HijackThis Log File - Edifiz

edifiz · 07-04-2007, 01:43 PM

Hi

- There seems to be a problem in my computer of late ie it started from past 2-3 days. I was working on my yahoo msgr n added couple of 'friends' ... Suddenly the msgr stopped running giving some error. When i started the Ymsgr again i got a msg at the bottom of my screen 'system registry changed' or something to this effect. Since then my comp started running a bit slow. I am not sure if my comp is hacked or what ? I would like to know can someone keep a track of the activites happening in my yahoo msgr or computer in general. Am i just being paranoid or is it possible that a third party can keep track of the activities on my computer.

- Every time i start my computer i get a Windows Defender Message box with the following message

Application failed to initialize:0x800106ba. A problem caused Windows Defender Service to stop. To start the service, restart your computer or search Help and Support on how to start a service manually.

Sorry for troubling you all and I thank you in advance.

Regards

Main.txt

Deckard's System Scanner v20070611.50
Run by Owner on 2007-07-04 at 15:23:56
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
57: 2007-07-04 19:24:19 UTC - RP1227 - Deckard's System Scanner Restore Point
56: 2007-07-03 14:39:17 UTC - RP1226 - System Checkpoint
55: 2007-07-02 03:32:05 UTC - RP1225 - System Checkpoint
54: 2007-07-01 02:38:07 UTC - RP1224 - System Checkpoint
53: 2007-06-30 01:24:49 UTC - RP1223 - System Checkpoint

-- First Restore Point --
1: 2007-05-03 19:25:49 UTC - RP1171 - System Checkpoint

Backed up registry hives.

Performed disk cleanup.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-07-04 15:27:54
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16473)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Virus Protection\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\TSF\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/?.home=msgr
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: PnIEBrowserHelperObj Class - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Virus Protection\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [IridiumTimeWizard] D:\My Documents\rupa\tp\iridium.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Virus Protection\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [FreeCall] "C:\program files\freecall.com\freecall\freecall.exe" -nosplash -minimized
O4 - HKCU\..\Run: [12Voip] "C:\Program Files\12Voip.com\12Voip\12Voip.exe" -nosplash -minimized
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: Yahoo! Freecell Solitaire () - http://presence.games.yahoo.com/yog/y/fs10_x.cab
O16 - DPF: Yahoo! MahJong Solitaire () - http://download.games.yahoo.com/game.../y/mjst4_x.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} () - http://download.abacast.com/download...basetup161.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{87126DBE-0C47-43B0-93FB-2408B31B1FC1}: NameServer = 207.69.188.185,207.69.188.186
O18 - Protocol: bw+0 - {459f93be-477c-45ac-b9bd-1f010c483399} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: offline-8876480 - {459F93BE-477C-45AC-B9BD-1F010C483399} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - Unknown owner - "C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 OMCI - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S3 Boonty Games - "c:\program files\common files\boonty shared\service\boonty.exe" (file missing)

-- Scheduled Tasks -------------------------------------------------------------

2007-07-04 15:20:19 412 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job
2007-06-24 16:38:56 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-06-04 02:16:01 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job

-- Files created between 2007-06-04 and 2007-07-04 -----------------------------

2007-07-04 10:00:35 0 d-------- C:\WINDOWS\LastGood
2007-07-04 09:16:15 0 d-------- C:\TSF
2007-07-03 19:19:40 0 dr-h----- C:\Documents and Settings\Owner\Recent
2007-06-24 16:38:52 0 d-------- C:\Program Files\Apple Software Update
2007-06-22 22:08:57 0 d-------- C:\Documents and Settings\All Users\Application Data\JollyBear
2007-06-17 12:40:58 0 d-------- C:\Documents and Settings\Owner\Application Data\12Voip
2007-06-16 08:43:16 0 d-------- C:\Program Files\iCall
2007-06-09 21:01:13 0 d-------- C:\Program Files\Ipwindows
2007-06-09 21:01:13 0 d-------- C:\Program Files\InetGet2

