|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-23-2006, 04:19 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
Very Slow PC, "pic009.com" infested possible trojan, hijacker, virus??
Hello,
I have a Toshiba A75-s206 that runs pretty slow after some hours of usage(a bout two hrs). I have DSL but sometimes pages take a long time to load. Also, when working with office documents, and I want to switch to another application (web browser), the computer lags for ever and ever and ever. I've also noticed that it takes about three minutes just to reload in the begining, and sometimes shut down takes a while as well. One additional problem that's been going on is that the sound doesn't work, it seems the sound drivers do not load up at start-up, and the sound also fails when I get svshost. error messages. I've done all the steps 1-5 on the main page and here's the log. I hope you guys can help me get my laptop back on track :-) :-) :-) Jose R Logfile of HijackThis v1.99.1 Scan saved at 4:08:12 PM, on 7/23/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\ACS.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Yahoo!\Antivirus\ISafe.exe C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\cplmcm.exe C:\WINDOWS\Explorer.EXE C:\Program Files\EzButton\EzButton.EXE C:\Program Files\TOSHIBA\Power Management\CePMTray.exe C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Yahoo!\Antivirus\CAVRID.exe C:\Program Files\Yahoo!\Antivirus\CAVTray.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Apoint2K\Apoint.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\AIM\aim.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Washer\washer.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe C:\Program Files\RssReader\RssReader.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\toshiba\ivp\ism\ivpsvmgr.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\Yahoo!\Antivirus\VetMsg.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = www.google.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.trustyhound.com/sidebar-search.php R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_75bf.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Core Library - {E9C1FD9A-46B0-4185-84ED-E2F8ACD4A262} - C:\WINDOWS\System32\KDP31d9.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_75bf.dll" O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [Uninstall_TBPS] C:\WINDOWS\Temp\TBuninst.exe /remove O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [sFEQ3Fe] rouoci.exe O4 - HKLM\..\Run: [SBC Yahoo! Connection Manager] C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe -Show O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Kazaa Download Accelerator Updater (required)] regsvr32 /s C:\WINDOWS\System32\KDP31d9.dll O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1109456582\ee\AOLHostManager.exe O4 - HKLM\..\Run: [hmonitor] C:\Program Files\Hmonitor\hmonitor.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_75bf.dll" O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0 O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [RssReader] C:\Program Files\RssReader\RssReader.exe O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe" O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [dox4RPKsX] rasimap.exe O4 - HKCU\..\Run: [AOLCC] "C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe" /startup O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .thp: C:\Program Files\Internet Explorer\Plugins\NPLM32.DLL O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/downloa...Downloader.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: VET Message Service (VetMsgNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WKSSVC (Windows Kernel System Service) - Unknown owner - C:\WINDOWS\cplmcm.exe |
|
     |
| Sponsored Links |
|
07-24-2006, 07:08 PM
|
#3 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
Hello and welcome to TSF!
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. You may wish to Subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools (above the first post), then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Please be patient with me during this time.
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all.  UNITE/ASAP: Proud member since 2006 |
|
|
|
|
07-25-2006, 10:36 AM
|
#4 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
Hello carganegativa18,
Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. If there is anything you don't understand, please ask BEFORE proceeding with the fixes. Please do these steps in order and do not skip any. Multiple Antivirus I see you have two or more antivirus programs installed. Multiple antivirus programs can bog down your system, interfere with each other, and may even cause crashes. I highly recommend you remove all but one of them using the Add/Remove Programs in the Control Panel. Unhide Files Go to My Computer > Tools > Folder Options > View tab and select "Show hidden files and folders". Uncheck the "Hide protected operating system files (Recommended)" option. Also make sure there is no checkmark beside "Hide file extensions for known file types". Click OK. Download CleanUp! Download and install CleanUp! but do not run it yet. WARNING: CleanUp! deletes EVERYTHING out of temporary folders and does not make backups. If you have any documents or programs that are saved in any temporary folders, please make a backup of these before running CleanUp! WARNING: Do not run cleanup under Windows XP x64 Edition. If you're not sure if you have the 64-bit version of Windows then you probably do not; however, you can check by using IE to download the whichcpu tool and then running it. Download Ewido Please download, install, and update Ewido Anti-Spyware.
Submit For Analysis Please find the following file (via Start > Search) and submit the following file to Jotti File Scan: C:\WINDOWS\cplmcm.exeAt the top of the window you should see "File to Upload & scan" and a blank box. Copy and paste the red text from above into the box. Then click "submit". When it is finished, please copy the information listed under "Service" and "Scanner Results" into Notepad and save it on your Desktop so you can paste it with your next reply. Uninstall Click Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): SafeGuard Protect PCShield Reboot Reboot your system to Safe Mode by repeatedly tapping the F8 key until the menu appears and choosing Safe Mode from the list. On some systems, this may be the F5 key so try that if F8 doesn't work. Login on with your usual account. Make sure to close any open windows. HijackThis Fixes Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist (make sure you do not miss any): R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.trustyhound.com/sidebar-search.phpPlease remember to close all other windows, including browsers then click Fix checked. Close HijackThis. Deletions Delete the following Folders/Files if they still exist: C:\Program Files\SafeGuard Protect PCShieldFind the following two files via Start > Search and delete them. rasimap.exe Run CleanUp! Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
Run Ewido
Reboot Reboot your system to Normal Mode. Online Scan Perform an online scan with Internet Explorer with Panda ActiveScan.
With Your Next Post... Please paste the following with your next reply (in this order please):
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all. UNITE/ASAP: Proud member since 2006 |
|
|
|
|
07-28-2006, 02:11 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
New Fresh Logs
Hello there, Im sorry for not replying sooner, but I was in the middle of Final Exams, so that took all my time away from fixing these errors, but here are the logs you requested me.
JOTTI FILE SCAN RESULTS: Service load: 0% 100% File: cplmcm.exe Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 b9eea37027168a6672380a5b3b16603a Packers detected: - Scanner results AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found BehavesLike:Trojan.FWDisable (probable variant) ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing Fortinet Found W32/CryptExe Kaspersky Anti-Virus Found Packed.Win32.CryptExe (probable variant) NOD32 Found IRC/SdBot Norman Virus Control Found Sandbox: W32/Malware; [ General information ] * Anti debug/emulation code present. * **Locates window "NULL [class _Oscar_StatusNotify]" on desktop. * **Locates window "NULL [class mIRC]" on desktop. * File length: 100554 bytes. [ Changes to filesystem ] * Creates file C:\WINDOWS\cplmcm.exe. * Deletes file c:\sample.exe. [ Changes to registry ] * Creates key "HKLM\Software\\Microsoft\\Windows". * Sets value "Melt"="c:\sample.exe" in key "HKLM\Software\\Microsoft\\Windows". * Creates key "HKLM\System\CurrentControlSet\Services\Windows Kernel System Service". * Sets value "ImagePath"=""C:\WINDOWS\cplmcm.exe"" in key "HKLM\System\CurrentControlSet\Services\Windows Kernel System Service". * Sets value "DisplayName"="WKSSVC" in key "HKLM\System\CurrentControlSet\Services\Windows Kernel System Service". * Deletes value "Melt" in key "HKLM\Software\\Microsoft\\Windows". * Sets value "WaitToKillServiceTimeout"="7000" in key "HKLM\System\CurrentControlSet\Control". * Modifies value "UpdatesDisableNotify"="" in key "HKLM\Software\Microsoft\Security Center". * Modifies value "AntiVirusDisableNotify"="" in key "HKLM\Software\Microsoft\Security Center". * Modifies value "FirewallDisableNotify"="" in key "HKLM\Software\Microsoft\Security Center". * Modifies value "AntiVirusOverride"="" in key "HKLM\Software\Microsoft\Security Center". * Modifies value "FirewallOverride"="" in key "HKLM\Software\Microsoft\Security Center". * Creates key "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update". * Sets value "AUOptions"="" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update". * Creates key "HKLM\System\CurrentControlSet\Services\wscsvc". * Sets value "Start"="" in key "HKLM\System\CurrentControlSet\Services\wscsvc". UNA Found nothing VirusBuster Found nothing VBA32 Found Trojan.IRC.SdBot ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 10:24:07 AM 7/28/2006 + Scan result: C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup (quarantined). C:\WINDOWS\system32\mqexdlm.srgOLD -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\WINDOWS\Sm9zZSBKIEFuZ3VpYW5v\asappsrv.dll -> Adware.CommAd : Cleaned with backup (quarantined). HKLM\SOFTWARE\Effective-i -> Adware.EffectiveBrandToolbar : Cleaned with backup (quarantined). HKLM\SOFTWARE\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : Cleaned with backup (quarantined). HKLM\SOFTWARE\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : Cleaned with backup (quarantined). HKU\S-1-5-21-694481242-625651855-603493804-1006\Software\Effective-i -> Adware.EffectiveBrandToolbar : Cleaned with backup (quarantined). HKU\S-1-5-21-694481242-625651855-603493804-1006\Software\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : Cleaned with backup (quarantined). HKU\S-1-5-21-694481242-625651855-603493804-1006\Software\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : Cleaned with backup (quarantined). C:\Installer3.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\WINDOWS\system32\ovbccp32.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\warebundlenewer.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\HJT\backups\backup-20060725-184413-512.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\HJT\backups\backup-20060725-184414-753.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\WINDOWS\system32\sfg_2b56.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\WINDOWS\system32\sfg_54fe.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\Program Files\TrustyHound-TB\autofill_plugin.dll -> Adware.SideSearch : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator -> Adware.UCmore : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator\INSTALL.LOG -> Adware.UCmore : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator\IUCmore.dll -> Adware.UCmore : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator\TBlogin.users.ucmore.com.4.5.40.0 -> Adware.UCmore : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll -> Adware.UCmore : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator\UNWISE.EXE -> Adware.UCmore : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator\logo.ico -> Adware.UCmore : Cleaned with backup (quarantined). C:\Program Files\TheSearchAccelerator\toolbar.cfg -> Adware.UCmore : Cleaned with backup (quarantined). C:\ucmoreiex.exe/IUCMORE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\ucmoreiex.exe/UCMTSAIE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\ucmoreiex.exe/empty_00000001 -> Adware.Ucmore : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UCmore - The Search Accelerator -> Adware.UCmore : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Desktop\FOLDERS\downloads\pianochordz40-eval.zip/ChordZ40.CAB/SETUP1.EXE -> Backdoor.Agobot.xb : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Desktop\pic009.com -> Backdoor.SdBot.qd : Cleaned with backup (quarantined). C:\WINDOWS\cplmcm.exe -> Backdoor.SdBot.qd : Cleaned with backup (quarantined). [1636] C:\WINDOWS\cplmcm.exe -> Backdoor.SdBot.qd : Error during cleaning. C:\Documents and Settings\Jose D. Rincon\Local Settings\Temporary Internet Files\Content.IE5\CPA7C9I3\loader[1].exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\drsmartload.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5db4521e-45118f42.zip/Installer.class -> Downloader.OpenConnection.w : Cleaned with backup (quarantined). C:\ac3_0010.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\kybrdef_7.exe -> Downloader.VB.air : Cleaned with backup (quarantined). [2540] C:\kybrdef_7.exe -> Downloader.VB.air : Error during cleaning. C:\Documents and Settings\Jose D. Rincon\Local Settings\Temporary Internet Files\Content.IE5\U9EH2RKJ\drsmartload45a[1].exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\WINDOWS\system32\dllcache\window.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\drsmartload45a7f.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\drsmartload45a7h.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\drsmartload45a7i.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\nwnmef_7.exe -> Downloader.VB.aiy : Cleaned with backup (quarantined). [2152] C:\nwnmef_7.exe -> Downloader.VB.aiy : Error during cleaning. C:\WINDOWS\system32\in10b6s.dll -> Dropper.Small.abd : Cleaned with backup (quarantined). C:\WINDOWS\system32\dllcache\system32.exe -> Hijacker.VB.fg : Cleaned with backup (quarantined). C:\WINDOWS\system32\dllcache\systems.exe -> Hijacker.VB.fg : Cleaned with backup (quarantined). C:\dfndref_7.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined). [3048] C:\dfndref_7.exe -> Hijacker.VB.ly : Error during cleaning. C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv156.jar-8e3574-2df65d11.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv157.jar-9c4cf5-2f5e7232.