS\netbios.sys (system) NetBios over Tcpip: system32\DRIVERS\netbt.sys (system) Network DDE: %SystemRoot%\system32\netdde.exe (disabled) Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled) Net Logon: %SystemRoot%\system32\lsass.exe (manual start) Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) 1394 Net Driver: system32\DRIVERS\nic1394.sys (manual start) Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start) Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start) IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start) VIA OHCI Compliant IEEE 1394 Host Controller: system32\DRIVERS\ohci1394.sys (system) Parallel port driver: system32\DRIVERS\parport.sys (manual start) PCI Bus Driver: system32\DRIVERS\pci.sys (system) PCIIde: system32\DRIVERS\pciide.sys (system) Plug and Play: %SystemRoot%\system32\services.exe (autostart) pohci13F: \??\C:\DOCUME~1\DAVIDB~1\LOCALS~1\Temp\pohci13F.sys (manual start) IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart) WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start) Processor Driver: system32\DRIVERS\processr.sys (system) Protected Storage: %SystemRoot%\system32\lsass.exe (autostart) QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start) Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start) Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system) Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start) Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start) Direct Parallel: system32\DRIVERS\raspti.sys (manual start) Rdbss: system32\DRIVERS\rdbss.sys (system) RDPCDD: System32\DRIVERS\RDPCDD.sys (system) Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start) Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system) Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled) Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start) Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart) QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start) Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart) Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start) Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Secdrv: system32\DRIVERS\secdrv.sys (manual start) Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start) Serial port driver: system32\DRIVERS\serial.sys (system) Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start) Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart) System Restore Filter Driver: system32\DRIVERS\sr.sys (system) srescan: system32\ZoneLabs\srescan.sys (system) System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Srv: system32\DRIVERS\srv.sys (manual start) SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart) Software Bus Driver: system32\DRIVERS\swenum.sys (manual start) Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start) MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{90CFF155-4AF7-40DB-B5A3-7E812034AEBB} (manual start) Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start) Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start) Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system) Terminal Device Driver: system32\DRIVERS\termdd.sys (system) Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start) Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Microcode Update Driver: system32\DRIVERS\update.sys (manual start) Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start) Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start) USB2 Enabled Hub: system32\DRIVERS\usbhub.sys (manual start) Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start) USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start) USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start) Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start) VgaSave: \SystemRoot\System32\drivers\vga.sys (system) VIA AGP Filter: system32\DRIVERS\viaagp1.sys (system) viagfx: system32\DRIVERS\vtmini.sys (manual start) ViaIde: system32\DRIVERS\viaide.sys (system) viasraid: system32\DRIVERS\viasraid.sys (system) Vinyl AC'97 Audio Controller (WDM): system32\drivers\vinyl97.sys (manual start) vsdatant: System32\vsdatant.sys (system) TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart) Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start) VIA USB Host Controller Lower Filter: \SystemRoot\System32\Drivers\vulfnth.sys (manual start) VIA USB Roothub Lower Filter: \SystemRoot\System32\Drivers\vulfntr.sys (manual start) Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start) Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start) WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart) Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart) Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start) Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart) Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) -------------------------------------------------- Enumerating Windows NT logon/logoff scripts: *No scripts set to run* Windows NT checkdisk command: BootExecute = autocheck autochk * Windows NT 'Wininit.ini': PendingFileRenameOperations: C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\system32\webcheck.dll SysTray: C:\WINDOWS\system32\stobject.dll -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run *Registry key not found* -------------------------------------------------- End of report, 33,743 bytes Report generated in 0.062 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 12/07/2006 23:46:35 for strings: ; 'yahoo' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}] @="Yahoo! Toolbar Helper" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2018C303-E3F2-4455-AA1A-773F84F10902}\InprocServer32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkinSelect.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3D5D83B0-47DC-4862-93D6-3E827A14AED1}\InprocServer32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkin2.