-- Find3M Report ---------------------------------------------------------------

2007-07-04 14:03:22 0 d-------- C:\Program Files\Windows Defender
2007-07-04 14:02:16 0 d-------- C:\Program Files\SpywareGuard
2007-07-04 14:01:42 0 d-------- C:\Program Files\QuickTime
2007-07-04 13:53:20 0 d-------- C:\Program Files\iTunes
2007-07-04 13:50:46 0 d-------- C:\Program Files\FinePixViewer
2007-07-04 13:50:34 0 d-------- C:\Program Files\EarthLink TotalAccess
2007-07-04 09:56:13 0 d-------- C:\Program Files\iWin Games
2007-07-04 09:04:31 0 d-------- C:\Program Files\Yahoo! Games
2007-07-04 08:55:14 0 d-------- C:\Program Files\Winamp
2007-06-28 10:44:42 0 d-------- C:\Documents and Settings\Owner\Application Data\Skype
2007-06-24 16:42:46 0 d-------- C:\Program Files\iPod
2007-06-06 17:48:49 0 d-------- C:\Documents and Settings\Owner\Application Data\Adobe
2007-06-03 16:00:05 0 d-------- C:\Program Files\BitLord
2007-05-20 13:08:32 0 d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2007-05-19 22:21:02 0 d-------- C:\Program Files\ReflexiveArcade
2007-05-18 15:17:37 0 d-------- C:\Documents and Settings\Owner\Application Data\FloodLightGames
2007-05-09 07:30:37 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-04 23:28:03 0 d-------- C:\Documents and Settings\Owner\Application Data\FreeCall

-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{4A368E80-174F-4872-96B5-0B27DDD11DB2} C:\Program Files\SpywareGuard\dlprotect.dll
{4B5F2E08-6F39-479a-B547-B2026E4C7EDF} C:\Program Files\EarthLink TotalAccess\PnEL.dll
{53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Virus Protection\Spybot - Search & Destroy\SDHelper.dll
{9394EDE7-C8B5-483E-8773-474BF36AF6E4} C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"
"mmtask"="\"C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe\""
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"IridiumTimeWizard"="D:\\My Documents\\rupa\\tp\\iridium.exe"
"SpybotSD TeaTimer"="C:\\Program Files\\Virus Protection\\Spybot - Search & Destroy\\TeaTimer.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
"FreeCall"="\"C:\\program files\\freecall.com\\freecall\\freecall.exe\" -nosplash -minimized"
"12Voip"="\"C:\\Program Files\\12Voip.com\\12Voip\\12Voip.exe\" -nosplash -minimized"
"E6TaskPanel"="\"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe\" -winstart"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert"="C:\\Program Files\\Symantec\\LiveUpdate\\ALUNotify.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ http://us.f208.mail.yahoo.com/ym/Sho...&view=a&head=b

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hkcmd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\hkcmd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\igfxtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

-- End of Deckard's System Scanner: finished at 2007-07-04 at 15:29:07 ---------

Also i wasnt able to run Step 4 of the 5 Step Process. I got the following message.

Setup has detected that the Service Pack version of the system installed is newer than the update you are applying to it.
You can only install this update on Service Pack 1.