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined). C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined). [872] C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Error during cleaning. :mozilla.144:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.101:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.102:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.103:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.107:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.108:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.127:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.128:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.170:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.148:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.149:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.56:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.57:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined). :mozilla.100:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.32:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.33:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.54:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.55:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.56:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.57:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.58:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.59:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.60:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.61:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.62:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.63:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.64:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.65:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.66:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.67:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.68:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.69:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.70:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.71:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.72:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.73:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.74:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.75:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.76:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.77:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.78:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.79:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.80:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.81:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.82:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.83:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.84:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.85:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.86:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.87:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.88:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.89:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.90:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.91:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.92:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.93:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.94:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.95:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.96:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.97:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.98:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.99:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.37:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). :mozilla.9:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). :mozilla.14:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Bfast : Cleaned with backup (quarantined). :mozilla.152:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). :mozilla.48:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined). :mozilla.130:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). :mozilla.135:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.136:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.137:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.138:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.139:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.140:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.141:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.41:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.42:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.43:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.121:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Centrport : Cleaned with backup (quarantined). :mozilla.150:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.151:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.73:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). :mozilla.23:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.24:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.25:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.46:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.47:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.48:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.49:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.50:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.51:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.52:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.53:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned with backup (quarantined). :mozilla.30:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.31:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.19:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.****-access : Cleaned with backup (quarantined). :mozilla.126:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.75:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup (quarantined). :mozilla.76:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup (quarantined). :mozilla.29:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined). :mozilla.117:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.118:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.119:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.120:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined). :mozilla.15:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned with backup (quarantined). :mozilla.16:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned with backup (quarantined). :mozilla.6:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup (quarantined). :mozilla.50:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.51:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.52:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.53:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.54:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.55:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined). :mozilla.39:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). :mozilla.40:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). :mozilla.115:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined). :mozilla.116:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined). :mozilla.162:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). :mozilla.163:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). :mozilla.22:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). :mozilla.70:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). :mozilla.71:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). :mozilla.10:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Xxxtoolbar : Cleaned with backup (quarantined). :mozilla.11:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Xxxtoolbar : Cleaned with backup (quarantined). :mozilla.12:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Xxxtoolbar : Cleaned with backup (quarantined). :mozilla.13:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Xxxtoolbar : Cleaned with backup (quarantined). :mozilla.9:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Xxxtoolbar : Cleaned with backup (quarantined). :mozilla.14:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\296a0wp8.default\cookies.txt -> TrackingCookie.Ysbweb : Cleaned with backup (quarantined). :mozilla.104:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). :mozilla.105:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). :mozilla.106:C:\Documents and Settings\Cesar Rincon\Application Data\Mozilla\Firefox\Profiles\mrjli2db.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-2a79b1dc-7fe3ab10.zip/Dummy.class -> Trojan.NoCheat.240 : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Desktop\Unused Desktop Shortcuts\CHEMIX_School_v3[1].00.zip/CHEMIX.School.v3.00.Cracked-iNFECTED/patch.exe -> Trojan.Proxcrak.A : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Desktop\Unused Desktop Shortcuts\chemixschoolv3.00patchinfected.zip/patch.exe -> Trojan.Proxcrak.A : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Desktop\Unused Desktop Shortcuts\chemixschoolv3.00patchinfected\patch.exe -> Trojan.Proxcrak.A : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Shared\Registry Mechanic 5.0.0.132.zip/Setup.exe -> Worm.VB.an : Cleaned with backup (quarantined). C:\Documents and Settings\Jose D. Rincon\Shared\Registry Mechanic 5.0.0.132A.zip/Setup.exe -> Worm.VB.an : Cleaned with backup (quarantined). ::Report end Panda Scan Report Incident Status Location Adware:adware/commad Not disinfected c:\windows\system32\atmtd.dll Adware:adware/ipinsight Not disinfected c:\windows\inf\polall1r.inf Adware:adware/dollarrevenue Not disinfected c:\drsmartload46a7h.exe Adware:adware/ieplugin Not disinfected c:\windows\kwv2.dat Adware:adware/ucmore Not disinfected C:\Documents and Settings\Jose D. Rincon\Start Menu\Programs\UCmore - The Search Accelerator Adware:adware/wupd Not disinfected Windows Registry Dialer:dialer.su Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\uninstall\Switch Adware:adware/look2me Not disinfected Windows Registry Potentially unwanted tool:application/mywebsearch Not disinfected hkey_classes_root\clsid\{147A976E-EEE1-4377-8EA7-4716E4CDD239} Potentially unwanted tool:application/myway Not disinfected hkey_classes_root\clsid\{66FC8717-EFA7-4546-8C4A-E224F3A80C76} Potentially unwanted tool:application/altnet Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\AltnetDM Adware:adware/ist.sidefind Not disinfected Windows Registry Adware:adware/popupdefence Not disinfected Windows Registry Adware:adware/wintools Not disinfected Windows Registry Adware:adware/xplugin Not disinfected Windows Registry Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-4514e5ea-4c4c202e.zip[javainstaller/InstallerApplet.class] Adware:Adware/CWS Not disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Counter.class-762d722b-73b6d256.class Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-4b7173d6-5a9df5c0.zip[BlackBox.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-4b7173d6-5a9df5c0.zip[VB.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-4b7173d6-5a9df5c0.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-4b7173d6-5a9df5c0.zip[Beyond.class] Adware:Adware/CWS.Searchmeup Not disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-5aea1fab.zip[GetAccess.class] Adware:Adware/CWS.Searchmeup Not disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-5aea1fab.zip[Installer.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-5aea1fab.zip[NewSecurityClassLoader.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-5aea1fab.zip[NewURLClassLoader.class] Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-4514e5ea-4e1241e2.zip[javainstaller/InstallerApplet.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-45167828.zip[Matrix.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-45167828.zip[Counter.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-45167828.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Jose D. Rincon\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-45167828.zip[Parser.class] Adware:Adware/Veevo Not disinfected C:\Documents and Settings\Jose D. Rincon\Desktop\12TH Grade\Mex Am Stu\Group Project - teotihuacan\kdap223h.exe[kdp107.dll] Adware:Adware/Ucmore Not disinfected C:\Documents and Settings\Jose D. Rincon\Start Menu\Programs\UCmore - The Search Accelerator\How To Uninstall.lnk Adware:Adware/Ucmore Not disinfected C:\Documents and Settings\Jose D. Rincon\Start Menu\Programs\UCmore - The Search Accelerator\UCmore Tour.lnk Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\StripSaver2\Distribution.dll Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\StripSaver2\Music.dll Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\StripSaver2\Windows.dll Virus:Exploit/ByteVerify Disinfected C:\quarantine\binny.class.Vir Virus:Exploit/ByteVerify Disinfected C:\quarantine\binny.class.Vir.0 Virus:Exploit/ByteVerify Disinfected C:\quarantine\binny.class.Vir.1 Dialer:Dialer.OK Not disinfected C:\WINDOWS\Downloaded Program Files\internazionale_ver3.INF Adware:Adware/CommAd Not disinfected C:\WINDOWS\Sm9zZSBKIEFuZ3VpYW5v\mA6Wtm14KHIRtapDsqcS.vbs Adware:Adware/DollarRevenue Not disinfected C:\WINDOWS\system32\w0034d94.dll Adware:Adware/SearchAid Not disinfected C:\WINDOWS\uninstall_nmon.vbs ************************************************** hijackThis Report Logfile of HijackThis v1.99.1 Scan saved at 1:55:19 PM, on 7/28/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\ACS.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\toshiba\ivp\ism\ivpsvmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\EzButton\EzButton.EXE C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\TOSHIBA\Power Management\CePMTray.exe C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Apoint2K\Apoint.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\AIM\aim.exe C:\Program Files\Washer\washer.exe C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe C:\Program Files\RssReader\RssReader.exe C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing) O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [SBC Yahoo! Connection Manager] C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe -Show O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [IVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1109456582\ee\AOLHostManager.exe O4 - HKLM\..\Run: [hmonitor] C:\Program Files\Hmonitor\hmonitor.exe O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0 O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [RssReader] C:\Program Files\RssReader\RssReader.exe O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe" O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [AOLCC] "C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe" /startup O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .thp: C:\Program Files\Internet Explorer\Plugins\NPLM32.DLL O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/downloa...Downloader.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\srlgntfy.dll (file missing) O20 - Winlogon Notify: IntlRun - C:\WINDOWS\system32\dav10.dll (file missing) O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\wL2topl.dll (file missing) O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\ovbccp32.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Sm9zZSBKIEFuZ3VpYW5v\command.exe (file missing) O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WKSSVC (Windows Kernel System Service) - Unknown owner - C:\WINDOWS\cplmcm.exe (file missing) THANKS A LOT! Jose R. |
|
|
|
|
07-29-2006, 10:29 AM
|
#6 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
Jose,
I hope you passed all your finals.  Looks like more malware has decided to take up residence on your computer since we last spoke. There's a lot to do, so make sure you read over everything and feel free to ask me any questions if you have any.We don't recommend using any sort of cracks or illegal software here. You may have installed a cracked version of CHEMIX School and I suggest that you remove it if that is the case. This probably lead to your infection and could be the current source of re-infection. Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. If there is anything you don't understand, please ask BEFORE proceeding with the fixes. Please do these steps in order and do not skip any. Download Brute Force Uninstaller Please download Brute Force Uninstaller to your desktop.
