|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
04-26-2007, 04:26 AM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Help needed - 2 annoying iexplore.exe tasks...
Hi...
I'm new to this community here, lets say i'm a noob... I really need some help in this matter. Whenever I open the task manager, there are always 2 iexplore.exe tasks even when IE is not open.. It really pisses me off because it is taking up some of my PC's resources..I suspected it is a malware but my antivirus and antispyware programs coudn't see anything... So, I downloaded Hijack This and here is the log.. Logfile of HijackThis v1.99.1 Scan saved at 6:34:13 PM, on 4/26/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\carpserv.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\NetPumper\NetPumperIEProxy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\BitComet\BitComet.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe c:\progra~1\intern~1\iexplore.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\BearShare Applications\BearShare\BearShare.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Essential drivers\WinProcess Viewer\PrcView.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [COALDARTEXITTONS] C:\Documents and Settings\All Users\Application Data\Flaw Rdr Coal Dart\Wait Gram.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [MapiPoll] C:\DOCUME~1\ADMINI~1\APPLIC~1\BODYME~1\Bend atom type.exe O4 - Startup: PowerReg Scheduler.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- Plz.. I really need ur expert advice ^_^ |
|
     |
| Sponsored Links |
|
04-29-2007, 09:08 AM
|
#2 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi and welcome to TSF.
Apologies for any delay in replying, but we have been rather busy lately, and, of course, all our helpers are volunteers. Since it has been a few days since you first posted, please follow these instructions if you still need assistance. Download Deckard's System Scanner (DSS) to your Desktop . Note: You must be logged onto an account with administrator privileges.
To attach a file to a new post, simply
I will monitor this thread for your reply. Thank you for your patience.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums.   Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-04-2007, 01:41 AM
|
#3 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
.. Hi ..
.. I followed ur instructions and obtained the ff:.. Deckard's System Scanner v20070426.43 Run by Administrator on 2007-05-04 at 16:22:09 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 42: 2007-05-04 08:22:23 UTC - RP42 - Deckard's System Scanner Restore Point 41: 2007-05-04 01:49:09 UTC - RP41 - System Checkpoint 40: 2007-05-02 01:05:38 UTC - RP40 - System Checkpoint 39: 2007-04-30 17:21:00 UTC - RP39 - System Checkpoint 38: 2007-04-29 03:33:40 UTC - RP38 - Installed Neverwinter Nights Platinum Edition -- First Restore Point -- 1: 2007-04-06 09:27:51 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 4:23:59 PM, on 5/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\carpserv.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\BitComet\BitComet.exe C:\Program Files\DAEMON Tools\daemon.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\CHIKKA~2.EXE C:\Essential drivers\dss.exe C:\PROGRA~1\HIJACK~1\Administrator.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [MapiPoll] C:\DOCUME~1\LOCALS~1\APPLIC~1\BODYME~1\Bend atom type.exe O4 - HKCU\..\Run: [Chikka] C:\Program Files\Chikka Messenger\Chikka v.4\\ChikkaLauncher.exe O4 - Startup: Neverwinter Nights_ Platinum Edition Registration.lnk = C:\NeverwinterNights\NWN\ereg\ATR1.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 mdmxsdk - c:\windows\system32\drivers\mdmxsdk.sys <Not Verified; Conexant; Diagnostic Interface> R2 StreamDispatcher - c:\windows\system32\drivers\strmdisp.sys <Not Verified; Conexant Systems; Conexant Stream Dispatcher> R3 HSF_DP - c:\windows\system32\drivers\hsf_dp.sys <Not Verified; Conexant Systems; SoftK56> R3 HSFHWBS2 - c:\windows\system32\drivers\hsfhwbs2.sys <Not Verified; Conexant Systems; SoftK56> R3 winachsf - c:\windows\system32\drivers\hsf_cnxt.sys <Not Verified; Conexant Systems; SoftK56> S3 RivaTuner32 - c:\program files\rivatuner v2.0 final release\rivatuner32.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Diskeeper - "c:\program files\diskeeper corporation\diskeeper\dkservice.exe" <Not Verified; Diskeeper Corporation; Diskeeper (TM) Disk Defragmenter> -- Scheduled Tasks ------------------------------------------------------------- 2007-05-04 16:00:02 288 --ah----- C:\WINDOWS\Tasks\AE5186DE92AA04CA.job -- Files created between 2007-04-04 and 2007-05-04 ----------------------------- 2007-05-04 12:51:45 0 d-------- C:\Documents and Settings\LocalService\Application Data\BODYMEMOSCR 2007-05-04 12:29:16 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-04-30 15:30:24 0 d-------- C:\Documents and Settings\Administrator\Application Data\Microsoft Games 2007-04-30 15:29:09 0 d-------- C:\Program Files\GameSpy Arcade 2007-04-30 15:12:43 0 d-------- C:\Program Files\Microsoft Games 2007-04-29 12:02:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\Leadertech 2007-04-29 11:22:47 0 d-------- C:\NeverwinterNights 2007-04-26 23:38:23 0 d-------- C:\Program Files\Download Manager 2007-04-26 23:37:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\IGN_DLM 2007-04-25 22:56:00 0 d-------- C:\Documents and Settings\All Users\Application Data\Flaw Rdr Coal Dart 2007-04-25 22:55:25 0 d-------- C:\Program Files\BODYMEMOSCR 2007-04-25 22:55:24 0 d-------- C:\Documents and Settings\Administrator\Application Data\BODYMEMOSCR 2007-04-25 22:55:09 0 d-------- C:\Documents and Settings\Administrator\Application Data\NetPumper 2007-04-25 22:54:57 0 d-------- C:\Program Files\NetPumper 2007-04-25 15:10:58 0 d-------- C:\logs 2007-04-25 15:10:52 0 d-------- C:\Documents and Settings\Administrator\ChikkaDefault 2007-04-25 15:10:33 0 d-------- C:\Program Files\Chikka Messenger 2007-04-25 08:20:47 0 d-------- C:\Program Files\Sierra On-Line 2007-04-25 08:20:45 0 d-------- C:\Sierra 2007-04-24 20:38:44 0 d-------- C:\Program Files\Infogrames Interactive 2007-04-24 19:22:53 0 --a------ C:\WINDOWS\PowerReg.dat 2007-04-24 11:42:15 0 d-------- C:\Documents and Settings\Administrator\Application Data\Hamachi 2007-04-24 11:41:26 0 d-------- C:\Program Files\Hamachi 2007-04-23 20:18:06 0 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2007-04-23 19:17:32 0 d-------- C:\WINDOWS\nview 2007-04-23 18:33:29 1216512 --a------ C:\Program Files\starcraft.exe <Not Verified; Blizzard Entertainment; StarCraft> 2007-04-23 18:24:08 967 --a------ C:\WINDOWS\ScUnin.pif 2007-04-23 18:24:08 35382 --a------ C:\WINDOWS\scunin.dat 2007-04-23 18:24:07 94208 --a------ C:\WINDOWS\ScUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller> 2007-04-23 18:19:07 0 d-------- C:\Program Files\Starcraft 2007-04-23 12:00:22 0 d-------- C:\Program Files\MagicISO 2007-04-22 12:31:07 4096 --a------ C:\WINDOWS\d3dx.dat 2007-04-22 12:14:54 0 d-------- C:\Program Files\Lionhead Studios Ltd 2007-04-18 11:51:10 0 d-------- C:\Program Files\Ubisoft 2007-04-17 22:01:07 0 d-------- C:\Program Files\mIRC 2007-04-14 21:12:11 0 d-------- C:\Program Files\Visual Boy Advance 2007-04-13 10:27:16 0 d-------- C:\WINDOWS\.jagex_cache_32 2007-04-13 10:26:57 0 d-------- C:\WINDOWS\Sun 2007-04-13 10:26:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2007-04-13 09:11:10 153751 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys 2007-04-13 09:10:34 4682 --a------ C:\WINDOWS\system32\npptNT2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT> 2007-04-13 08:49:52 0 d-------- C:\Program Files\Mobius 2007-04-12 23:20:10 0 d-------- C:\Program Files\cFosSpeed 2007-04-12 18:26:29 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2007-04-12 08:16:57 0 d-------- C:\Valve 2007-04-12 08:15:59 0 d-------- C:\Program Files\DAEMON Tools 2007-04-12 08:13:03 646392 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-04-12 07:38:40 20480 --a------ C:\WINDOWS\system32\wbload.dll 2007-04-12 07:38:39 36864 --a------ C:\WINDOWS\system32\wbsys.dll <Not Verified; Stardock.Net, Inc; WindowBlinds 4.x for x86 machines> 2007-04-12 07:38:37 0 d-------- C:\Program Files\Stardock 2007-04-11 23:29:32 0 d-------- C:\Program Files\RivaTuner v2.0 Final Release 2007-04-11 21:05:48 1744 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-04-11 19:47:45 1632 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-04-11 19:47:32 0 d-------- C:\Program Files\Project64 1.6 2007-04-10 10:16:48 0 d-------- C:\Program Files\Nvidia 2007-04-09 20:18:26 0 d--hs---- C:\Diskeeper 2007-04-09 13:58:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation 2007-04-09 13:56:00 0 d-------- C:\Program Files\Diskeeper Corporation 2007-04-08 08:15:46 0 d-------- C:\Program Files\Eusing Free Registry Cleaner 2007-04-08 08:15:26 262144 --a------ C:\Documents and Settings\All Users\ntuser.dat 2007-04-08 03:00:50 0 d-------- C:\WINDOWS\system32\PreInstall 2007-04-07 13:30:00 0 d--h----- C:\WINDOWS\$hf_mig$ 2007-04-07 13:28:23 0 d-------- C:\WINDOWS\pss 2007-04-07 13:22:38 20480 --a------ C:\WINDOWS\system32\normaliz.