edifiz · 07-04-2007, 01:44 PM

Incident Status Location

Adware:adware/outerinfo Not disinfected Windows Registry
Spyware:spyware/shopnav Not disinfected Windows Registry
Spyware:spyware/clientman Not disinfected Windows Registry
Adware:adware/rxtoolbar Not disinfected Windows Registry
Adware:adware/transponder Not disinfected Windows Registry
Adware:adware/zsearch Not disinfected Windows Registry
Adware:adware/sidesearch Not disinfected Windows Registry
Adware:adware/flashtrack Not disinfected Windows Registry
Adware:Adware/PurityScan Not disinfected C:\4FB.tmp[¦++\Yazzle1552OinAdmin.exe]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@apmebf[2].txt
Spyware:Cookie/OfferOptimizer Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@offeroptimizer[1].txt
Spyware:Cookie/OfferOptimizer Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@offeroptimizer[3].txt
Spyware:Cookie/Rightmedia Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@rightmedia[1].txt
Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@tickle[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Cookies\owner@com[1].txt
Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Owner\Local Settings\Temp\sdexe.exe
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Rupa\Cookies\rupa@apmebf[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Rupa\Cookies\rupa@atdmt[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Rupa\Cookies\rupa@perf.overture[1].txt
Adware:Adware/DollarRevenue Not disinfected C:\Program Files\Common Files\{3018F0D7-07CA-1033-0826-020409200001}\Uninst.exe
Adware:Adware/Maxifiles Not disinfected C:\Program Files\Common Files\{B018F0D7-07CA-1033-0826-020409200001}\services.dll
Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\6C901D50-2D65-46BF-9493-B98F14
Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\871350F8-4A13-40F7-897F-E05C8F
Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\FB5EED50-C92F-4F5E-A256-A1E54D
Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\FC0E4DDF-B929-4E85-A3CA-4D3723
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\02CA684E-DD42-418A-98DC-6D7142
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\036AFBE3-2FC5-4B2C-9520-FD1E99
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\05D97AE4-AAF7-4DE3-91D5-E62F42
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\0B90EB3B-FA59-44F2-BAE3-1AC2C0
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\1182EB76-8E49-4B31-B3CF-B4F81A
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\33EB0D65-B83A-40DA-AAB7-D329CA
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\41D5F93A-538F-4CC4-A9DD-3C4390
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\4C9986D0-D509-429E-861D-7A6684
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\56BEA6AD-1066-4F96-B20F-6A519E
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\652699A5-310D-4A20-9DFF-DF80EA
Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\F17B65BA-4C6D-4F35-9982-6BAB68
Spyware:Cookie/Maxserving Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1A.tmp
Spyware:Cookie/RealMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1D.tmp
Adware:Adware/DelFinMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1D2.tmp\vmstmp.exe
Adware:Adware/IPInsight Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1DB.tmp
Spyware:Cookie/RealMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq21B.tmp
Spyware:Cookie/Belnk Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq53.tmp
Spyware:Cookie/Belnk Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq54.tmp
Spyware:Cookie/Maxserving Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9.tmp
Spyware:Cookie/RealMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9F.tmp
Adware:Adware/Maxifiles Not disinfected C:\WINDOWS\b122.exe
Virus:Trj/Downloader.OLY Disinfected C:\WINDOWS\retadpu72.exe
Virus:Trj/Banker.FWD Disinfected C:\WINDOWS\system32\mpeg4dec0.dll
Virus:Trj/Banker.FQH Disinfected C:\WINDOWS\system32\wzip32.exe

edifiz · 07-07-2007, 10:35 AM

*bump*

edifiz · 07-09-2007, 05:28 PM

y is my query not being addressed ??? i noticed that the ones posted after mine r being looked into ??

can i atleast knw the reason y mines not being addressed ??

Clark76 · 07-10-2007, 07:44 AM

Hello and Welcome. Apologies for any delay in replying, but we have been rather busy lately.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p

Please be patient with me during this time.

You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

edifiz · 07-10-2007, 07:54 AM

thank you soo much ... yeah i will b patient :)

Clark76 · 07-10-2007, 09:13 AM

Hello again

Quote:

I would like to know can someone keep a track of the activites happening in my yahoo msgr or computer in general. Am i just being paranoid or is it possible that a third party can keep track of the activities on my computer.

It is quite possible. That is the exact reason some malware is written. Now lets clean your system.

Please stay with me until I declare you clean.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

==========

P2P - I see you have P2P software <Limewire and Bitlord> installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

==========

Download ComboFix from here
http://download.bleepingcomputer.com...a/ComboFix.exe

**Save it directly to your desktop**

==========

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent certain tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.

Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode" if not already selected.
Choose "Yes" at the Warning prompt.
Expand the "Tools" menu.
Click "Resident".
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
In the File menu click "Exit" to exit Spybot Search & Destroy.

---------

Please disable Spywareguard, as it may hinder the removal of some entries. You can re-enable it after you're clean.

Right click the running icon of Spywareguard located in the system tray
Go to Menu > File > Exit and confirm the programs close.

=========

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you located here - C:\ComboFix.txt Post that log in your next reply

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

edifiz · 07-10-2007, 07:51 PM

"Owner" - 2007-07-10 21:44:09 - ComboFix 07-07-10.5 - Service Pack 2

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Owner\MYDOCU~1.\smbols~1
C:\Program Files\Common Files\{3018F~1
C:\Program Files\Common Files\{3018F~1\Uninst.exe
C:\Program Files\Common Files\{B018F~1
C:\Program Files\Common Files\{B018F~1\services.dll
C:\Program Files\Common Files\uninstall information
C:\Program Files\inetget2
C:\Program Files\ipwindows
C:\WINDOWS\b122.exe
C:\WINDOWS\curity~1
C:\WINDOWS\hosts
C:\WINDOWS\wr.txt