Do not do anything with these yet! Download FixISTBar Please download the ISTBar removal tool from Symantec to your Desktop. Do not run it yet. Download ComboFix Download ComboFix from one of the following links:
Double click combofix.exe & follow the prompts. While ComboFix is running, please do not click or move the window, as this may cause the tool to stall. When the tool has finished, it will produce a log for you and save it as C:\ComboFix.txt. Post that log in your next reply. Download CWShredder Download CWShredder and run it. Click Check for Update. Click on 'I Agree' button if you agree. Click on 'Fix' (it will automatically fix anything it finds for you) and then click OK. If it asks if you want to delete a certain random file, choose No and post that filename here. Let it finish the scan and then hit Next and Exit. Disable Services Click Start>Run - type SERVICES.MSC and then click on the OK button.
Registry Fixes Download the attached carganegativa18.zip file to your Desktop. Double click on the zip folder, then double click on the carganegativa18.reg file within. Click yes to allow it to merge into your registry. You can delete both the carganegativa18.zip and carganegativa18.reg now. Uninstall Click Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): Network Monitor Reboot Reboot your system to Safe Mode by repeatedly tapping the F8 key until the menu appears and choosing Safe Mode from the list. On some systems, this may be the F5 key so try that if F8 doesn't work. Login on with your usual account. Make sure to close any open windows. HijackThis Fixes Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist (make sure you do not miss any): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.comPlease remember to close all other windows, including browsers then click Fix checked. Close HijackThis. Deletions Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.
Clear Your Java Cache Click on Start->Settings->Control Panel->Java Plug-in (If you do not see the icon, look to your left and click 'Switch to Classic View'). Click the Settings button under Internet Explorer near the bottom, and click on Delete Files and click OK and OK. Clear Cookies Clear your Firefox cookies. From the open browser, go to Tools>Options>Privacy>Cookies>Clear. Run FixISTBar Run the ISTBar removal Tool. Run Ewido
Run Brute Force Uninstaller Please go to Start > My Computer and navigate to the folder you installed BFU in (i.e, C:\BFU).
Reboot Reboot your system to Normal Mode. Online Scan Perform an online scan using Internet Explorer with Kaspersky WebScanner. Click on Launch Kaspersky Anti-Virus Web Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
Re-run Combofix Double click combofix.exe & follow the prompts. When the tool has finished, it will move the old log to C:\Combofix.previous.run.txt and produce a new log in C:\ComboFix.txt. Please include both logs in your next reply. Generate An Uninstall List
With Your Next Post... Please paste the following with your next reply (in this order please):
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all. UNITE/ASAP: Proud member since 2006 Last edited by Deckard; 11-02-2006 at 05:54 PM. |
|
|
|
|
07-29-2006, 01:28 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
Question: Programs are not in Add/Remove but...
Hello,
I'm in the step where I have to remove Network Monitor, StripSaver 2, TrustyHound and WeatherBug. Here's what happened: When trying to remove NetworkMonitor, I got this error message: " Cannot find script file "C:\WINDOWS\uninstall_nmon.vbs" I could not find StripSaver2 nor TrustyHound however, for these two I was able to find them in C:\Program Files\StripSaver2 and C:\TrustyHound Hb the only one that I wasn't able to find was Weatherbug, neither in add/remove nor in C:\program files\. What should I do for StripSaver and TrustryHoud, should I go ahead and delete their respective folders?? Thanks |
|
|
|
|
07-29-2006, 01:47 PM
|
#8 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
Just skip the uninstalls for now then - they're not critical and we'll get NetworkMonitor out of your add/remove list on the next pass. I'm already having you delete C:\Program Files\StripSaver2 later in the fix, and you can delete C:\TrustyHound Hb at that point, too.
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all. UNITE/ASAP: Proud member since 2006 |
|
|
|
|
07-29-2006, 02:07 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
Two files with the same name, which one is it?
Hello, Im in the DELETIONS portion
and there are two files C:\WINDOWS\inf\polall1r.inf the first one polall1r has no ".something" but when I put view-->details right next to it says " Setup Information" the other one has a .PNF extension, "polall1r.PNF " ---> Precompiled setup information for sure is not the second one, but Im not sure about the first fine. Jose R. |
|
|
|
|
07-29-2006, 03:52 PM
|
#10 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
Go to My Computer > Tools > Folder Options > View tab and make sure there is no checkmark beside "Hide file extensions for known file types". Click OK.
Just delete polall1r.inf for now; I want to run it past the analysts to make sure that it's safe to delete polall1r.PNF. We'll get it next round if it is.