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2007-04-07 11:38:51 0 d-------- C:\Program Files\Alwil Software 2007-04-07 11:05:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\Help 2007-04-07 11:00:15 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-04-07 10:58:20 0 d-------- C:\Documents and Settings\LocalService\Start Menu 2007-04-07 10:57:02 0 d-------- C:\WINDOWS\SoftwareDistribution 2007-04-07 10:56:56 0 d-------- C:\WINDOWS\Prefetch 2007-04-07 10:56:55 0 d---s---- C:\WINDOWS\system32\Microsoft 2007-04-07 10:45:24 0 d-------- C:\WINDOWS\peernet 2007-04-07 10:45:23 0 d-------- C:\WINDOWS\provisioning 2007-04-07 10:41:35 0 d-------- C:\WINDOWS\ServicePackFiles 2007-04-07 10:32:28 0 d-------- C:\WINDOWS\EHome 2007-04-07 10:03:22 592 --a------ C:\WINDOWS\chgkey.vbs 2007-04-07 09:58:37 0 d-------- C:\Program Files\Setup 2007-04-07 09:56:24 0 d-------- C:\Program Files\WinAce 2007-04-07 09:35:31 0 d-------- C:\Documents and Settings\Administrator\Shared 2007-04-07 09:35:23 0 d-------- C:\Documents and Settings\Administrator\Incomplete 2007-04-07 00:53:28 0 d-------- C:\Program Files\Common Files\ODBC 2007-04-07 00:53:25 0 dr------- C:\Program Files 2007-04-07 00:53:25 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-04-07 00:53:02 0 d--h----- C:\Documents and Settings\Default User\Templates 2007-04-07 00:53:02 0 dr------- C:\Documents and Settings\Default User\Start Menu 2007-04-07 00:53:02 0 dr-h----- C:\Documents and Settings\Default User\SendTo 2007-04-07 00:53:02 0 d--h----- C:\Documents and Settings\Default User\Recent 2007-04-07 00:53:02 0 d--h----- C:\Documents and Settings\Default User\PrintHood 2007-04-07 00:53:02 0 d--h----- C:\Documents and Settings\Default User\NetHood 2007-04-07 00:53:02 0 d-------- C:\Documents and Settings\Default User\My Documents 2007-04-07 00:53:02 0 dr-h----- C:\Documents and Settings\Default User\Local Settings 2007-04-07 00:53:02 0 d-------- C:\Documents and Settings\Default User\Favorites 2007-04-07 00:53:02 0 d-------- C:\Documents and Settings\Default User\Desktop 2007-04-07 00:53:02 0 d---s---- C:\Documents and Settings\Default User\Cookies 2007-04-07 00:53:02 0 d--h----- C:\Documents and Settings\All Users\Templates 2007-04-07 00:53:02 0 dr------- C:\Documents and Settings\All Users\Start Menu 2007-04-07 00:53:02 0 d-------- C:\Documents and Settings\All Users\Favorites 2007-04-07 00:53:02 0 dr------- C:\Documents and Settings\All Users\Documents 2007-04-07 00:53:02 0 d-------- C:\Documents and Settings\All Users\Desktop 2007-04-07 00:52:46 0 dr-h----- C:\Documents and Settings\Default User\Application Data 2007-04-07 00:52:46 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft 2007-04-07 00:52:46 0 dr-h----- C:\Documents and Settings\All Users\Application Data 2007-04-07 00:52:46 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft 2007-04-07 00:38:25 0 d-------- C:\WINDOWS\system32\CatRoot2 2007-04-07 00:38:25 0 d-------- C:\WINDOWS\system32\CatRoot 2007-04-07 00:38:05 0 d-------- C:\Documents and Settings 2007-04-07 00:33:14 0 d-------- C:\WINDOWS 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\WinSxS 2007-04-07 00:33:14 0 dr------- C:\WINDOWS\Web 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\twain_32 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\wins 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\wbem 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\usmt 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\spool 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\ShellExt 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\Setup 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\ras 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\oobe 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\npp 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\mui 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\inetsrv 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\IME 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\icsxml 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\ias 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\export 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\drivers 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\drivers\etc 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\drivers\disdn 2007-04-07 00:33:14 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\dhcp 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\config 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\3com_dmi 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\3076 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\2052 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1054 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1042 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1041 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1037 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1033 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1031 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1028 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system32\1025 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\system 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\security 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Resources 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\repair 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\mui 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\msapps 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\msagent 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Media 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\java 2007-04-07 00:33:14 0 d--h----- C:\WINDOWS\inf 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\ime 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Help 2007-04-07 00:33:14 0 dr--s---- C:\WINDOWS\Fonts 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Driver Cache 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Debug 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Cursors 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Connection Wizard 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\Config 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\AppPatch 2007-04-07 00:33:14 0 d-------- C:\WINDOWS\addins 2007-04-06 23:32:20 0 d-------- C:\Documents and Settings\Administrator\Application Data\BearShare 2007-04-06 21:26:53 0 d-------- C:\Program Files\Java 2007-04-06 21:16:05 0 d-------- C:\Program Files\Common Files\Java 2007-04-06 21:13:33 0 d-------- C:\Program Files\LimeWire 2007-04-06 21:09:42 0 d-------- C:\Documents and Settings\Administrator\.limewire 2007-04-06 20:54:53 0 d-------- C:\Program Files\Winamp 2007-04-06 20:42:43 0 d-------- C:\Program Files\BearShare Applications 2007-04-06 20:30:06 0 d-------- C:\NVIDIA 2007-04-06 20:24:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2007-04-06 20:24:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-04-06 20:24:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-04-06 20:24:36 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2007-04-06 20:17:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-04-06 19:53:11 0 d-------- C:\Program Files\Combined Community Codec Pack 2007-04-06 19:50:26 0 d-------- C:\WINDOWS\RegisteredPackages 2007-04-06 19:48:53 0 d-------- C:\DIRECTX 9.0c 2007-04-06 19:47:11 0 d-------- C:\Downloads 2007-04-06 19:47:02 0 d-------- C:\Program Files\BitComet 2007-04-06 19:28:43 0 dr-h----- C:\Documents and Settings\Administrator\Application Data\yahoo! 