((((((((((((((((((((((((( Files Created from 2007-06-11 to 2007-07-11 )))))))))))))))))))))))))))))))

2007-07-10 21:43 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-07 06:28 <DIR> d-------- C:\Program Files\Peterson's
2007-07-06 21:22 <DIR> d-------- C:\DOCUME~1\Owner\.javaws
2007-07-06 21:18 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-07-04 15:23 <DIR> d-------- C:\Deckard
2007-07-04 09:16 <DIR> d-------- C:\TSF
2007-06-24 16:38 <DIR> d-------- C:\Program Files\Apple Software Update
2007-06-22 22:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
2007-06-17 12:40 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\12Voip
2007-06-16 08:43 <DIR> d-------- C:\Program Files\iCall

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-07 01:32:12 335 ----a-w C:\WINDOWS\nsreg.dat
2007-07-07 01:22:17 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-04 18:03:22 -------- d-----w C:\Program Files\Windows Defender
2007-07-04 18:02:16 -------- d-----w C:\Program Files\SpywareGuard
2007-07-04 18:01:42 -------- d-----w C:\Program Files\QuickTime
2007-07-04 17:53:20 -------- d-----w C:\Program Files\iTunes
2007-07-04 17:50:46 -------- d-----w C:\Program Files\FinePixViewer
2007-07-04 17:50:34 -------- d-----w C:\Program Files\EarthLink TotalAccess
2007-07-04 13:56:13 -------- d-----w C:\Program Files\iWin Games
2007-07-04 13:04:31 -------- d-----w C:\Program Files\Yahoo! Games
2007-07-04 12:55:14 -------- d-----w C:\Program Files\Winamp
2007-06-28 14:44:42 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Skype
2007-06-24 20:42:46 -------- d-----w C:\Program Files\iPod
2007-05-20 17:08:32 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\GetRightToGo
2007-05-20 02:21:02 -------- d-----w C:\Program Files\ReflexiveArcade
2007-05-18 19:17:37 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\FloodLightGames
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
2006-10-26 11:28 440384 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-01-12 20:38 63128 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2}]
2003-08-02 23:24 192512 -ra------ C:\Program Files\SpywareGuard\dlprotect.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B5F2E08-6F39-479a-B547-B2026E4C7EDF}]
2003-12-08 16:26 401408 --a------ C:\Program Files\EarthLink TotalAccess\PnEL.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\PROGRA~1\VIRUSP~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
2004-08-13 18:42 155648 --a------ C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
2006-01-17 16:04 282624 --a------ C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 18:12]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-21 21:01]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 23:32]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2005-03-15 09:58]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 18:07]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-07-12 22:28]
"IridiumTimeWizard"="D:\My Documents\rupa\tp\iridium.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 22:49]
"FreeCall"="C:\program files\freecall.com\freecall\freecall.exe" []
"12Voip"="C:\Program Files\12Voip.com\12Voip\12Voip.exe" []
"E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2003-12-08 15:51]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 10:13]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3b67d10-7fba-11db-bbbd-00c0a8895ef3}]
AutoRun\command- wd_windows_tools\setup.exe

Contents of the 'Scheduled Tasks' folder
2007-06-24 20:38:56 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-04 06:16:01 C:\WINDOWS\tasks\MP Scheduled Scan.job
2007-07-11 00:27:14 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-10 21:48:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-10 21:49:16
C:\ComboFix-quarantined-files.txt ... 2007-07-10 21:48

--- E O F ---

Clark76 · 07-10-2007, 09:43 PM

Please clear out your Yahoo Quarantine folder – C:\Program Files\Yahoo!\YPSR\ Quarantine – Note: just empty the folder, do not delete the folder.

Then clear out your Microsoft AntiSpyware Quarantine folder - C:\Program Files\Microsoft AntiSpyware\ Quarantine – Note: just empty the folder, do not delete the folder.