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all. UNITE/ASAP: Proud member since 2006 |
|
|
|
|
07-30-2006, 08:50 AM
|
#11 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
Fresh logs Part I
Hi,
Some of the process took more than three hours to complete so I wasn't able to post them until today in the morning. Here are the logs you requested me, THANKS Start Time= Sat 07/29/2006 12:43:58.21 Running from: C:\Documents and Settings\Jose D. Rincon\Desktop ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon\Settings HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wzcnotif * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * REGISTRY ENTRIES REMOVED: [HKEY_CLASSES_ROOT\clsid\{63819B6B-FB4C-4B04-B567-541A50F43FD4}] @="" "IDEx"="ADDR" [HKEY_CLASSES_ROOT\clsid\{63819B6B-FB4C-4B04-B567-541A50F43FD4}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\clsid\{63819B6B-FB4C-4B04-B567-541A50F43FD4}\Implemented Categories\{00021492-0000- 0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\clsid\{63819B6B-FB4C-4B04-B567-541A50F43FD4}\InprocServer32] @="C:\\WINDOWS\\system32\\ovbccp32.dll" "ThreadingModel"="Apartment" Granting sedebugprivilege to Administrators ... successful (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\drsmartload46a7h.exe C:\drsmartload849a7h.exe C:\drsmartload849a7i.exe C:\Documents and Settings\Jose D. Rincon\Local Settings\Temporary Internet Files\Content.IE5 \6ZUNE32B\drsmartload849a[1].exe C:\WINDOWS\drsmartload2.dat C:\WINDOWS\newname.dat C:\WINDOWS\keyboard1.dat C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\system32\atmtd.dll C:\WINDOWS\system32\atmtd.dll._ C:\Program Files\network monitor C:\Documents and Settings\LocalService\Application Data\NetMon (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-07-25 17:44:14 ( .D... ) "C:\Program Files\CleanUp!" 2006-07-25 14:47:50 ( .D... ) "C:\Program Files\ewido anti-spyware 4.0" 2006-07-25 14:33:20 29040 ( A.... ) "C:\WINDOWS\system32\w0034d94.dll" 2006-07-23 13:20:12 224 ( A.... ) "C:\PPCleanDeleteAtReboot.bat" 2006-07-23 12:07:52 ( .D... ) "C:\Program Files\Spybot - Search & Destroy" 2006-07-23 11:22:42 ( .D... ) "C:\Program Files\Lavasoft" 2006-07-19 17:32:52 ( .D... ) "C:\Documents and Settings\Jose D. Rincon\Application Data\AdobeAUM" 2006-06-19 16:20:42 702768 ( ..... ) "C:\WINDOWS\system32\WgaLogon.dll" 2006-06-06 12:37:54 48936 ( A.... ) "C:\WINDOWS\system32\sirenacm.dll" 2006-05-31 22:35:20 ( .D... ) "C:\Program Files\DVDx" 2006-05-31 22:03:00 ( .D... ) "C:\Program Files\Jahshaka" 2006-05-31 22:02:40 262144 ( A.... ) "C:\WINDOWS\system32\wrap_oal.dll" 2006-05-31 22:02:38 86016 ( A.... ) "C:\WINDOWS\system32\OpenAL32.dll" 2006-05-31 22:02:04 ( .D... ) "C:\Program Files\OpenLibraries" 2006-05-19 05:59:42 148480 ( A.... ) "C:\WINDOWS\system32\dnsapi.dll" 2006-05-19 05:59:42 111616 ( A.... ) "C:\WINDOWS\system32\dhcpcsvc.dll" 2006-05-19 05:59:42 94720 ( A.... ) "C:\WINDOWS\system32\iphlpapi.dll" (((((((((((((((((((((((((((((((((((((( Files Created - Last 30days ))))))))))))))))))))))))))))))))))))))))))) 2006-07-28 10:42 73,728 C:\WINDOWS\system32\asuninst.exe 2006-07-28 10:42 11,776 C:\WINDOWS\system32\ZPORT4AS.dll 2006-07-28 08:27 468,766,720 C:\hiberfil.sys 2006-07-25 14:33 29,040 C:\WINDOWS\system32\w0034d94.dll 2006-06-19 16:20 702,768 C:\WINDOWS\system32\WgaLogon.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" "WMC_AutoUpdate"="" "TPNF"="C:\\Program Files\\TOSHIBA\\TouchPad\\TPTray.exe" "Synchronization Manager"="%SystemRoot%\\system32\\mobsync.exe /logon" "ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE" "RegistryMechanic"="" "Pinger"="c:\\toshiba\\ivp\\ism\\pinger.exe /run" "PadTouch"="C:\\Program Files\\TOSHIBA\\Touch and Launch\\PadExe.exe" "Network Associates Error Reporting Service"="\"C:\\Program Files\\Common Files\\Network Associates\\TalkBack\\TBMon.exe\"" "NDSTray.exe"="NDSTray.exe" "McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey" "IVPServiceMgr"="C:\\toshiba\\ivp\\ism\\ivpsvmgr.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "EzButton"="C:\\Program Files\\EzButton\\EzButton.EXE" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "CeEPOWER"="C:\\Program Files\\TOSHIBA\\Power Management\\CePMTray.exe" "CeEKEY"="C:\\Program Files\\TOSHIBA\\E-KEY\\CeEKey.exe" "BigDogPath"="C:\\WINDOWS\\VM_STI.EXE VIMICRO USB PC Camera 301x" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "AGRSMMSG"="AGRSMMSG.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "Washer"="C:\\Program Files\\Washer\\washer.exe /0" "TOSCDSPD"="C:\\Program Files\\TOSHIBA\\TOSCDSPD\\toscdspd.exe" "PopUpStopperFreeEdition"="\"C:\\Program Files\\Panicware\\Pop-Up Stopper Free Edition\\PSFree.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "flags"=dword:00000008 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex\000] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"=dword:00000001 "AllowUnhashedWebView"=dword:00000001 "NoCDBurning"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,fe,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Cisco Systems VPN Client.lnk] "backup"="C:\\WINDOWS\\pss\\Cisco Systems VPN Client.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\CISCOS~1\\VPNCLI~1\\vpngui.exe \"-user_logon\"" "item"="Cisco Systems VPN Client" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Clean Access Agent.lnk" "backup"="C:\\WINDOWS\\pss\\Clean Access Agent.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\CISCOS~1\\CLEANA~1\\CCAAgent.exe " "item"="Clean Access Agent" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk] "backup"="C:\\WINDOWS\\pss\\GStartup.lnkCommon Startup" "location"="Common Startup" "item"="GStartup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Image Zone Fast Start.lnk" "backup"="C:\\WINDOWS\\pss\\HP Image Zone Fast Start.lnkCommon Startup" "location"="Common Startup" "command"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqthb08.exe -s" "item"="HP Image Zone Fast Start" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^iFinger 2.1.lnk] "backup"="C:\\WINDOWS\\pss\\iFinger 2.1.lnkCommon Startup" "location"="Common Startup" "item"="iFinger 2.1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] "backup"="C:\\WINDOWS\\pss\\Kodak EasyShare software.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Kodak\\KODAKE~1\\bin\\EASYSH~1.EXE -h" "item"="Kodak EasyShare software" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] "backup"="C:\\WINDOWS\\pss\\KODAK Software Updater.lnkCommon Startup" "location"="Common Startup" "item"="KODAK Software Updater" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] "backup"="C:\\WINDOWS\\pss\\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\OFFICE11\\ONENOTEM.EXE /tsr" "item"="Microsoft Office OneNote 2003 Quick Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk] "backup"="C:\\WINDOWS\\pss\\MyWebSearch Email Plugin.lnkCommon Startup" "location"="Common Startup" "item"="MyWebSearch Email Plugin" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk] "backup"="C:\\WINDOWS\\pss\\RAMASST.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\system32\\RAMASST.exe " "item"="RAMASST" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] "backup"="C:\\WINDOWS\\pss\\WinZip Quick Pick.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\WinZip\\WZQKPICK.EXE " "item"="WinZip Quick Pick" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jose D. Rincon^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] "backup"="C:\\WINDOWS\\pss\\Microsoft Office OneNote 2003 Quick Launch.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\MICROS~2\\OFFICE11\\ONENOTEM.EXE /tsr" "item"="Microsoft Office OneNote 2003 Quick Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jose D. Rincon^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk] "backup"="C:\\WINDOWS\\pss\\MyWebSearch Email Plugin.lnkStartup" "location"="Startup" "item"="MyWebSearch Email Plugin" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jose D. Rincon^Start Menu^Programs^Startup^Rain.lnk] "backup"="C:\\WINDOWS\\pss\\Rain.lnkStartup" "location"="Startup" "command"="C:\\Rain\\Rain.exe " "item"="Rain" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="points manager" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANR] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ANR" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLSP Scheduler" "hkey"="HKLM" "command"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLCC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ACCAgnt" "hkey"="HKCU" "command"="\"C:\\Program Files\\AOL Computer Check-Up\\ACCAgnt.exe\" /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Apoint" "hkey"="HKLM" "command"="C:\\Program Files\\Apoint2K\\Apoint.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Archive] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="archive" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoLoaderAproposClient] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="cxtpls_loader_ff" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoUpdater] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AutoUpdate" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CFD" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BullsEye Network] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="bargains" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files\SBC Yahoo!] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe ] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SBC Yahoo! Connection Manager" "hkey"="HKLM" "command"="SBC Yahoo! Connection Manager" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CaAvTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CAVTray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVTray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CAVRID" "hkey"="HKLM" "command"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVRID.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ccApp" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CMESys" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\conscorr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="conscorr" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CSV7P88] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CSV7P88" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DkIcon" "hkey"="HKLM" "command"="\"C:\\Program Files\\Diskeeper Corporation\\Diskeeper\\DkIcon.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eZmmod] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mmod" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fcr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="fcr" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gah95on6] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="gah95on6" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="gcasServ" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleDesktop" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GTV GlobalIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="global" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hmonitor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="hmonitor" "hkey"="HKLM" "command"="C:\\Program Files\\Hmonitor\\hmonitor.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLHostManager" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\1109456582\\ee\\AOLHostManager.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HPWuSchd2" "hkey"="HKLM" "command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IHaKRbLg2] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IHaKRbLg2" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="optimize" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IST Service] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="istsvc" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="kazaa" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kazaa Download Accelerator Updater] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="kdpupd" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lwvdciirowz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ubbnifb" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Access] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MediaAccK" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mimboot" "hkey"="HKLM" "command"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mimboot.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mmtask" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msnappau" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mswspl] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="searchbarcash" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MySpaceIM" "hkey"="HKCU" "command"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mwsoemon" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="P2P Networking" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RamBooster] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Rambooster" "hkey"="HKCU" "command"="C:\\Program Files\\RamBooster 2.0\\Rambooster.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RssReader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RssReader" "hkey"="HKCU" "command"="C:\\Program Files\\RssReader\\RssReader.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sais] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="sais" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\salm] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="salm" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBC Yahoo! Connection Manager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ConnectionManager" "hkey"="HKLM" "command"="C:\\WINDOWS\\..\\Program Files\\SBC Yahoo!\\Connection Manager\\ConnectionManager.exe -Show" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchUpgrader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SearchUpgrader" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TBPS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TBPS" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="realsched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ViewMgr" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows AdTools] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="WinAdTools" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="WToolsA" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ypager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe\" -quiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="yop" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Yahoo!