2007-04-06 19:16:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2007-04-06 19:10:36 0 d-------- C:\Documents and Settings\Administrator\Application Data\Google 2007-04-06 19:10:34 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2007-04-06 19:09:20 0 d-------- C:\Program Files\Google 2007-04-06 18:24:34 0 d-------- C:\Essential drivers 2007-04-06 18:19:31 0 d-------- C:\Documents and Settings\All Users\Application Data\yahoo! 2007-04-06 18:11:11 0 d--hs---- C:\Documents and Settings\Administrator\UserData 2007-04-06 18  15 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion2007-04-06 18:05:51 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia 2007-04-06 18:05:46 0 d-------- C:\Program Files\Yahoo! 2007-04-06 17:54:05 0 d-------- C:\Program Files\CONEXANT 2007-04-06 17:53:20 57344 --a------ C:\WINDOWS\system32\mdmxsdk.dll <Not Verified; Conexant; Diagnostic Interface> 2007-04-06 17:53:20 12074 --a------ C:\WINDOWS\system32\hsfinst.dll <Not Verified; Conexant Systems; SoftK56> 2007-04-06 17:53:20 33548 --a------ C:\WINDOWS\system32\drivers\strmdisp.sys <Not Verified; Conexant Systems; Conexant Stream Dispatcher> 2007-04-06 17:53:20 9855 --a------ C:\WINDOWS\system32\drivers\mdmxsdk.sys <Not Verified; Conexant; Diagnostic Interface> 2007-04-06 17:53:20 4608 --a------ C:\WINDOWS\system32\carpserv.exe <Not Verified; Conexant Systems; Conexant carpserv> 2007-04-06 17:53:20 51200 --a------ C:\WINDOWS\system32\carpdll.dll <Not Verified; Conexant Systems; Conexant CARPDLL> 2007-04-06 17:53:19 160083 --a------ C:\WINDOWS\system32\drivers\HSFHWBS2.sys <Not Verified; Conexant Systems; SoftK56> 2007-04-06 17:53:19 1171488 --a------ C:\WINDOWS\system32\drivers\HSF_DP.sys <Not Verified; Conexant Systems; SoftK56> 2007-04-06 17:53:19 591536 --a------ C:\WINDOWS\system32\drivers\HSF_CNXT.sys <Not Verified; Conexant Systems; SoftK56> 2007-04-06 17:53:15 0 d-------- C:\Program Files\UIU 2007-04-06 17:52:41 49152 -----n--- C:\WINDOWS\remvess.exe 2007-04-06 17:52:41 0 d-------- C:\WINDOWS\options 2007-04-06 17:52:41 163840 -----n--- C:\WINDOWS\essspk.exe <Not Verified; ; ESSSPK Application> 2007-04-06 17:52:34 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-04-06 17:52:32 0 d-------- C:\Program Files\Common Files\InstallShield 2007-04-06 17:49:40 0 d-------- C:\Program Files\Canon 2007-04-06 17:45:40 36864 --a------ C:\WINDOWS\system32\CNMCP3Y.EXE 2007-04-06 17:45:40 0 d--h----- C:\BJPrinter 2007-04-06 17:43:56 208947 --a------ C:\WINDOWS\system32\UnAudioNT.dll 2007-04-06 17:43:55 0 d-------- C:\Program Files\VIA Technologies, Inc 2007-04-06 17:43:28 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2007-04-06 17:43:02 0 d-------- C:\Documents and Settings\Administrator\WINDOWS 2007-04-06 17:40:30 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2007-04-06 17:35:19 0 d-------- C:\Program Files\Microsoft ActiveSync 2007-04-06 17:32:06 0 d-------- C:\WINDOWS\ShellNew 2007-04-06 17:32:01 0 d-------- C:\Program Files\Common Files\L&H 2007-04-06 17:27:33 0 d--hs---- C:\WINDOWS\Installer 2007-04-06 17:27:30 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2007-04-06 17:27:17 0 d--h----- C:\Documents and Settings\Administrator\Templates 2007-04-06 17:27:17 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2007-04-06 17:27:17 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2007-04-06 17:27:17 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2007-04-06 17:27:17 3145728 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2007-04-06 17:27:17 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2007-04-06 17:27:17 0 dr------- C:\Documents and Settings\Administrator\My Documents 2007-04-06 17:27:17 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2007-04-06 17:27:17 0 dr------- C:\Documents and Settings\Administrator\Favorites 2007-04-06 17:27:17 0 d-------- C:\Documents and Settings\Administrator\Desktop 2007-04-06 17:27:17 0 d--hs---- C:\Documents and Settings\Administrator\Cookies 2007-04-06 17:27:17 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2007-04-06 17:27:00 0 d-------- C:\WINDOWS\LogFiles 2007-04-06 17:25:51 0 d--hs---- C:\System Volume Information 2007-04-06 17:25:50 786432 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT 2007-04-06 17:25:50 0 d--h----- C:\Documents and Settings\LocalService\Local Settings 2007-04-06 17:25:50 0 d--hs---- C:\Documents and Settings\LocalService\Cookies 2007-04-06 17:25:50 0 d-------- C:\Documents and Settings\LocalService\Application Data 2007-04-06 17:25:50 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft 2007-04-06 17:25:49 786432 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT 2007-04-06 17:25:49 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings 2007-04-06 17:25:49 0 d---s---- C:\Documents and Settings\NetworkService\Cookies 2007-04-06 17:25:49 0 d-------- C:\Documents and Settings\NetworkService\Application Data 2007-04-06 17:25:49 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft 2007-04-06 17:21:25 0 d-------- C:\WINDOWS\system32\xircom 2007-04-06 17:21:25 0 d-------- C:\Program Files\microsoft frontpage 2007-04-06 17:21:04 233472 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT 2007-04-06 17:20:56 0 -rahs---- C:\MSDOS.SYS 2007-04-06 17:20:56 0 -rahs---- C:\IO.SYS 2007-04-06 17:20:56 0 --a------ C:\CONFIG.SYS 2007-04-06 17:20:56 0 --a------ C:\AUTOEXEC.BAT 2007-04-06 17:19:39 0 d--hs---- C:\Documents and Settings\All Users\DRM 2007-04-06 17:19:27 0 dr------- C:\WINDOWS\Offline Web Pages 2007-04-06 17:19:27 0 d---s---- C:\WINDOWS\Downloaded Program Files 2007-04-06 17:19:00 0 d-------- C:\WINDOWS\srchasst 2007-04-06 17:18:52 0 d-------- C:\WINDOWS\system32\DirectX 2007-04-06 17:18:51 0 d-------- C:\WINDOWS\system32\Macromed 2007-04-06 17:18:37 0 d-------- C:\Program Files\Movie Maker 2007-04-06 17:18:09 0 d-------- C:\WINDOWS\system32\Restore 2007-04-06 17:18:04 0 d-------- C:\WINDOWS\PCHEALTH 2007-04-06 17:17:57 0 d---s---- C:\WINDOWS\Tasks 2007-04-06 17:17:54 0 d-------- C:\Program Files\Common Files\MSSoap 2007-04-06 17:17:12 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-04-06 17:16:55 0 d-------- C:\WINDOWS\Registration 2007-04-06 17:16:47 0 d--h----- C:\Program Files\WindowsUpdate 2007-04-06 17:16:47 0 d-------- C:\Program Files\Online Services 2007-04-06 17:16:36 0 d-------- C:\Program Files\Messenger 2007-04-06 17:16:25 0 d-------- C:\Program Files\MSN Gaming Zone 2007-04-06 17:16:15 0 d-------- C:\Program Files\Windows NT 2007-04-06 17:16:04 0 d-------- C:\WINDOWS\system32\MsDtc 2007-04-06 17:16:02 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2007-04-07 00:53:02 62 --ahs---- C:\Documents and Settings\Administrator\Application Data\desktop.ini 2007-04-06 19:47:12 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll <Not Verified; BitComet; BitComet BCTP Helper> 2007-02-13 18:55:40 224256 --a------ C:\WINDOWS\system32\AutoFAT.exe <Not Verified; Diskeeper Corporation.; Diskeeper Corporation. Diskeeper (NT5 AutoFAT component 20070209)> 2007-02-13 18:55:32 185344 --a------ C:\WINDOWS\system32\AutoNTFS.exe <Not Verified; Diskeeper Corporation.; Diskeeper Corporation. Diskeeper (NT5 AutoNTFS component 20070209)> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} C:\Program Files\Yahoo!\Common\yiesrvc.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "CARPService"="carpserv.