=============

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

edifiz · 07-11-2007, 09:53 AM

i didnt find any 'Save as Text' button once the scan was done .. I am trying once again .. will let u knw soon ...

thanks

Clark76 · 07-11-2007, 10:31 AM

See if this helps:

edifiz · 07-11-2007, 11:21 AM

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, July 11, 2007 1:19:42 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 11/07/2007
Kaspersky Anti-Virus database records: 361185
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 86054
Number of viruses found: 14
Number of infected objects: 34
Number of suspicious objects: 0
Duration of the scan process: 01:46:32

Infected Object Name / Virus Name / Last Action
C:\4FB.tmp/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\4FB.tmp NSIS: infected - 1 skipped
C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\ye_dil_mange_more.exe Infected: not-virus:BadJoke.Win32.Delf.h skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012007071120070712\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_31c.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_870.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\~DF3D3B.tmp Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\BWDocMap.pht Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\BWInfopakMap.pht Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chandir.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chandir.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chn.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chn.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\D0000000.FCS Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\inuse.txt Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\L0000014.FCS Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\main.log Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_die.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_die.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_ext.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_ext.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\storydb.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\storydb.idx Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\billing_Owner.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\client_Owner.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\network_Owner.log Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\{B018F~1\services.dll.vir Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream/data0002 Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir NSIS: infected - 3 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc1.tmp\vmstmp.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.c skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc131\FC0E4DDF-B929-4E85-A3CA-4D3723/mySetp.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.o skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc131\FC0E4DDF-B929-4E85-A3CA-4D3723 CAB: infected - 1 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\02CA684E-DD42-418A-98DC-6D7142 Infected: not-a-virus:AdWare.Win32.Gator.6051 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\036AFBE3-2FC5-4B2C-9520-FD1E99 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\05D97AE4-AAF7-4DE3-91D5-E62F42 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\0B90EB3B-FA59-44F2-BAE3-1AC2C0 Infected: not-a-virus:AdWare.Win32.Gator.5017 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\1182EB76-8E49-4B31-B3CF-B4F81A Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\33EB0D65-B83A-40DA-AAB7-D329CA Infected: not-a-virus:AdWare.Win32.Gator.5017 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\41D5F93A-538F-4CC4-A9DD-3C4390 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\4C9986D0-D509-429E-861D-7A6684 Infected: not-a-virus:AdWare.Win32.Gator.3124 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\56BEA6AD-1066-4F96-B20F-6A519E Infected: not-a-virus:AdWare.Win32.Gator.5017 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\652699A5-310D-4A20-9DFF-DF80EA Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped
C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\F17B65BA-4C6D-4F35-9982-6BAB68 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094586.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094587.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094588.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094718.dll Infected: not-a-virus:AdWare.Win32.AdMedia.g skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094741.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094742.dll Infected: Trojan-Spy.Win32.Banker.cmd skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094743.exe Infected: Trojan-Downloader.Win32.Banload.aoo skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095298.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

edifiz · 07-11-2007, 11:22 AM

thanks i got it :)

Clark76 · 07-12-2007, 04:40 AM

Almost there

Please empty you Recycle Bin

============

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/165442-hijackthis-log-file-edifiz.html#post977140

Collect::
C:\4FB.tmp

Save this as "CFScript"

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Additonally, ComboFix will generate a zipped file on your desktop called Submit [Date Time].zip
Please submit this file to:

http://www.bleepingcomputer.com/subm....php?channel=4

Please include a link to this topic in the message.

==========

Run Deckard's System Scanner (DSS) again

Close all applications and windows.
Double-click on DSS.exe to run it, and follow the prompts.
When the scan is complete, one text file will open - main.txt
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt in your reply.

edifiz · 07-12-2007, 07:31 AM

"Owner" - 2007-07-12 9:22:01 - ComboFix 07-07-10.5 - Service Pack 2
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\4FB.tmp

((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))

2007-07-11 07:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-10 21:43 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-07 06:28 <DIR> d-------- C:\Program Files\Peterson's
2007-07-06 21:22 <DIR> d-------- C:\DOCUME~1\Owner\.javaws
2007-07-06 21:18 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-07-04 15:23 <DIR> d-------- C:\Deckard
2007-07-04 09:16 <DIR> d-------- C:\TSF
2007-06-24 16:38 <DIR> d-------- C:\Program Files\Apple Software Update
2007-06-22 22:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
2007-06-17 12:40 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\12Voip
2007-06-16 08:43 <DIR> d-------- C:\Program Files\iCall