\\YOP\\yop.exe /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "TBPSSvc"=dword:00000002 HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system DisableRegistryTools REG_DWORD 0 (0x0) Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: Sat 07/29/2006 12:53:57.87 ComboFix ver 06.07.15/28 - This logfile is located at C:\ComboFix.txt ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 6:51:28 PM 7/29/2006 + Scan result: C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074744.dll -> Adware.Aws : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074520.exe -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074746.dll -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073898.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073906.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074518.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074519.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074741.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074742.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074743.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074535.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074536.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074737.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074738.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074739.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074740.dll -> Adware.SafeGuard : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074745.dll -> Adware.SideSearch : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074731.dll -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074732.dll -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074736.exe/IUCMORE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155 \A0074736.exe/UCMTSAIE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155 \A0074736.exe/empty_00000001 -> Adware.Ucmore : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074717.com -> Backdoor.SdBot.qd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074718.exe -> Backdoor.SdBot.qd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP149\A0070325.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP150\A0070348.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP150\A0071337.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP150\A0071351.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP152\A0071802.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP152\A0071953.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP153\A0072712.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP153\A0072742.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP153\A0073745.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP153\A0073757.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP153\A0073767.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP153\A0073788.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073792.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073809.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073820.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073837.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073878.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073892.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073915.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074523.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074531.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074549.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074708.exe -> Downloader.Adload.de : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074722.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073899.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073907.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074727.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074720.exe -> Downloader.VB.air : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073808.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073819.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073836.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073876.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073891.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0073913.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074480.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074530.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP154\A0074548.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074724.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074725.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074726.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074719.exe -> Downloader.VB.aiy : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074730.dll -> Dropper.Small.abd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074716.exe -> Hijacker.VB.fg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074721.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074747.exe -> Not-A- Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined). C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP155\A0074723.exe -> Trojan.Proxcrak.A : Cleaned with backup (quarantined). ::Report end ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ KASPERSKY ONLINE SCANNER REPORT Saturday, July 29, 2006 11:38:41 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 30/07/2006 Kaspersky Anti-Virus database records: 198239 Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true Scan Target My Computer C:\ D:\ Scan Statistics Total number of scanned objects 143194 Number of viruses found 17 Number of infected objects 42 / 0 Number of suspicious objects 2 Duration of the scan process 03:27:11 Infected Object Name Virus Name Last Action C:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\Whapi\WHAppList.xml Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\MMC\dfrg Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-682003330-651377827-839522115- 1003\eb2e4b8a-b006-4a2a-a1cd-162ea0aed8cf Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-682003330-651377827-839522115- 1003\Preferred Object is locked skipped C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Themes\Custom.theme Object is locked skipped C:\Documents and Settings\Administrator\Cookies\administrator@google[1].txt Object is locked skipped C:\Documents and Settings\Administrator\Cookies\administrator@microsoft[1].txt Object is locked skipped C:\Documents and Settings\Administrator\Cookies\administrator@support.microsoft[1].txt Object is locked skipped C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Customize Links.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Free Hotmail.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\RealPlayer.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\TOSHIBA Access\Software Downloads.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\TOSHIBA Access\Software Upgrades.lnk Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\TOSHIBA Access\System Information.lnk Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\TOSHIBA Access\TOSHIBA Computer Accessories.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\TOSHIBA Access\TOSHIBA Support Centers.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Windows Media.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Links\Windows.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Media\Real.com Radio Tuner.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\MSN.com.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\Radio Station Guide.url Object is locked skipped C:\Documents and Settings\Administrator\Favorites\RealPlayer Home Page.url Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0 \WMSDKNS.DTD Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0 \WMSDKNS.XML Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Works\Portfolio\Sample.wsb Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012005121020051211\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012006010320060104\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\2926- 14_185x105_ani[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\2926- 23_Jan_m50_thin_light[1].swf Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\985a83bcS[1].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\arrow[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\CA0ZO765.htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \1TLHNV6R\CA5TN0HC.htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\close[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\default[1].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\default[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\default[2].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\dpd_goSBM [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \1TLHNV6R\GSSSM_searchUI[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\hero_1S[1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\international [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\logo[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \1TLHNV6R\Microsoft_Services[1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \1TLHNV6R\ms_masthead_ltr[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \1TLHNV6R\nav_curve_bottom3[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\nav_first[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\nav_page[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\saveicon[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\shopping_cart [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \1TLHNV6R\svchostexe_error_svchostexe_has_generated_an_error_now_what_do_i_do[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\techprops[1].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1TLHNV6R\xmlContent [2].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\1501ab53S [1].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\4101ccf1S [1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\99b166acS [1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \JGPXRVSD\Assisted_Support[1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\b433593aS [2].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\common[1].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\dpd_goHHO [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\eluminate[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\eluminate[1].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\google[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \JGPXRVSD\GSSSM_rltlngRelatedlanguages[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\home[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\langicon[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\MAIN_styles [1].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \JGPXRVSD\nav_curve_bottom2[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\order_status [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\sendicon[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\show_ads[2].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\spacer[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \JGPXRVSD\support.microsoft[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\surveyalone [2].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\surveysubmit [1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\t3_en[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JGPXRVSD\TSH-2371- 06_1a[1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \JGPXRVSD\what_is_svchost_and_why_is_there_more_than_one_copy_running[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\2926- 18_HolidayBundle_v2.0[1].swf Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \MG2M3STT\activity;src=1000873;type=tdcom487;cat=tdcom588;ord=1;num=7999956537748[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\al[1].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\arrowLTR [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\askleonew [1].png Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \MG2M3STT\CAG45AF1.htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\cfb61fb4S [1].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \MG2M3STT\cmdatatagutils[1].inc Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\cm[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\default[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\dpd_goENT [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\en-us[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\feed- icon16x16[1].png Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\goBtn_HHO [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\gotoicon [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\Hero_1[1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\logo_sm[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \MG2M3STT\nav_curve_bottom1[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\onepix[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\override [1].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\regionname [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\search[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\spacer[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\surveyinvite [1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\survey[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\survey[2].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MG2M3STT\us[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\arcomment[1].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \PU72D2TC\CAMZ5CQO.htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\cd314e4bS [1].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\cm[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\csg_curve1 [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\csg_curve2 [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\CSG_styles [1].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\d3e6e07eS [2].css Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\default[1].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\default[2].htm Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\dpd_goPUB [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\eluminate[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\emailicon[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 \PU72D2TC\homePage_tabs[1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\logogoogle [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\logo[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\my_account [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\nav_current [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\nav_curve1 [1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\nav_next[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\printicon[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\Self_Support [1].jpg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\signin[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\surveyinvite [2].