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "cFosSpeed"="C:\\Program Files\\cFosSpeed\\cFosSpeed.exe" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "BitComet"="\"C:\\Program Files\\BitComet\\BitComet.exe\" /tray" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "MapiPoll"="C:\\DOCUME~1\\LOCALS~1\\APPLIC~1\\BODYME~1\\Bend atom type.exe" "Chikka"="C:\\Program Files\\Chikka Messenger\\Chikka v.4\\\\ChikkaLauncher.exe" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="wbsys.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^PowerReg Scheduler.exe] "path"="C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup\\PowerReg Scheduler.exe" "backup"="C:\\WINDOWS\\pss\\PowerReg Scheduler.exeStartup" "location"="Startup" "command"="C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup\\PowerReg Scheduler.exe" "item"="PowerReg Scheduler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] "backup"="C:\\WINDOWS\\pss\\WinZip Quick Pick.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\WinZip\\WZQKPICK.EXE " "item"="WinZip Quick Pick" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="avgcc" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COALDARTEXITTONS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Wait Gram" "hkey"="HKLM" "command"="C:\\Documents and Settings\\All Users\\Application Data\\Flaw Rdr Coal Dart\\Wait Gram.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DLM" "hkey"="HKCU" "command"="C:\\Program Files\\Download Manager\\DLM.exe /windowsstart /startifwork" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MapiPoll] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Bend atom type" "hkey"="HKCU" "command"="C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\BODYME~1\\Bend atom type.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetPumper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NetPumperIEProxy" "hkey"="HKLM" "command"="\"C:\\Program Files\\NetPumper\\NetPumperIEProxy.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Steam" "hkey"="HKCU" "command"="C:\\Valve\\Steam\\Steam.exe -silent" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c84dc3d1-e459-11db-8a88-806d6172696f}] Shell\AutoRun\command D:\RoNsetup.exe /autorun [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cde24a41-f18c-11db-8109-000e2e802d90}] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd349752-e88a-11db-80fe-000e2e802d90}] Shell\AutoRun\command E:\autorun.exe -- Hosts ----------------------------------------------------------------------- 127.0.0.1 bin.errorprotector.com ## added by CiD 127.0.0.1 br.errorsafe.com ## added by CiD 127.0.0.1 br.winantivirus.com ## added by CiD 127.0.0.1 br.winfixer.com ## added by CiD 127.0.0.1 cdn.drivecleaner.com ## added by CiD 127.0.0.1 cdn.errorsafe.com ## added by CiD 127.0.0.1 cdn.winsoftware.com ## added by CiD 127.0.0.1 de.errorsafe.com ## added by CiD 127.0.0.1 de.winantivirus.com ## added by CiD 127.0.0.1 download.cdn.drivecleaner.com ## added by CiD 60 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2007-05-04 at 16:28:43 --------- .. Tnx 4 d help.. 
|
|
|
|
|
05-04-2007, 02:13 PM
|
#4 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi again.
My name is Iain and I will be helping you clean your system. You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply. Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below. Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your log is clean. Remember that although your symptoms may vanish, this does NOT mean that your system is clean. If there is anything you don't understand, please ask BEFORE proceeding with the fixes. Please ensure that you follow the instructions in the order I have them listed. Anti Virus I see you appear to have more than one Anti Virus programme on your system, AVG and AVAST. While this may seem to offer extra protection it is not a good idea! There will be conflicts between the programmes and your system may become slow and unstable as a consequence. Please uninstall one anti virus - the choice is yours. Show Hidden Files Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option. Downloads Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later. *NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! Download AVG Anti Spyware Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows" 
When you have finished updating, EXIT AVG Anti Spyware. Download HostsXpert Download fl.zip You will use this later. Run HostsXpert Click "Make Hosts Writable?" in the upper right corner (If available). Click Restore Original Hosts and then click OK. Click the X to exit the program. Reboot Reboot your system in Safe Mode.
Uninstall Programmes Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present): CiD Help HijackThis Entries Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O4 - HKCU\..\Run: [MapiPoll] C:\DOCUME~1\LOCALS~1\APPLIC~1\BODYME~1\Bend atom type.exe Please remember to close all other windows, including browsers then click Fix checked. File Deletions Delete the following Folders indicated in BLUE if they still exist. C:\Documents and Settings\LocalService\Application Data\BODYMEMOSCR C:\Documents and Settings\All Users\Application Data\Flaw Rdr Coal Dart C:\Program Files\BODYMEMOSCR C:\Documents and Settings\Administrator\Application Data\BODYMEMOSCR Run CleanUp! *NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows: Click Options Move the slider button down to Custom CleanUp! Check the following:
Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted. Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility. Run AVG Anti Spyware Run AVG with it's updated definitions (...it's important that all windows must be closed)
NOTE: AVG scan may require an hour. Reboot Reboot your system in Normal Mode. Online Scan Perform an online scan with Internet Explorer with Panda ActiveScan
* Turn off the real time scanner of any existing antivirus program while performing the online scan Run findlop Extract the contents of fl.zip to a new folder on Desktop. Within the folder, locate & double-click fl.bat. It should produce a report at c:\findlop.txt. Post the contents of the report in your next reply. Logs required AVG Log Panda Log C:\findlop.txt HijackThis Log Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced only while in Normal Mode.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-05-2007, 08:22 PM
|
#5 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi.
I have a question.. The reason why I have 2 antivirus software is because AVG won't uninstall cleanly.. It will say "uninstall complete" but all of its files are still intact.. Will this really affect the fix procedures?..  P.S. Is this the right place to post this problem?.. |
|
|
|
|
05-06-2007, 08:27 AM
|
#6 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi
We can leave that for now. You'll likely need to re-install it before you can uninstall it. It won't affect anything we're doing here, so just carry on and follow my instructions.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-07-2007, 05:24 PM
|
#7 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
..Hello..
.. I have finished ur instructions and I gotta say that the 2 iexplore tasks are not there anymore.. Thnks a lot..  .. Anyway, attached are the files you wanted .. .. Please inform me if I have more problems w/ malware to take care of..
|
|
|
|
|
05-08-2007, 01:41 PM
|
#8 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi again
Looks better. Online Scan Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner Next Click on Kaspersky Online Scanner  A Welcome screen will appear - click 'Accept' at the bottom. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
Now under select a target to scan: Select My Computer
* Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%. Deckard's System Scanner - Download and Run Download Deckard's System Scanner (DSS) to your Desktop . Note: You must be logged onto an account with administrator privileges.