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-07 01:32:12 335 ----a-w C:\WINDOWS\nsreg.dat
2007-07-07 01:22:17 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-04 18:03:22 -------- d-----w C:\Program Files\Windows Defender
2007-07-04 18:02:16 -------- d-----w C:\Program Files\SpywareGuard
2007-07-04 18:01:42 -------- d-----w C:\Program Files\QuickTime
2007-07-04 17:53:20 -------- d-----w C:\Program Files\iTunes
2007-07-04 17:50:46 -------- d-----w C:\Program Files\FinePixViewer
2007-07-04 17:50:34 -------- d-----w C:\Program Files\EarthLink TotalAccess
2007-07-04 13:56:13 -------- d-----w C:\Program Files\iWin Games
2007-07-04 13:04:31 -------- d-----w C:\Program Files\Yahoo! Games
2007-07-04 12:55:14 -------- d-----w C:\Program Files\Winamp
2007-06-28 14:44:42 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Skype
2007-06-24 20:42:46 -------- d-----w C:\Program Files\iPod
2007-05-20 17:08:32 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\GetRightToGo
2007-05-20 02:21:02 -------- d-----w C:\Program Files\ReflexiveArcade
2007-05-18 19:17:37 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\FloodLightGames
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
2006-10-26 11:28 440384 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-01-12 20:38 63128 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2}]
2003-08-02 23:24 192512 -ra------ C:\Program Files\SpywareGuard\dlprotect.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B5F2E08-6F39-479a-B547-B2026E4C7EDF}]
2003-12-08 16:26 401408 --a------ C:\Program Files\EarthLink TotalAccess\PnEL.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\PROGRA~1\VIRUSP~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
2004-08-13 18:42 155648 --a------ C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
2006-01-17 16:04 282624 --a------ C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 18:12]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-21 21:01]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 23:32]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2005-03-15 09:58]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 18:07]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-07-12 22:28]
"IridiumTimeWizard"="D:\My Documents\rupa\tp\iridium.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 22:49]
"FreeCall"="C:\program files\freecall.com\freecall\freecall.exe" []
"12Voip"="C:\Program Files\12Voip.com\12Voip\12Voip.exe" []
"E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2003-12-08 15:51]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 10:13]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]

Contents of the 'Scheduled Tasks' folder
2007-06-24 20:38:56 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-04 06:16:01 C:\WINDOWS\tasks\MP Scheduled Scan.job
2007-07-12 11:11:33 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-12 09:27:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-12 9:29:00
C:\ComboFix-quarantined-files.txt ... 2007-07-12 09:28
C:\ComboFix2.txt ... 2007-07-10 21:49

--- E O F ---

edifiz · 07-12-2007, 07:32 AM

the above log popped up once the scan was done ... it IS NOT the one saved as C:/combofix.txt

edifiz · 07-12-2007, 07:40 AM

I keep gettin this warning from Spywareguard Browser Protection Alert

An attempt to change your homepage has been detected

Warning! Your IE homepage has been changed

you IE local machine homepage has been changed from http://uk.yahoo.com?.home=msgr
to
about blank

What would you like to do ?
Restore old value
Keep new value

Is this normal ??? and what am i supposed to select ???

edifiz · 07-12-2007, 07:43 AM

Deckard's System Scanner v20070611.50
Run by Owner on 2007-07-12 at 09:41:09
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-07-12 09:41:25
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16473)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\WINDOWS\explorer.exe
C:\TSF\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/?.home=msgr
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: PnIEBrowserHelperObj Class - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Virus Protection\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [IridiumTimeWizard] D:\My Documents\rupa\tp\iridium.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [FreeCall] "C:\program files\freecall.com\freecall\freecall.exe" -nosplash -minimized
O4 - HKCU\..\Run: [12Voip] "C:\Program Files\12Voip.com\12Voip\12Voip.exe" -nosplash -minimized
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O16 - DPF: Yahoo! Freecell Solitaire () - http://presence.games.yahoo.com/yog/y/fs10_x.cab
O16 - DPF: Yahoo! MahJong Solitaire () - http://download.games.yahoo.com/game.../y/mjst4_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} () - http://download.abacast.com/download...basetup161.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{87126DBE-0C47-43B0-93FB-2408B31B1FC1}: NameServer = 207.69.188.185,207.69.188.186
O18 - Protocol: bw+0 - {459f93be-477c-45ac-b9bd-1f010c483399} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: offline-8876480 - {459F93BE-477C-45AC-B9BD-1F010C483399} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - Unknown owner - "C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"