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\surveytrigger [1].js Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PU72D2TC\uparrow[1].gif Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Music\Desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Music\Sample Music.lnk Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Object is locked skipped C:\Documents and Settings\Administrator\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\SendTo\RecordNow!.RecordNowSendToExt Object is locked skipped C:\Documents and Settings\Administrator\Templates\excel.xls Object is locked skipped C:\Documents and Settings\Administrator\Templates\excel4.xls Object is locked skipped C:\Documents and Settings\Administrator\Templates\lotus.wk4 Object is locked skipped C:\Documents and Settings\Administrator\Templates\powerpnt.ppt Object is locked skipped C:\Documents and Settings\Administrator\Templates\presenta.shw Object is locked skipped C:\Documents and Settings\Administrator\Templates\quattro.wb2 Object is locked skipped C:\Documents and Settings\Administrator\Templates\sndrec.wav Object is locked skipped C:\Documents and Settings\Administrator\Templates\winword.doc Object is locked skipped C:\Documents and Settings\Administrator\Templates\winword2.doc Object is locked skipped C:\Documents and Settings\Administrator\Templates\wordpfct.wpd Object is locked skipped C:\Documents and Settings\Administrator\Templates\wordpfct.wpg Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20060729_Time- 190645343_EnterceptExceptions.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20060729_Time- 190645343_EnterceptRules.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_ANTEATER -SHAFAX.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_ANTEATER-SHAFAX.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped C:\Documents and Settings\Cesar Rincon\Local Settings\Temp\hsperfdata_Cesar Rincon\2348 Object is locked skipped C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-4514e5ea- 4c4c202e.zip/javainstaller/InstallerApplet.class Infected: Trojan-Downloader.Java.OpenStream.t skipped C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-4514e5ea- 4c4c202e.zip ZIP: infected - 1 skipped C:\Documents and Settings\Jose D. Rincon\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Jose D. Rincon\Desktop\12TH Grade\Briefcase Database Object is locked skipped C:\Documents and Settings\Jose D. Rincon\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Jose D. Rincon\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Jose D. Rincon\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Jose D. Rincon\Local Settings\Temp\~DF6B91.tmp Object is locked skipped C:\Documents and Settings\Jose D. Rincon\Local Settings\Temp\~DF6D6E.tmp Object is locked skipped C:\Documents and Settings\Jose D. Rincon\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Jose D. Rincon\ntuser.dat Object is locked skipped C:\Documents and Settings\Jose D. Rincon\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Norton AntiVirus\Quarantine\08BB5A36 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\161F04F1.htm Suspicious: Exploit.HTML.Mht skipped C:\Program Files\Norton AntiVirus\Quarantine\18331190.class Infected: Trojan-Dropper.Java.Beyond.d skipped C:\Program Files\Norton AntiVirus\Quarantine\1F8A35DD Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1F8E5FDA Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1F9109D6 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1F9433D2 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1F975DCF Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1F9B07CB Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1FA15BC4 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1FA405C0 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1FA82FBD Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\1FAB59B9 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\21494AE8.htm Infected: Trojan.JS.Seeker skipped C:\Program Files\Norton AntiVirus\Quarantine\21AF40F0.class Infected: Trojan.Java.ClassLoader.aj skipped C:\Program Files\Norton AntiVirus\Quarantine\32EC3021.class Infected: Trojan.Java.ClassLoader.v skipped C:\Program Files\Norton AntiVirus\Quarantine\352D3A23 Infected: Trojan-Downloader.Win32.IstBar.gen skipped C:\Program Files\Norton AntiVirus\Quarantine\55B2543A.class Infected: Trojan.Java.ClassLoader.v skipped C:\Program Files\Norton AntiVirus\Quarantine\565D31B9.htm Infected: Trojan.JS.Seeker skipped C:\Program Files\Norton AntiVirus\Quarantine\565D31B9.php Infected: Exploit.HTML.Mht skipped C:\Program Files\Norton AntiVirus\Quarantine\56605BB5.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\566305B1.class Infected: Trojan.Java.ClassLoader.h skipped C:\Program Files\Norton AntiVirus\Quarantine\566D03A7.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\5687538A.htm Suspicious: Exploit.HTML.Mht skipped C:\Program Files\Norton AntiVirus\Quarantine\5687538A.php Infected: Exploit.HTML.Mht skipped C:\Program Files\Norton AntiVirus\Quarantine\568B7D86.class Infected: Trojan.Java.ClassLoader.h skipped C:\Program Files\Norton AntiVirus\Quarantine\56947B7C.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\56B84954.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\56B84954.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\56B84954.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\56B84954.zip/Installer.class Infected: Trojan- Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\56B84954.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\56B84954.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\5A2F4B66.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\5A666A28.class Infected: Trojan.Java.ClassLoader.d skipped C:\Program Files\Norton AntiVirus\Quarantine\671128E8.class Infected: Trojan.Java.ClassLoader.d skipped C:\Program Files\Norton AntiVirus\Quarantine\76B01355.class Infected: Exploit.Java.ByteVerify skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{1593D9F2-BEBE-480D-9CDC-68B6495175A6}\RP156\change.log Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hh.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhctrl.ocx Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\itss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\osk.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shdocvw.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shell32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shmedia.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\urlmon.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\zipfldr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828012$\ntkrnlmp.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828012$\ntkrnlpa.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828012$\ntkrnlpa.exe.000 Object is locked skipped C:\WINDOWS\$NtUninstallKB828012$\ntkrpamp.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828012$\ntoskrnl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828012$\ntoskrnl.exe.000 Object is locked skipped C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB830680$\keymgr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB833407$\bssym7.ttf Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\esba-4.exe/WISE0007.BIN Infected: Backdoor.Win32.Ruledor.e skipped C:\WINDOWS\esba-4.exe/WISE0008.BIN Infected: Trojan-Downloader.Win32.Agent.ab skipped C:\WINDOWS\esba-4.exe/WISE0010.BIN Infected: Trojan-Dropper.Win32.Small.gj skipped C:\WINDOWS\esba-4.exe/WISE0011.BIN Infected: Trojan-Downloader.Win32.IstBar.er skipped C:\WINDOWS\esba-4.exe WiseSFX: infected - 4 skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\spool\PRINTERS\00004.SPL Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_758.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
|
|
|
|
07-30-2006, 08:55 AM
|
#12 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
New Logs Part II
On my previous post I wasn't able to put all the logs in one. Here's he second part, Thanks
Start Time= Sun 07/30/2006 8:27:57.18 Running from: C:\Documents and Settings\Jose D. Rincon\Desktop QuickScan did not find any signs of infected files (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-07-25 17:44:14 ( .D... ) "C:\Program Files\CleanUp!" 2006-07-25 14:47:50 ( .D... ) "C:\Program Files\ewido anti-spyware 4.0" 2006-07-25 14:33:20 29040 ( A.... ) "C:\WINDOWS\system32\w0034d94.dll" 2006-07-23 13:20:12 224 ( A.... ) "C:\PPCleanDeleteAtReboot.bat" 2006-07-23 12:07:52 ( .D... ) "C:\Program Files\Spybot - Search & Destroy" 2006-07-23 11:22:42 ( .D... ) "C:\Program Files\Lavasoft" 2006-07-19 17:32:52 ( .D... ) "C:\Documents and Settings\Jose D. Rincon\Application Data\AdobeAUM" 2006-06-19 16:20:42 702768 ( ..... ) "C:\WINDOWS\system32\WgaLogon.dll" 2006-06-06 12:37:54 48936 ( A.... ) "C:\WINDOWS\system32\sirenacm.dll" 2006-05-31 22:35:20 ( .D... ) "C:\Program Files\DVDx" 2006-05-31 22:03:00 ( .D... ) "C:\Program Files\Jahshaka" 2006-05-31 22:02:40 262144 ( A.... ) "C:\WINDOWS\system32\wrap_oal.dll" 2006-05-31 22:02:38 86016 ( A.... ) "C:\WINDOWS\system32\OpenAL32.dll" 2006-05-31 22:02:04 ( .D... ) "C:\Program Files\OpenLibraries" 2006-05-19 05:59:42 148480 ( A.... ) "C:\WINDOWS\system32\dnsapi.dll" 2006-05-19 05:59:42 111616 ( A.... ) "C:\WINDOWS\system32\dhcpcsvc.dll" 2006-05-19 05:59:42 94720 ( A.... ) "C:\WINDOWS\system32\iphlpapi.dll" (((((((((((((((((((((((((((((((((((((( Files Created - Last 30days ))))))))))))))))))))))))))))))))))))))))))) 2006-07-29 19:00 468,766,720 C:\hiberfil.sys 2006-07-28 10:42 73,728 C:\WINDOWS\system32\asuninst.exe 2006-07-28 10:42 11,776 C:\WINDOWS\system32\ZPORT4AS.dll 2006-07-25 14:33 29,040 C:\WINDOWS\system32\w0034d94.dll 2006-06-19 16:20 702,768 C:\WINDOWS\system32\WgaLogon.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" "WMC_AutoUpdate"="" "TPNF"="C:\\Program Files\\TOSHIBA\\TouchPad\\TPTray.exe" "Synchronization Manager"="%SystemRoot%\\system32\\mobsync.exe /logon" "ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE" "RegistryMechanic"="" "Pinger"="c:\\toshiba\\ivp\\ism\\pinger.exe /run" "PadTouch"="C:\\Program Files\\TOSHIBA\\Touch and Launch\\PadExe.exe" "Network Associates Error Reporting Service"="\"C:\\Program Files\\Common Files\\Network Associates\\TalkBack\\TBMon.exe\"" "NDSTray.exe"="NDSTray.exe" "McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey" "IVPServiceMgr"="C:\\toshiba\\ivp\\ism\\ivpsvmgr.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "EzButton"="C:\\Program Files\\EzButton\\EzButton.EXE" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "CeEPOWER"="C:\\Program Files\\TOSHIBA\\Power Management\\CePMTray.exe" "CeEKEY"="C:\\Program Files\\TOSHIBA\\E-KEY\\CeEKey.exe" "BigDogPath"="C:\\WINDOWS\\VM_STI.EXE VIMICRO USB PC Camera 301x" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "AGRSMMSG"="AGRSMMSG.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "Washer"="C:\\Program Files\\Washer\\washer.exe /0" "TOSCDSPD"="C:\\Program Files\\TOSHIBA\\TOSCDSPD\\toscdspd.exe" "PopUpStopperFreeEdition"="\"C:\\Program Files\\Panicware\\Pop-Up Stopper Free Edition\\PSFree.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"=dword:00000001 "AllowUnhashedWebView"=dword:00000001 "NoCDBurning"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,fe,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Cisco Systems VPN Client.lnk] "backup"="C:\\WINDOWS\\pss\\Cisco Systems VPN Client.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\CISCOS~1\\VPNCLI~1\\vpngui.exe \"-user_logon\"" "item"="Cisco Systems VPN Client" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Clean Access Agent.lnk" "backup"="C:\\WINDOWS\\pss\\Clean Access Agent.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\CISCOS~1\\CLEANA~1\\CCAAgent.exe " "item"="Clean Access Agent" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk] "backup"="C:\\WINDOWS\\pss\\GStartup.lnkCommon Startup" "location"="Common Startup" "item"="GStartup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Image Zone Fast Start.lnk" "backup"="C:\\WINDOWS\\pss\\HP Image Zone Fast Start.lnkCommon Startup" "location"="Common Startup" "command"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqthb08.exe -s" "item"="HP Image Zone Fast Start" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^iFinger 2.1.lnk] "backup"="C:\\WINDOWS\\pss\\iFinger 2.1.lnkCommon Startup" "location"="Common Startup" "item"="iFinger 2.1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] "backup"="C:\\WINDOWS\\pss\\Kodak EasyShare software.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Kodak\\KODAKE~1\\bin\\EASYSH~1.EXE -h" "item"="Kodak EasyShare software" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] "backup"="C:\\WINDOWS\\pss\\KODAK Software Updater.lnkCommon Startup" "location"="Common Startup" "item"="KODAK Software Updater" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] "backup"="C:\\WINDOWS\\pss\\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\OFFICE11\\ONENOTEM.EXE /tsr" "item"="Microsoft Office OneNote 2003 Quick Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk] "backup"="C:\\WINDOWS\\pss\\MyWebSearch Email Plugin.lnkCommon Startup" "location"="Common Startup" "item"="MyWebSearch Email Plugin" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk] "backup"="C:\\WINDOWS\\pss\\RAMASST.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\system32\\RAMASST.exe " "item"="RAMASST" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] "backup"="C:\\WINDOWS\\pss\\WinZip Quick Pick.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\WinZip\\WZQKPICK.EXE " "item"="WinZip Quick Pick" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jose D. Rincon^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] "backup"="C:\\WINDOWS\\pss\\Microsoft Office OneNote 2003 Quick Launch.