To attach a file to a new post, simply
Post back with Kaspersky Log main.txt and attach C:\Deckard\System Scanner\extra.txt
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-10-2007, 10:15 PM
|
#9 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
.. Hello again sir..
..The Deckard SS only displays the log "main.txt". It didn't display any "extra.txt".. Is this a problem?.. |
|
|
|
|
05-11-2007, 02:04 PM
|
#10 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi
No problem - the file extra.txt will be located here C:\Deckard\System Scanner\extra.txt Don't worry too much if you can't find it for now - just post the logs you have.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-11-2007, 10:24 PM
|
#11 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Ok.. As for now, I have the 2 logs. (Kaspersky and main.txt)
--Kaspersky Log-- ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, May 11, 2007 9:07:44 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 10/05/2007 Kaspersky Anti-Virus database records: 316356 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 91966 Number of viruses found: 16 Number of infected objects: 50 / 0 Number of suspicious objects: 0 Duration of the scan process: 04:57:53 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bis73.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\Documents and Settings\Administrator\Application Data\BearShare\Data\DataBase\DataDir\ContentDirs.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\BearShare\Data\DataBase\DataDir\ContentFile.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\BearShare\Data\DataBase\DataDir\DownloadFile.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\BearShare\Data\DataBase\DataDir\PartsHashes.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\BearShare\Data\DataBase\DataDir\Playlists.db Object is locked skipped C:\Documents and Settings\Administrator\Application Data\BearShare\Data\DataBase\LgDir\log.0000000126 Object is locked skipped C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007051120070512\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\~DF9A8B.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\~DF9A9B.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Application Data\BODYMEMOSCR\Bend atom type.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Downloads\RockXP4.exe/data.rar/RockXP4_.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Downloads\RockXP4.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Downloads\RockXP4.exe RarSFX: infected - 2 skipped C:\Essential drivers\BearShareV6int.exe/WISE0044.BIN/stream/data0005 Infected: not-a-virus:AdWare.Win32.Softomate.j skipped C:\Essential drivers\BearShareV6int.exe/WISE0044.BIN/stream Infected: not-a-virus:AdWare.Win32.Softomate.j skipped C:\Essential drivers\BearShareV6int.exe/WISE0044.BIN Infected: not-a-virus:AdWare.Win32.Softomate.j skipped C:\Essential drivers\BearShareV6int.exe WiseSFX: infected - 3 skipped C:\Essential drivers\BearShareV6int.exe WiseSFX Dropper: infected - 3 skipped C:\Essential drivers\mirc621.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\Essential drivers\mirc621.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\Essential drivers\mirc621.exe NSIS: infected - 2 skipped C:\Essential drivers\netpumper-1.50-setup-NP_0020.exe/data0079 Infected: Trojan.Win32.Obfuscated.en skipped C:\Essential drivers\netpumper-1.50-setup-NP_0020.exe Inno: infected - 1 skipped C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped C:\Program Files\Internet Explorer\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped C:\Program Files\NetPumper\ZM\minime.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{193D6F79-6490-4FE9-8379-ECAC28AE168E}\RP34\A0025544.exe/data.rar/RockXP4_.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\System Volume Information\_restore{193D6F79-6490-4FE9-8379-ECAC28AE168E}\RP34\A0025544.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\System Volume Information\_restore{193D6F79-6490-4FE9-8379-ECAC28AE168E}\RP34\A0025544.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{193D6F79-6490-4FE9-8379-ECAC28AE168E}\RP43\A0032055.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{193D6F79-6490-4FE9-8379-ECAC28AE168E}\RP43\A0032056.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{193D6F79-6490-4FE9-8379-ECAC28AE168E}\RP43\A0032208.exe Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\System Volume Information\_restore{193D6F79-6490-4FE9-8379-ECAC28AE168E}\RP45\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\f3PSSavr.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_654.dat Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_74c.dat Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. --Main.txt-- Deckard's System Scanner v20070426.43 Run by Administrator on 2007-05-11 at 13:12:31 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 1:12:33 PM, on 5/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\carpserv.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\BearShare Applications\BearShare\BearShare.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe C:\Documents and Settings\Administrator\Desktop\dss.exe C:\PROGRA~1\HIJACK~1\ADMINI~1.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Chikka] C:\Program Files\Chikka Messenger\Chikka v.4\\ChikkaLauncher.exe O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - Startup: Neverwinter Nights_ Platinum Edition Registration.lnk = C:\NeverwinterNights\NWN\ereg\ATR1.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZK O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- Files created between 2007-04-11 and 2007-05-11 ----------------------------- 2007-05-11 00:37:56 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-05-11 00:37:49 0 d-------- C:\WINDOWS\LastGood 2007-05-10 18:15:34 0 d-------- C:\Documents and Settings\Administrator\Application Data\FunWebProducts 2007-05-10 18:14:10 28672 --a------ C:\WINDOWS\system32\f3PSSavr.scr <Not Verified; FunWebProducts.com; Popular Screensavers> 2007-05-10 18:14:10 0 d-------- C:\Program Files\FunWebProducts 2007-05-10 18:14:02 0 d-------- C:\Program Files\MyWebSearch 2007-05-08 04:35:59 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-05-04 12:51:45 0 d-------- C:\Documents and Settings\LocalService\Application Data\BODYMEMOSCR 2007-05-04 12:29:16 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-04-30 15:30:24 0 d-------- C:\Documents and Settings\Administrator\Application Data\Microsoft Games 2007-04-30 15:29:09 0 d-------- C:\Program Files\GameSpy Arcade 2007-04-30 15:12:43 0 d-------- C:\Program Files\Microsoft Games 2007-04-29 12:02:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\Leadertech 2007-04-29 11:22:47 0 d-------- C:\NeverwinterNights 2007-04-26 23:38:23 0 d-------- C:\Program Files\Download Manager 2007-04-26 23:37:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\IGN_DLM 2007-04-25 22:55:09 0 d-------- C:\Documents and Settings\Administrator\Application Data\NetPumper 2007-04-25 22:54:57 0 d-------- C:\Program Files\NetPumper 2007-04-25 15:10:58 0 d-------- C:\logs 2007-04-25 15:10:52 0 d-------- C:\Documents and Settings\Administrator\ChikkaDefault 2007-04-25 15:10:33 0 d-------- C:\Program Files\Chikka Messenger 2007-04-25 08:20:47 0 d-------- C:\Program Files\Sierra On-Line 2007-04-25 08:20:45 0 d-------- C:\Sierra 2007-04-24 20:38:44 0 d-------- C:\Program Files\Infogrames Interactive 2007-04-24 19:22:53 0 --a------ C:\WINDOWS\PowerReg.dat 2007-04-24 11:42:15 0 d-------- C:\Documents and Settings\Administrator\Application Data\Hamachi 2007-04-24 11:41:26 0 d-------- C:\Program Files\Hamachi 2007-04-23 20:18:06 0 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2007-04-23 19:17:32 0 d-------- C:\WINDOWS\nview 2007-04-23 18:33:29 1216512 --a------ C:\Program Files\starcraft.exe <Not Verified; Blizzard Entertainment; StarCraft> 2007-04-23 18:24:08 967 --a------ C:\WINDOWS\ScUnin.pif 2007-04-23 18:24:08 35382 --a------ C:\WINDOWS\scunin.dat 2007-04-23 18:24:07 94208 --a------ C:\WINDOWS\ScUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller> 2007-04-23 18:19:07 0 d-------- C:\Program Files\Starcraft 2007-04-23 12:00:22 0 d-------- C:\Program Files\MagicISO 2007-04-22 12:31:07 4096 --a------ C:\WINDOWS\d3dx.dat 2007-04-22 12:14:54 0 d-------- C:\Program Files\Lionhead Studios Ltd 2007-04-18 11:51:10 0 d-------- C:\Program Files\Ubisoft 2007-04-17 22:01:07 0 d-------- C:\Program Files\mIRC 2007-04-14 21:12:11 0 d-------- C:\Program Files\Visual Boy Advance 2007-04-13 10:27:16 0 d-------- C:\WINDOWS\.jagex_cache_32 2007-04-13 