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97D85205-80CF-4b71-90A5-D220DA4FEE58}\InprocServer32] @="C:\\Program Files\\Yahoo!\\Shared\\YAlertCenter.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B448FAA5-DC36-4C3D-9436-67021CDECA82}\InprocServer32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkin2.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B448FAA5-DC36-4C3D-9436-67021CDECA82}\ToolboxBitmap32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkin2.dll, 107" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4528244-55B0-4FBC-B27E-26851B634D02}\InprocServer32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkin2.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7EEC168-A4C4-42C6-8601-B02816959B24}\InprocServer32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkin2.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7EEC168-A4C4-42C6-8601-B02816959B24}\ToolboxBitmap32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkin2.dll, 112" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}] @="Yahoo! Toolbar" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{475DAFB5-B05A-4E11-B466-00CF55C1628E}\1.0\0\win32] @="C:\\Program Files\\Yahoo!\\Shared\\YAlertCenter.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{475DAFB5-B05A-4E11-B466-00CF55C1628E}\1.0\HELPDIR] @="C:\\Program Files\\Yahoo!\\Shared\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F84EA6C-A074-482D-911D-7C92E59CB16F}\1.0\0\win32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkin2.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F84EA6C-A074-482D-911D-7C92E59CB16F}\1.0\HELPDIR] @="C:\\Program Files\\Yahoo!\\Shared\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E926E2D-BF6C-11D2-A33D-00A0C94B8D0E}\1.0\0\win32] @="C:\\Program Files\\Yahoo!\\Messenger\\stock.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E926E2D-BF6C-11D2-A33D-00A0C94B8D0E}\1.0\HELPDIR] @="C:\\Program Files\\Yahoo!\\Messenger\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C652805E-0CD2-4AE7-A633-8300BAB8DAAC}\1.0\0\win32] @="C:\\Program Files\\Yahoo!\\Shared\\YbSkinSelect.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C652805E-0CD2-4AE7-A633-8300BAB8DAAC}\1.0\HELPDIR] @="C:\\Program Files\\Yahoo!\\Shared\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E5D12C41-7B4F-11D3-B5C9-0050045C3C96}\1.0\0\win32] @="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E5D12C41-7B4F-11D3-B5C9-0050045C3C96}\1.0\HELPDIR] @="C:\\Program Files\\Yahoo!\\Messenger\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F0012D80-989C-11D3-B7C5-0090271D5CA7}\4.0] @="MyYahoo 4.0 Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F0012D80-989C-11D3-B7C5-0090271D5CA7}\4.0\0\win32] @="C:\\Program Files\\Yahoo!\\Messenger\\MyYahoo.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F0012D80-989C-11D3-B7C5-0090271D5CA7}\4.0\HELPDIR] @="C:\\Program Files\\Yahoo!\\Messenger\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ybmfile\shell\open\command] @="C:\\PROGRA~1\\Yahoo!\\Common\\YSHORT~1.EXE %1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ybmfile\shell\opennew\command] @="C:\\PROGRA~1\\Yahoo!\\Common\\YSHORT~1.EXE %1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main] "Start Page"="http://www.yahoo.com/" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search] "CustomSearch"="http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr7/*http://www.yahoo.com/ext/search/search.html" [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Browser] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Browser\Extensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Companion] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Companion] "AppTitle"="Yahoo! Toolbar with Pop-up Blocker" "attempt"="...attempting to retrieve buttons from Yahoo!..." [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Companion\PUB] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Companion\YCheck] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Essentials] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Essentials] "CommonDir"="C:\\Program Files\\Yahoo!\\Common" "MainDir"="C:\\Program Files\\Yahoo!" [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Essentials\Restore] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Essentials\Restore\Main] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Essentials\Restore\User] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Skin] [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Skin] "Path"="C:\\Program Files\\Yahoo!\\Shared\\Graphics" [HKEY_LOCAL_MACHINE\SOFTWARE\Yahoo\Uninstaller] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager] ; Contents of value: ; \??\C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL ; ; "PendingFileRenameOperations"=hex(7):5c,3f,3f,5c,43,3a,5c,50,52,4f,47,52,41,7e,\ 31,5c,59,61,68,6f,6f,21,5c,43,6f,6d,6d,6f,6e,5c,59,49,4e,53,54,48,7e,31,2e,\ 44,4c,4c,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager] ; Contents of value: ; \??\C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL ; ; "PendingFileRenameOperations"=hex(7):5c,3f,3f,5c,43,3a,5c,50,52,4f,47,52,41,7e,\ 31,5c,59,61,68,6f,6f,21,5c,43,6f,6d,6d,6f,6e,5c,59,49,4e,53,54,48,7e,31,2e,\ 44,4c,4c,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Google\NavClient\1.1\History] ; Contents of value: ; Û´d "cannot remove yahoo as homepage"=hex:05,db,b4,44 ; Contents of value: ; rÛ´d "remove yahoo as homepage"=hex:52,db,b4,44 ; Contents of value: ; ›Û´d "www.yahoo .co.uk"=hex:9b,db,b4,44 ; Contents of value: ; Ü´d " can't remove yahoo as homepage"=hex:81,dc,b4,44 ; Contents of value: ; Ñò´d "can't change yahoo homepage"=hex:d1,f2,b4,44 ; Contents of value: ; ;õ´d "site:e.my.yahoo.com"=hex:3b,f5,b4,44 ; Contents of value: ; }õ´d "get rid of yahoo as home page"=hex:7d,f5,b4,44 ; Contents of value: ; }õ´d "site:e.my.yahoo.com get rid of yahoo as home page"=hex:7d,f5,b4,44 ; Contents of value: ; …õ´d " get rid of yahoo as home page"=hex:85,f5,b4,44 [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.yahoo.com/" [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Yahoo!] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Yahoo!\Communication] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Yahoo!\Community] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Yahoo!\Entertainment] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Yahoo!\Home & Living] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Yahoo!\Personal Publishing] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo] "ClientUpdatePage"="http://update.messenger.yahoo.com/msgrcli75.html" [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Audio Conferencing] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Common] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion] "attempt"="...attempting to retrieve buttons from Yahoo!..." [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\opt] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\Profiles] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\Profiles\!guest] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\Profiles\!guest\ButtonHistory] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\Profiles\kathy_blr] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\Profiles\kathy_blr\ButtonHistory] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\Pub] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\pubmod] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\SearchHistory] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Companion\Ycheck] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Profiles] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Profiles\kathy_blr] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Profiles\kathy_blr\Skin] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\Profiles\Skin] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\PUB] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\PUB\Allow] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\YChoose] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\YFriendsBar] [HKEY_USERS\S-1-5-21-1214440339-1770027372-682003330-1004\Software\Yahoo\YFriendsBar\Settings] ; End Of The Log... I hope this is okay - we have also been getting some spam in too recently - I normally delete it without opening it |
|
|
|
|
07-12-2006, 05:24 PM
|
#8 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,453
OS: N/A
|
Please download the file attached
Double-click the file within & allow it to merge with the Registry. This will remove the Yahoo entries from the Registry
__________________
Question - what have you done for the community today? Last edited by sUBs; 07-15-2006 at 01:01 AM. |
|
|
|
|
07-13-2006, 04:05 PM
|
#12 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 10
OS: WINDOWS XP
|
Please forgive - now I know I really am stupid. When I start up normally only one user account opens - starting up in safe mode opened 2 user accounts - me and administrator. My father built this computer for me and set evrything up in my husband's name.
I ofcourse must not have been happy with this and created another account and set it up as main account or something - can't remember. Anyway - had to do it in my account and not administrators obviously - I think the account named administrator isn't really the administrator - ifyou know what I mean. Anyway all fixed - thankyou so much! Any idea why this happened? Last edited by kajb; 07-13-2006 at 04:22 PM. |
|
|
|
|
07-13-2006, 04:28 PM
|
#13 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,453
OS: N/A
|
Sorry...didnt see your earlier reply. Please show me a fresh Hijackthis log.
If possible, please tell me the exact "can't accessthe registry" message you encountered.
__________________
Question - what have you done for the community today? Last edited by sUBs; 07-13-2006 at 04:42 PM. |
|
|
|
|
07-13-2006, 05:10 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 10
OS: WINDOWS XP
|
Hijack this log
Logfile of HijackThis v1.99.1 Scan saved at 00  06, on 14/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\VIAudioi\SBADeck\ADeck.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\Program Files\ScanSoft\OmniPageSE\opware32.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\David Blair\My Documents\remove yahoo\hijack this\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://ebanking.northernbank.co.uk/.../e-Safekey.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{55B7C673-B115-4412-894D-ACA977ECB03B}: NameServer = 80.225.255.50 80.225.255.58 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe The "can't access registry" message I encountered was because I was trying to fix it in the wrong user account. Because I was in the wrong account (one that is not used), I could not find saved yahooed.zip file - I was therefore trying to bring it from a disc. When I switched to the right user account, the file was sitting there and it all worked straight away - does that make sense? Probably not! |
|
|
|
|
07-14-2006, 01:53 AM
|
#15 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,453
OS: N/A
|
Lol ...that's okay. Yahoo appears to be gone.
Shall we consider this as resolved?
__________________
Question - what have you done for the community today? |
|
|
|
|
07-14-2006, 04:22 AM
|
#17 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,453
OS: N/A
|
If I have to take a wild guess, it would be one of your security software that's caused the issue. Either Ewido, SpyBot or Zone Alarm. They guard against homepage changes.
When we entered safe mode, none of these programs were running & that's why we were able to change the homepage. I doubt if it's Yahoo's fault.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