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\MICROS~2\\OFFICE11\\ONENOTEM.EXE /tsr" "item"="Microsoft Office OneNote 2003 Quick Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jose D. Rincon^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk] "backup"="C:\\WINDOWS\\pss\\MyWebSearch Email Plugin.lnkStartup" "location"="Startup" "item"="MyWebSearch Email Plugin" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jose D. Rincon^Start Menu^Programs^Startup^Rain.lnk] "backup"="C:\\WINDOWS\\pss\\Rain.lnkStartup" "location"="Startup" "command"="C:\\Rain\\Rain.exe " "item"="Rain" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="points manager" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANR] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ANR" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLSP Scheduler" "hkey"="HKLM" "command"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLCC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ACCAgnt" "hkey"="HKCU" "command"="\"C:\\Program Files\\AOL Computer Check-Up\\ACCAgnt.exe\" /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Apoint" "hkey"="HKLM" "command"="C:\\Program Files\\Apoint2K\\Apoint.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Archive] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="archive" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoLoaderAproposClient] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="cxtpls_loader_ff" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoUpdater] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AutoUpdate" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CFD" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BullsEye Network] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="bargains" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files\SBC Yahoo!] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS\..\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe ] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SBC Yahoo! Connection Manager" "hkey"="HKLM" "command"="SBC Yahoo! Connection Manager" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CaAvTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CAVTray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVTray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAVRID] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CAVRID" "hkey"="HKLM" "command"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVRID.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ccApp" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CMESys" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\conscorr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="conscorr" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CSV7P88] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CSV7P88" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DkIcon" "hkey"="HKLM" "command"="\"C:\\Program Files\\Diskeeper Corporation\\Diskeeper\\DkIcon.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eZmmod] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mmod" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fcr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="fcr" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gah95on6] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="gah95on6" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="gcasServ" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleDesktop" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GTV GlobalIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="global" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hmonitor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="hmonitor" "hkey"="HKLM" "command"="C:\\Program Files\\Hmonitor\\hmonitor.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AOLHostManager" "hkey"="HKLM" "command"="C:\\Program Files\\Common Files\\AOL\\1109456582\\ee\\AOLHostManager.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HPWuSchd2" "hkey"="HKLM" "command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IHaKRbLg2] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IHaKRbLg2" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="optimize" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IST Service] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="istsvc" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="kazaa" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kazaa Download Accelerator Updater] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="kdpupd" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lwvdciirowz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ubbnifb" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Access] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MediaAccK" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mimboot" "hkey"="HKLM" "command"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mimboot.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mmtask" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msnappau" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mswspl] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="searchbarcash" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MySpaceIM" "hkey"="HKCU" "command"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mwsoemon" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="P2P Networking" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RamBooster] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Rambooster" "hkey"="HKCU" "command"="C:\\Program Files\\RamBooster 2.0\\Rambooster.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RealPlay" "hkey"="HKLM" "command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RssReader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RssReader" "hkey"="HKCU" "command"="C:\\Program Files\\RssReader\\RssReader.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sais] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="sais" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\salm] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="salm" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBC Yahoo! Connection Manager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ConnectionManager" "hkey"="HKLM" "command"="C:\\WINDOWS\\..\\Program Files\\SBC Yahoo!\\Connection Manager\\ConnectionManager.exe -Show" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchUpgrader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SearchUpgrader" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TBPS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TBPS" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="realsched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ViewMgr" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows AdTools] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="WinAdTools" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="WToolsA" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ypager" "hkey"="HKCU" "command"="\"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe\" -quiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="yop" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Yahoo!\\YOP\\yop.exe /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "TBPSSvc"=dword:00000002 HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system DisableRegistryTools REG_DWORD 0 (0x0) Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: Sun 07/30/2006 8:28:38.07 ComboFix ver 06.07.15/28 - This logfile is located at C:\ComboFix.txt ComboFix.2006-07-29.234416.txt ComboFix.2006-07-30.082756.txt ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^6 UNINSTALL_LIST Ad-Aware SE Personal Adobe Atmosphere Player for Acrobat and Adobe Reader Adobe Download Manager 2.0 (Remove Only) Adobe Photoshop Album 2.0 Starter Edition Adobe Reader 7.0.8 ALPS Touch Pad Driver AOL Deskbar AOL Instant Messenger ArcSoft Software Suite aspi AT&T Connection Services Manager Atheros Client Utility ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver BJC-2000 CCHelp CCScore CD/DVD Drive Acoustic Silencer Cda Product Service - shared component Clean Access Agent CleanUp! Collage Creator Command CR2 Derive 6 Trial Edition Diskeeper Professional Edition DriverGuide Toolkit DVD X Rescue DVD-RAM Driver DVDx Easy Button EasyBackup 2.0 ESSAdpt ESSANUP ESSBrwr ESSCAM ESSCDBK ESScore ESSgui ESShelp ESSini ESSPCD ESSTUTOR ESSvpaht ESSvpot ewido anti-spyware 4.0 Google Desktop Search Hardware sensors monitor 4.2 HijackThis 1.99.1 HOTLLAMA Media Player - Update HP PSC & OfficeJet 4.7 HP Software Update ImageMixer for Sony InterVideo WinDVD for Toshiba iPod for Windows 2005-11-17 iTunes J2SE Development Kit 5.0 Update 4 J2SE Runtime Environment 5.0 Update 4 JCreator LE 3.50 Kaspersky Online Scanner Kodak EasyShare software KSU Lavasoft VX2 Cleaner Live Homework Help LiveMath Plugin LiveUpdate 2.5 (Symantec Corporation) Logitech Gaming Software Macromedia Flash Player 8 Macromedia Shockwave Player Magical Jellybean Dictionary Mathematica 5 MC Web McAfee VirusScan Enterprise MDL Chime/Chime Pro for Internet Explorer Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft Data Access Components KB870669 Microsoft Office OneNote 2003 Microsoft Office PowerPoint 2003 Template Creation Wizard Microsoft Office Professional Edition 2003 Microsoft Windows XP Video Decoder Checkup Utility Microsoft Works 2000 Microsoft Works 7.0 MicroStaff WINASPI Mozilla Firefox (1.0.1) Mozilla Thunderbird (1.5.0.4) MSN Music Assistant Musicmatch® Jukebox myTunes Redux 1.0 Network Monitor Notebook Maximizer Notifier Opera OTtBP Panda ActiveScan Password SafeHouse Full PCDLNCH PLT Scheme v301 Pop-Up Stopper Free Edition QTVRControlX 3.3 Quicken 2004 QuickTime RealArcade RealPlayer Realtek AC'97 Audio Realtek Fast Ethernet Adapter Driver RecordPad Sound Recorder Uninstall RocketReader Gold Version 6.3 Roxio Burn Engine RssReader SBC Yahoo! Applications SBC Yahoo! DSL Activation Security Update for Microsoft .NET Framework 2.0 (KB917283) Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918439) SFR SFR2 Shizmoo Web Games (Uproar) Shockwave Silvertech Software Skype 1.0 SmartSound Quicktracks Plugin SMSC IrCC V5.1.3600.3 SP1 Sonic DLA Sonic RecordNow! Sony USB Driver SpecialOffers! Spybot - Search & Destroy 1.4 SRS WOW XT Plug-In for Windows Media Player for Toshiba version 1.0.1 SSH Secure Shell TI Connect 1.5 TOSHIBA Access TOSHIBA ConfigFree TOSHIBA Console TOSHIBA Fax Extension TOSHIBA Hotkey Utility TOSHIBA PC Diagnostic Tool TOSHIBA Power Management Utility Toshiba Registration TOSHIBA Software Modem TOSHIBA Software Upgrades TOSHIBA Speech System Applications TOSHIBA Speech System SR Engine(U.S.) Version1.0 TOSHIBA Speech System TTS Engine(U.S.) Version1.0 Toshiba Tbiosdrv Driver Touch and Launch TouchPad On/Off Utility Ulead PhotoImpact XL Trial Ulead VideoStudio 8.0 Trial Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Viewpoint Media Player Vimicro USB PC Camera 301x Virtual DJ - Atomix Productions VPN Client WinAce Archiver 2.0 Window Washer Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Windows Installer Clean Up Windows Live Messenger Windows Live Sign-in Assistant Windows Media Encoder 9 Series Windows Media Encoder 9 Series Windows Media Format Runtime Windows Media Player 9 Hotfix [See KB885492 for more information] Windows XP Creativity Fun Packs - Windows Movie Maker 2 - Audio Windows XP Creativity Fun Packs - Windows Movie Maker 2 - Titles Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinMX WinZip Wolfram Notebook Indexer 1.1 Write-N-Cite ZoneAlarm ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Logfile of HijackThis v1.99.1 Scan saved at 8:43:02 AM, on 7/30/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\ACS.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\toshiba\ivp\ism\ivpsvmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\EzButton\EzButton.EXE C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\TOSHIBA\Power Management\CePMTray.exe C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\AIM\aim.exe C:\Program Files\Washer\washer.exe C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe C:\toshiba\ivp\ism\ivpsvmgr.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\WINDOWS\explorer.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uci.edu/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo! \Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo! \Common\YIeTagBm.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [IVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0 O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe" O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04 \bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo! \Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11 \REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .thp: C:\Program Files\Internet Explorer\Plugins\NPLM32.DLL O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/downloa...Downloader.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0 \guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32 \drivers\KodakCCS.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
|
|
|
07-30-2006, 09:46 PM
|
#13 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
Jose,
Okay, you're looking a lot better now. Couple more things and you'll be good to go. Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. If there is anything you don't understand, please ask BEFORE proceeding with the fixes. Please do these steps in order and do not skip any. Download AproposFix Please download AproposFix. Save it to your desktop but do NOT run it yet. Download Registry Fixes Download the attached carganegativa18-2.zip file to your Desktop. Double click on carganegativa18-2.zip file, then double click on the carganegativa18-2.reg file within. Click yes to allow it to merge into your registry. You can delete carganegativa18-2.zip now. Reboot Reboot your system to Safe Mode by repeatedly tapping the F8 key until the menu appears and choosing Safe Mode from the list. On some systems, this may be the F5 key so try that if F8 doesn't work. Login on with your usual account. Make sure to close any open windows. Uninstall Click Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): SpecialOffers! Uninstall Manager
Deletions Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GStartup.lnk Run AproposFix Please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts. Reboot Reboot your system to Normal Mode when AproposFix has finished. With Your Next Post... Please post the entire contents of log.txt in the aproposfix folder along with a new HijackThis log. Please turn off word wrap in Notepad (under the tools menu) before copying and pasting -- it makes the logs harder to read. Also, please let me know how your system is behaving now.