10:26:57 0 d-------- C:\WINDOWS\Sun 2007-04-13 10:26:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2007-04-13 09:11:10 153751 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys 2007-04-13 09:10:34 4682 --a------ C:\WINDOWS\system32\npptNT2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT> 2007-04-13 08:49:52 0 d-------- C:\Program Files\Mobius 2007-04-12 23:20:10 0 d-------- C:\Program Files\cFosSpeed 2007-04-12 18:26:29 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2007-04-12 08:16:57 0 d-------- C:\Valve 2007-04-12 08:15:59 0 d-------- C:\Program Files\DAEMON Tools 2007-04-12 08:13:03 646392 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-04-12 07:38:40 20480 --a------ C:\WINDOWS\system32\wbload.dll 2007-04-12 07:38:39 36864 --a------ C:\WINDOWS\system32\wbsys.dll <Not Verified; Stardock.Net, Inc; WindowBlinds 4.x for x86 machines> 2007-04-12 07:38:37 0 d-------- C:\Program Files\Stardock 2007-04-11 23:29:32 0 d-------- C:\Program Files\RivaTuner v2.0 Final Release 2007-04-11 21:05:48 1744 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-04-11 19:47:45 1632 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-04-11 19:47:32 0 d-------- C:\Program Files\Project64 1.6 -- Find3M Report --------------------------------------------------------------- 2007-05-08 05:53:37 0 d-------- C:\Program Files\Google 2007-04-30 11:36:42 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-04-23 19:08:59 0 d-------- C:\Program Files\Common Files\InstallShield 2007-04-22 22:48:28 0 d-------- C:\Documents and Settings\Administrator\Application Data\BearShare 2007-04-22 17:20:22 0 d-------- C:\Program Files\Java 2007-04-18 00:16:11 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia 2007-04-13 09:13:42 0 d-------- C:\Program Files\BitComet 2007-04-10 10:17:02 0 d-------- C:\Program Files\Nvidia 2007-04-09 13:56:00 0 d-------- C:\Program Files\Diskeeper Corporation 2007-04-08 08:26:36 0 d-------- C:\Program Files\Eusing Free Registry Cleaner 2007-04-08 08:14:13 0 d-------- C:\Program Files\Messenger 2007-04-07 20:32:35 0 d-------- C:\Program Files\Setup 2007-04-07 11:38:51 0 d-------- C:\Program Files\Alwil Software 2007-04-07 11:05:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\Help 2007-04-07 11:00:17 0 d--h----- C:\Program Files\WindowsUpdate 2007-04-07 10:45:26 0 d-------- C:\Program Files\Movie Maker 2007-04-07 10:40:58 0 d-------- C:\Program Files\Windows NT 2007-04-07 10:09:02 592 --a------ C:\WINDOWS\chgkey.vbs 2007-04-07 10:01:17 0 d-------- C:\Program Files\WinAce 2007-04-07 09:21:40 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2007-04-07 00:53:28 0 d-------- C:\Program Files\Common Files\ODBC 2007-04-07 00:53:25 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-04-07 00:53:02 62 --ahs---- C:\Documents and Settings\Administrator\Application Data\desktop.ini 2007-04-06 21:27:41 0 d-------- C:\Program Files\LimeWire 2007-04-06 21:16:06 0 d-------- C:\Program Files\Common Files\Java 2007-04-06 21:01:18 0 d-------- C:\Program Files\Winamp 2007-04-06 20:42:43 0 d-------- C:\Program Files\BearShare Applications 2007-04-06 19:53:16 0 d-------- C:\Program Files\Combined Community Codec Pack 2007-04-06 19:47:12 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll <Not Verified; BitComet; BitComet BCTP Helper> 2007-04-06 19:32:57 0 d-------- C:\Documents and Settings\Administrator\Application Data\Google 2007-04-06 19:28:43 0 dr-h----- C:\Documents and Settings\Administrator\Application Data\yahoo! 2007-04-06 18:18:29 0 d-------- C:\Program Files\Yahoo! 2007-04-06 17:54:48 0 d-------- C:\Program Files\UIU 2007-04-06 17:54:05 0 d-------- C:\Program Files\CONEXANT 2007-04-06 17:49:40 0 d-------- C:\Program Files\Canon 2007-04-06 17:43:55 0 d-------- C:\Program Files\VIA Technologies, Inc 2007-04-06 17:35:19 0 d-------- C:\Program Files\Microsoft ActiveSync 2007-04-06 17:32:01 0 d-------- C:\Program Files\Common Files\L&H 2007-04-06 17:27:30 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2007-04-06 17:21:25 0 d-------- C:\Program Files\microsoft frontpage 2007-04-06 17:20:56 0 -rahs---- C:\MSDOS.SYS 2007-04-06 17:20:56 0 -rahs---- C:\IO.SYS 2007-04-06 17:20:56 0 --a------ C:\CONFIG.SYS 2007-04-06 17:20:56 0 --a------ C:\AUTOEXEC.BAT 2007-04-06 17:19:12 0 d-------- C:\Program Files\Online Services 2007-04-06 17:17:54 0 d-------- C:\Program Files\Common Files\MSSoap 2007-04-06 17:17:12 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-04-06 17:16:25 0 d-------- C:\Program Files\MSN Gaming Zone 2007-02-13 18:55:40 224256 --a------ C:\WINDOWS\system32\AutoFAT.exe <Not Verified; Diskeeper Corporation.; Diskeeper Corporation. Diskeeper (NT5 AutoFAT component 20070209)> 2007-02-13 18:55:32 185344 --a------ C:\WINDOWS\system32\AutoNTFS.exe <Not Verified; Diskeeper Corporation.; Diskeeper Corporation. Diskeeper (NT5 AutoNTFS component 20070209)> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {00A6FAF1-072E-44cf-8957-5838F569A31D} C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {07B18EA1-A523-4961-B6BB-170DE4475CCA} C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} C:\Program Files\Yahoo!\Common\yiesrvc.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "CARPService"="carpserv.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "cFosSpeed"="C:\\Program Files\\cFosSpeed\\cFosSpeed.exe" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "My Web Search Bar Search Scope Monitor"="\"C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\m3SrchMn.exe\" /m=2 /w" "MyWebSearch Email Plugin"="C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\mwsoemon.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "BitComet"="\"C:\\Program Files\\BitComet\\BitComet.exe\" /tray" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "Chikka"="C:\\Program Files\\Chikka Messenger\\Chikka v.4\\\\ChikkaLauncher.exe" "MyWebSearch Email Plugin"="C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\mwsoemon.exe" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="wbsys.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^PowerReg Scheduler.exe] "path"="C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup\\PowerReg Scheduler.exe" "backup"="C:\\WINDOWS\\pss\\PowerReg Scheduler.exeStartup" "location"="Startup" "command"="C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup\\PowerReg Scheduler.exe" "item"="PowerReg Scheduler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] "backup"="C:\\WINDOWS\\pss\\WinZip Quick Pick.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\WinZip\\WZQKPICK.EXE " "item"="WinZip Quick Pick" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="avgcc" "hkey"="HKLM" "command"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COALDARTEXITTONS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Wait Gram" "hkey"="HKLM" "command"="C:\\Documents and Settings\\All Users\\Application Data\\Flaw Rdr Coal Dart\\Wait Gram.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DLM" "hkey"="HKCU" "command"="C:\\Program Files\\Download Manager\\DLM.exe /windowsstart /startifwork" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MapiPoll] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Bend atom type" "hkey"="HKCU" "command"="C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\BODYME~1\\Bend atom type.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetPumper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NetPumperIEProxy" "hkey"="HKLM" "command"="\"C:\\Program Files\\NetPumper\\NetPumperIEProxy.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Steam" "hkey"="HKCU" "command"="C:\\Valve\\Steam\\Steam.exe -silent" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D] Shell\AutoRun\command D:\RoNsetup.exe /autorun [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c84dc3d1-e459-11db-8a88-806d6172696f}] Shell\AutoRun\command D:\RoNsetup.exe /autorun [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cde24a41-f18c-11db-8109-000e2e802d90}] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd349752-e88a-11db-80fe-000e2e802d90}] Shell\AutoRun\command E:\autorun.exe -- End of Deckard's System Scanner: finished at 2007-05-11 at 13:13:04 --------- 
|
|
|
|
|
05-12-2007, 08:40 AM
|
#12 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi again
Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below. Registry Fix Click on the zip file attached to this post to open and extract the file nba.reg to your desktop. Double click on the file nba.reg to run it. Answer yes to any prompts and allow it to merge into the Registry. Reboot Reboot your system in Safe Mode.
Uninstall Programmes Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present): FunWebProducts MyWebSearch HijackThis Entries Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any) R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe Please remember to close all other windows, including browsers then click Fix checked. File Deletions Delete the following Folders indicated in BLUE if they still exist. C:\Program Files\MyWebSearch C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\APPLICATION DATA\BODYME~1 <- - Look for the folder name that starts BODYME C:\Documents and Settings\All Users\Application Data\Flaw Rdr Coal Dart C:\Documents and Settings\Administrator\Application Data\FunWebProducts C:\Program Files\FunWebProducts Reboot Reboot your system in Normal Mode. Please download combofix.exe to your desktop. Alternate link. IMPORTANT - You must place combofix on your desktop!! Double click combofix.exe & follow the prompts. When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall. Post back with c:\combofix.txt and a fresh HijackThis Log.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner Last edited by Glaswegian; 03-27-2008 at 03:11 PM. |
|
|
|
|
05-13-2007, 12:52 PM
|
#13 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi again..
I couldn't delete the folder C:\Program Files\MyWebSearch ( It says somethin about bein write protected).. Other than that I didn't have any problems. Here are the logs.. --ComboFix log-- "Administrator" - 2007-05-14 3:36:01 Service Pack 2 ComboFix 07-05.13.V - Running from: "C:\Documents and Settings\Administrator\Desktop\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-14 )))))))))))))))))))))))))))))))))) 2007-05-14 03:18 381,012 --a------ C:\Program Files\Uninstall Fun Web Products.dll 2007-05-11 13:12 <DIR> d-------- C:\Deckard 2007-05-11 00:37 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-05-10 18:14 <DIR> d-------- C:\Program Files\MyWebSearch 2007-05-08 04:35 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-05-07 11:46 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-05-04 12:51 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\BODYMEMOSCR 2007-05-04 12:29 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-04-30 15:30 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft Games 2007-04-30 15:29 <DIR> d-------- C:\Program Files\GameSpy Arcade 2007-04-30 15:12 <DIR> d-------- C:\Program Files\Microsoft Games 2007-04-29 12:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Leadertech 2007-04-29 11:22 <DIR> d-------- C:\NeverwinterNights 2007-04-26 23:38 <DIR> d-------- C:\Program Files\Download Manager 2007-04-26 23:37 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\IGN_DLM 2007-04-25 22:55 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\NetPumper 2007-04-25 22:54 <DIR> d-------- C:\Program Files\NetPumper 2007-04-25 15:10 <DIR> d-------- C:\Program Files\Chikka Messenger 2007-04-25 15:10 <DIR> d-------- C:\logs 2007-04-25 15:10 <DIR> d-------- C:\DOCUME~1\ADMINI~1\ChikkaDefault 2007-04-25 08:20 <DIR> d-------- C:\Sierra 2007-04-25 08:20 <DIR> d-------- C:\Program Files\Sierra On-Line 2007-04-24 20:38 <DIR> d-------- C:\Program Files\Infogrames Interactive 2007-04-24 19:22 0 --a------ C:\WINDOWS\PowerReg.dat 2007-04-24 11:42 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Hamachi 2007-04-24 11:41 26,056 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-04-24 11:41 <DIR> d-------- C:\Program Files\Hamachi 2007-04-23 20:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles 2007-04-23 19:17 176,128 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-04-23 19:17 <DIR> d-------- C:\WINDOWS\nview 2007-04-23 18:33 1,216,512 --a------ C:\Program Files\starcraft.exe 2007-04-23 18:24 967 --a------ C:\WINDOWS\ScUnin.pif 2007-04-23 18:24 94,208 --a------ C:\WINDOWS\ScUnin.exe 2007-04-23 18:24 35,382 --a------ C:\WINDOWS\scunin.dat 2007-04-23 18:19 <DIR> d-------- C:\Program Files\Starcraft 2007-04-23 12:00 <DIR> d-------- C:\Program Files\MagicISO 2007-04-22 12:31 4,096 --a------ C:\WINDOWS\d3dx.dat 2007-04-22 12:14 <DIR> d-------- C:\Program Files\Lionhead Studios Ltd 2007-04-18 11:51 <DIR> d-------- C:\Program Files\Ubisoft 2007-04-17 22:01 <DIR> d-------- C:\Program Files\mIRC 2007-04-14 21:12 <DIR> d-------- C:\Program Files\Visual Boy Advance (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-13 19:37:55 -------- d-----w C:\Program Files\cFosSpeed 2007-05-13 05:59:39 1,632 ----a-w C:\WINDOWS\system32\d3d8caps.dat 2007-05-11 14:57:05 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\BearShare 2007-05-07 21:53:37 -------- d-----w C:\Program Files\Google 2007-05-07 21:53:24 -------- d-----w C:\Program Files\DAEMON Tools 2007-05-04 04:29:16 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-30 03:39:12 1,744 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-04-30 03:36:42 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-04-24 07:49:27 153,751 ----a-w C:\WINDOWS\system32\drivers\dump_wmimmc.sys 2007-04-23 11:08:59 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-18 04:16:54 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-04-13 01:13:42 -------- d-----w C:\Program Files\BitComet 2007-04-13 00:49:52 -------- d-----w C:\Program Files\Mobius 2007-04-12 00:13:04 646,392 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-11 23:38:37 -------- d-----w C:\Program Files\Stardock 2007-04-11 15:29:47 -------- d-----w C:\Program Files\RivaTuner v2.0 Final Release 2007-04-11 12:59:39 -------- d-----w C:\Program Files\Project64 1.6 2007-04-10 02:17:02 -------- d-----w C:\Program Files\Nvidia 2007-04-09 05:56:00 -------- d-----w C:\Program Files\Diskeeper Corporation 2007-04-08 00:26:36 -------- d-----w C:\Program Files\Eusing Free Registry Cleaner 2007-04-08 00:14:13 -------- d-----w C:\Program Files\Messenger 2007-04-07 12:32:35 -------- d-----w C:\Program Files\Setup 2007-04-07 03:38:51 -------- d-----w C:\Program Files\Alwil Software 2007-04-07 03:05:17 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Help 2007-04-07 03:00:17 -------- d--h--w C:\Program Files\WindowsUpdate 2007-04-07 02:45:26 -------- d-----w C:\Program Files\Movie Maker 2007-04-07 02:40:58 -------- d-----w C:\Program Files\Windows NT 2007-04-07 02:09:02 592 ----a-w C:\WINDOWS\chgkey.vbs 2007-04-07 02:01:17 -------- d-----w C:\Program Files\WinAce 2007-04-06 16:53:28 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-06 16:53:25 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-06 13:27:41 -------- d-----w C:\Program Files\LimeWire 2007-04-06 13:01:18 -------- d-----w C:\Program Files\Winamp 2007-04-06 12:42:43 -------- d-----w C:\Program Files\BearShare Applications 2007-04-06 12:24:43 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2007-04-06 12:24:43 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2007-04-06 11:53:16 -------- d-----w C:\Program Files\Combined Community Codec Pack 2007-04-06 11:47:12 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll 2007-04-06 11:32:57 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Google 2007-04-06 11:28:43 -------- d--h--r C:\DOCUME~1\ADMINI~1\APPLIC~1\yahoo! 2007-04-06 10:18:29 -------- d-----w C:\Program Files\Yahoo! 2007-04-06 09:54:48 -------- d-----w C:\Program Files\UIU 2007-04-06 09:54:05 -------- d-----w C:\Program Files\CONEXANT 2007-04-06 09:49:40 -------- d-----w C:\Program Files\Canon 2007-04-06 09:43:55 -------- d-----w C:\Program Files\VIA Technologies, Inc 2007-04-06 09:35:19 -------- d-----w C:\Program Files\Microsoft ActiveSync 2007-04-06 09:32:01 -------- d-----w C:\Program Files\Common Files\L&H 2007-04-06 09:21:25 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-06 09:20:56 0 --sha-r C:\MSDOS.SYS 2007-04-06 09:20:56 0 --sha-r C:\IO.SYS 2007-04-06 09:20:56 0 ----a-w C:\CONFIG.SYS 2007-04-06 09:20:56 0 ----a-w C:\AUTOEXEC.BAT 2007-04-06 09:19:12 -------- d-----w C:\Program Files\Online Services 2007-04-06 09:17:54 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-06 09:17:12 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-06 09:16:25 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-03-13 09:30:28 649,432 ----a-r C:\WINDOWS\system32\drivers\cfosspeed.sys 2007-03-13 09:30:26 281,816 ----a-w C:\WINDOWS\system32\cfosspeed.dll 2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-13 10:55:40 224,256 ----a-w C:\WINDOWS\system32\AutoFAT.exe 2007-02-13 10:55:32 185,344 ----a-w C:\WINDOWS\system32\AutoNTFS.