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all. UNITE/ASAP: Proud member since 2006 Last edited by Deckard; 11-02-2006 at 05:54 PM. |
|
|
|
|
07-30-2006, 10:54 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
I found nearly identical file names:
I have to delte these two files:
C:\WINDOWS\pss\GStartup.lnk C:\WINDOWS\pss\MyWebSearch Email Plugin.lnk however, the only thing I see is this C:\WINDOWS\pss\GStartup.lnkCommon Startup C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkCommon Startup C:\WINDOWS\pss\MyWebSearch Email Plugin.InkStartup are these the right files? and should I go ahead and delete them???? Jose |
|
|
|
|
07-30-2006, 11:05 PM
|
#15 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
Yes, delete all three of those files. MSConfig must have renamed them.
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all. UNITE/ASAP: Proud member since 2006 |
|
|
|
|
07-30-2006, 11:32 PM
|
#16 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 11
OS: Windows XP
|
New Logs
Here are the new Logs after I did all the steps outlined before. Also, I uste text pad (or something like that), and I think I turn off the word wrap, I hope I did it right.
As far as my system goes, I've noticed a tremendous increase in performance. Loading pages doens't take as long as before, and start-up time has been decreased by about 35-60 percent. I don't get any more pop-ups and also one thing I notices is that when I right click the screen to make a new folder, new txt file, or new word document, it doens't take 5 seconds to let me pick, it now happens very very very fast. Thanks a lot, and I hope that in the mean time I haven't gotten infected with something else!!! Jose R Ad-Aware SE Personal Adobe Atmosphere Player for Acrobat and Adobe Reader Adobe Download Manager 2.0 (Remove Only) Adobe Photoshop Album 2.0 Starter Edition Adobe Reader 7.0.8 ALPS Touch Pad Driver AOL Deskbar AOL Instant Messenger ArcSoft Software Suite aspi AT&T Connection Services Manager Atheros Client Utility ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver BJC-2000 CCHelp CCScore CD/DVD Drive Acoustic Silencer Cda Product Service - shared component Clean Access Agent CleanUp! Collage Creator Command CR2 Derive 6 Trial Edition Diskeeper Professional Edition DriverGuide Toolkit DVD X Rescue DVD-RAM Driver DVDx Easy Button EasyBackup 2.0 ESSAdpt ESSANUP ESSBrwr ESSCAM ESSCDBK ESScore ESSgui ESShelp ESSini ESSPCD ESSTUTOR ESSvpaht ESSvpot ewido anti-spyware 4.0 Google Desktop Search Hardware sensors monitor 4.2 HijackThis 1.99.1 HOTLLAMA Media Player - Update HP PSC & OfficeJet 4.7 HP Software Update ImageMixer for Sony InterVideo WinDVD for Toshiba iPod for Windows 2005-11-17 iTunes J2SE Development Kit 5.0 Update 4 J2SE Runtime Environment 5.0 Update 4 JCreator LE 3.50 Kaspersky Online Scanner Kodak EasyShare software KSU Lavasoft VX2 Cleaner Live Homework Help LiveMath Plugin LiveUpdate 2.5 (Symantec Corporation) Logitech Gaming Software Macromedia Flash Player 8 Macromedia Shockwave Player Magical Jellybean Dictionary Mathematica 5 MC Web McAfee VirusScan Enterprise MDL Chime/Chime Pro for Internet Explorer Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft Data Access Components KB870669 Microsoft Office OneNote 2003 Microsoft Office PowerPoint 2003 Template Creation Wizard Microsoft Office Professional Edition 2003 Microsoft Windows XP Video Decoder Checkup Utility Microsoft Works 2000 Microsoft Works 7.0 MicroStaff WINASPI Mozilla Firefox (1.0.1) Mozilla Thunderbird (1.5.0.4) MSN Music Assistant Musicmatch® Jukebox myTunes Redux 1.0 Network Monitor Notebook Maximizer Notifier Opera OTtBP Panda ActiveScan Password SafeHouse Full PCDLNCH PLT Scheme v301 Pop-Up Stopper Free Edition QTVRControlX 3.3 Quicken 2004 QuickTime RealArcade RealPlayer Realtek AC'97 Audio Realtek Fast Ethernet Adapter Driver RecordPad Sound Recorder Uninstall RocketReader Gold Version 6.3 Roxio Burn Engine RssReader SBC Yahoo! Applications SBC Yahoo! DSL Activation Security Update for Microsoft .NET Framework 2.0 (KB917283) Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918439) SFR SFR2 Shizmoo Web Games (Uproar) Shockwave Silvertech Software Skype 1.0 SmartSound Quicktracks Plugin SMSC IrCC V5.1.3600.3 SP1 Sonic DLA Sonic RecordNow! Sony USB Driver Spybot - Search & Destroy 1.4 SRS WOW XT Plug-In for Windows Media Player for Toshiba version 1.0.1 SSH Secure Shell Stamina 2.5 TI Connect 1.5 TOSHIBA Access TOSHIBA ConfigFree TOSHIBA Console TOSHIBA Fax Extension TOSHIBA Hotkey Utility TOSHIBA PC Diagnostic Tool TOSHIBA Power Management Utility Toshiba Registration TOSHIBA Software Modem TOSHIBA Software Upgrades TOSHIBA Speech System Applications TOSHIBA Speech System SR Engine(U.S.) Version1.0 TOSHIBA Speech System TTS Engine(U.S.) Version1.0 Toshiba Tbiosdrv Driver Touch and Launch TouchPad On/Off Utility Ulead PhotoImpact XL Trial Ulead VideoStudio 8.0 Trial Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Vimicro USB PC Camera 301x Virtual DJ - Atomix Productions VPN Client WinAce Archiver 2.0 Window Washer Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Windows Installer Clean Up Windows Live Messenger Windows Live Sign-in Assistant Windows Media Encoder 9 Series Windows Media Encoder 9 Series Windows Media Format Runtime Windows Media Player 9 Hotfix [See KB885492 for more information] Windows XP Creativity Fun Packs - Windows Movie Maker 2 - Audio Windows XP Creativity Fun Packs - Windows Movie Maker 2 - Titles Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinMX WinZip Wolfram Notebook Indexer 1.1 Write-N-Cite ZoneAlarm ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Log of AproposFix v1.1 ************ Running from directory: C:\Documents and Settings\Jose D. Rincon\Desktop\aproposfix ************ Registry entries found: ************ No service found! Removing hidden folder: No folder found! Deleting files: Backing up files: Done! Removing registry entries: REGEDIT4 Done! Finished! ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Logfile of HijackThis v1.99.1 Scan saved at 11:26:02 PM, on 7/30/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\ACS.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\toshiba\ivp\ism\ivpsvmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\EzButton\EzButton.EXE C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\TOSHIBA\Power Management\CePMTray.exe C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\AIM\aim.exe C:\Program Files\Washer\washer.exe C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uci.edu/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [IVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0 O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe" O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .thp: C:\Program Files\Internet Explorer\Plugins\NPLM32.DLL O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/downloa...Downloader.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
|
|
|
07-31-2006, 08:02 AM
|
#17 (permalink) |
|
Mentor, Analyst - Security Team
Join Date: May 2006
Location: Oregon
Posts: 2,503
OS: MacOS X, Debian, OpenBSD, Windows
|
You missed Network Monitor --
Well done, your logs are clean! Any more issues? If not, you should be good to go but we still have a few items we'd like to address. Reset hidden/system files and folders
Reset System Restore
Re-enable Protection Turn back on any malware prevention tools we might have had you switch off (i.e., Ewido Shield). Microsoft Updates It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by malware. Using Internet Explorer, please go to Microsoft's Windows Update and download all of the critical updates to help prevent possible re-infection. Enable Windows Auto Update:
Update Java We need to update your Java as it is out of date. Older versions can be a security risk as malware writers have been known exploit the weaknesses the code.
Malware Prevention This is a good time to set up protection against further attacks. You might want to read Tony Klein's "How Did I Get Infected In The First Place?". At the minimum, you need an antivirus that is continually updated, a good firewall, a spyware blocker such as Spyware Blaster, and a real time spyware program such as Spyware Guard to prevent spyware intrusions. I also recommend IE-Spyad, which places over 4,000 websites and domains in the IE Restricted list, thus helping prevent attempts to re-infect your system. All of these have no-strings-attached free versions available. However, be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use but often have malware in them. Two more articles you may want to read at your leisure are "KRC Anti-Spyware Tutorial" and "Making Internet Explorer Safer". The following is a list of free software we recommend: Realtime Malware Prevention Tools These programs actively watch your computer for possible malware-related changes and help prevent them. You can run more than one of these at a time.Passive Malware Prevention Tools These programs configure your computer to prevent known malware-related changes. You can have more than one of these at a time and they take up minimal resources.
Using an alternative browser can help prevent malware from being installed without your knowledge, but may not work on all websites.Alternative Miscellaneous Here are some alternatives that are worth looking into if you use their features:
Please respond to this thread one more time so we can mark this thread as resolved.
__________________
The chance to begin again in a golden land of opportunity and adventure. Need HijackThis help? Please read MicroBell's Five Step Process before posting.
Please donate and help keep this site free to all. UNITE/ASAP: Proud member since 2006 |
|
|
|
| Thread Tools | |
|
|
and select alcanshorty.bfu