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 10:28] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll [2007-03-29 22:31] {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 15:29] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar1.dll [2007-04-06 19:10] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "CARPService"="carpserv.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "cFosSpeed"="C:\\Program Files\\cFosSpeed\\cFosSpeed.exe" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CARPService"="carpserv.exe" [2002-12-04 17:55 C:\WINDOWS\system32\carpserv.exe]) "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 23:42] "cFosSpeed"="C:\Program Files\cFosSpeed\cFosSpeed.exe" [2007-03-13 17:30] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:56] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16] "nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe]) "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-04-01 16:16] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 20:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-03-27 15:22] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-04-06 19:10] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-04-04 02:04] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 18:48] "Chikka"="C:\Program Files\Chikka Messenger\Chikka v.4\\ChikkaLauncher.exe" [2006-11-13 10:55] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "BitComet"="\"C:\\Program Files\\BitComet\\BitComet.exe\" /tray" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "Chikka"="C:\\Program Files\\Chikka Messenger\\Chikka v.4\\\\ChikkaLauncher.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 22:13] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="wbsys.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^administrator^start menu^programs^startup^powerreg scheduler.exe C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PowerReg Scheduler.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users^start menu^programs^startup^microsoft office.lnk C:\PROGRA~1\MICROS~2\Office10\OSA.EXE -b -l HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users^start menu^programs^startup^winzip quick pick.lnk C:\PROGRA~1\WinZip\WZQKPICK.EXE HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avg7_cc C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs "C:\Program Files\Messenger\msmsgs.exe" /background HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\netpumper "C:\Program Files\NetPumper\NetPumperIEProxy.exe" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\steam C:\Valve\Steam\Steam.exe -silent [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D] Shell\AutoRun\command D:\RoNsetup.exe /autorun [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cde24a41-f18c-11db-8109-000e2e802d90}] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20070508-014952-712 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = backup-20070508-014952-629 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-14 03:40:38 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-14 3:41:07 C:\ComboFix-quarantined-files.txt ... 2007-05-14 03:41 --HijackThis Log-- Logfile of HijackThis v1.99.1 Scan saved at 3:50:18 AM, on 5/14/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\carpserv.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Chikka] C:\Program Files\Chikka Messenger\Chikka v.4\\ChikkaLauncher.exe O4 - Startup: Neverwinter Nights_ Platinum Edition Registration.lnk = C:\NeverwinterNights\NWN\ereg\ATR1.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZK O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe |
|
|
|
|
05-13-2007, 01:25 PM
|
#14 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi again
Good work. Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\Program Files\Uninstall Fun Web Products.dll C:\Program Files\MyWebSearch Note: If they resist, you may have to boot to Safe Mode to delete them. If MyWebSearch still refuses to go, open the folder and delete any files inside first. Choose any one of the following online scanners, run a scan, and post back with any log produced. http://housecall.trendmicro.com/ <- - you can use Firefox for this scanner http://www3.ca.com/virusinfo/virusscan.aspx http://www.bitdefender.com/scan8/ie.html http://us.mcafee.com/root/mfs/default.asp http://security.symantec.com/sscv6/d...d=ie&venid=sym Let me know how your system is running now and if the MyWebSearch folder refuses to delete.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-15-2007, 07:01 PM
|
#15 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
..Hi..
I used BitDefender and I got its virus report.. BitDefender Online Scanner - Real Time Virus Report Generated at: Wed, May 16, 2007 - 07:57:34 -------------------------------------------------------------------------------- Scan Info Scanned Files 405731 Infected Files 1 Virus Detected Trojan.FatObfus.Gen 1 -------------------------------------------------------------------------------- This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world. |
|
|
|
|
05-16-2007, 12:02 PM
|
#16 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi
Did you manage to delete the MyWebSearch folder? How are things running now?
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-16-2007, 08:58 PM
|
#17 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Yup. I was able to delete the MyWebSearch folder.
Things here are okay since the iexplore tasks that were stealing my resources are gone now..Thnx 4 d help man...
|
|
|
|
|
05-17-2007, 01:07 PM
|
#18 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi again
All your logs are indeed clean. Any more problems? If not we’ll just tidy up and I’ll let you go, along with my recommendations for staying safe and secure. You can go ahead and delete any special tools we used (SmitRem, SmitfraudFix, ComboFix, DSS etc). They won't serve a future purpose and are replaced with updated versions frequently, so the copies you have are probably already out of date and there is therefore no need to keep them. Reset Hidden/System Files To reset your hidden and system files:
System Restore To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK. To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK. This will create a new Restore Point. Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs: Spyware Blaster to help prevent spyware from installing in the first place. Spyware Guard to catch and block spyware before it can execute. Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here. Ad-aware Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here. IE-SPYAD IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here. SnoopFree SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen. Note that SnoopFree is only for XP systems. MVPS Hosts File The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Firefox Opera Maxthon Firewalls A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use: Comodo Personal Firewall Sygate Personal Firewall ZoneAlarm Anti Virus Software It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial Here are three very good free Antivirus products which are available: BitDefender Free Avast! AVG It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. Other Protection Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles PC Safety & Security - What Do I Need?. Making Internet Explorer Safer. Keep clean and safe and enjoy your computing! Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
05-19-2007, 08:07 PM
|
#19 (permalink) |
|
Registered User
Join Date: Apr 2007
Location: Zamboanga City, Philippines
Posts: 14
OS: Windows XP Professional
|
Re: Help needed - 2 annoying iexplore.exe tasks...
Hi
My PC is in top shape & I'm following ur preventive measures now... Many Many Thnx 4 d help man... 
|
|
|
|
| Thread Tools | |
|
|
located at the bottom of the page.
then click 