-- Files created between 2007-06-12 and 2007-07-12 -----------------------------

2007-07-11 07:56:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-07-07 06:28:15 0 d-------- C:\Program Files\Peterson's
2007-07-06 21:22:45 0 d-------- C:\Documents and Settings\Owner\.javaws
2007-07-06 21:18:40 0 d--h----- C:\Program Files\Zero G Registry
2007-07-06 17:56:38 0 dr-h----- C:\Documents and Settings\Owner\Recent
2007-07-04 09:16:15 0 d-------- C:\TSF
2007-06-24 16:38:52 0 d-------- C:\Program Files\Apple Software Update
2007-06-22 22:08:57 0 d-------- C:\Documents and Settings\All Users\Application Data\JollyBear
2007-06-17 12:40:58 0 d-------- C:\Documents and Settings\Owner\Application Data\12Voip
2007-06-16 08:43:16 0 d-------- C:\Program Files\iCall

-- Find3M Report ---------------------------------------------------------------

2007-07-06 21:32:23 0 d-------- C:\Documents and Settings\Owner\Application Data\Mozilla
2007-07-06 21:32:12 335 --a------ C:\WINDOWS\nsreg.dat
2007-07-06 21:22:17 0 d-------- C:\Program Files\Java
2007-07-06 21:22:17 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-07-04 14:03:22 0 d-------- C:\Program Files\Windows Defender
2007-07-04 14:02:16 0 d-------- C:\Program Files\SpywareGuard
2007-07-04 14:01:42 0 d-------- C:\Program Files\QuickTime
2007-07-04 13:53:20 0 d-------- C:\Program Files\iTunes
2007-07-04 13:50:46 0 d-------- C:\Program Files\FinePixViewer
2007-07-04 13:50:34 0 d-------- C:\Program Files\EarthLink TotalAccess
2007-07-04 09:56:13 0 d-------- C:\Program Files\iWin Games
2007-07-04 09:04:31 0 d-------- C:\Program Files\Yahoo! Games
2007-07-04 08:55:14 0 d-------- C:\Program Files\Winamp
2007-06-28 10:44:42 0 d-------- C:\Documents and Settings\Owner\Application Data\Skype
2007-06-24 16:42:46 0 d-------- C:\Program Files\iPod
2007-06-06 17:48:49 0 d-------- C:\Documents and Settings\Owner\Application Data\Adobe
2007-05-20 13:08:32 0 d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo
2007-05-19 22:21:02 0 d-------- C:\Program Files\ReflexiveArcade
2007-05-18 15:17:37 0 d-------- C:\Documents and Settings\Owner\Application Data\FloodLightGames

-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{4A368E80-174F-4872-96B5-0B27DDD11DB2} C:\Program Files\SpywareGuard\dlprotect.dll
{4B5F2E08-6F39-479a-B547-B2026E4C7EDF} C:\Program Files\EarthLink TotalAccess\PnEL.dll
{53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\VIRUSP~1\SPYBOT~1\SDHelper.dll
{9394EDE7-C8B5-483E-8773-474BF36AF6E4} C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"
"mmtask"="\"C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe\""
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"IridiumTimeWizard"="D:\\My Documents\\rupa\\tp\\iridium.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
"FreeCall"="\"C:\\program files\\freecall.com\\freecall\\freecall.exe\" -nosplash -minimized"
"12Voip"="\"C:\\Program Files\\12Voip.com\\12Voip\\12Voip.exe\" -nosplash -minimized"
"E6TaskPanel"="\"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe\" -winstart"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert"="C:\\Program Files\\Symantec\\LiveUpdate\\ALUNotify.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ http://us.f208.mail.yahoo.com/ym/Sho...&view=a&head=b

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hkcmd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\hkcmd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\igfxtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

-- End of Deckard's System Scanner: finished at 2007-07-12 at 09:42:13 ---------

Clark76 · 07-13-2007, 09:04 PM

Quote:

I keep gettin this warning from Spywareguard Browser Protection Alert

An attempt to change your homepage has been detected

Warning! Your IE homepage has been changed

you IE local machine homepage has been changed from http://uk.yahoo.com?.home=msgr
to
about blank

What would you like to do ?
Restore old value
Keep new value

Is this normal ??? and what am i supposed to select ???

I apologize, I should have had you disable Spywareguard before running the previous fix.

=================

Please disable Spywareguard, as it may hinder the removal of some entries. You can re-enable it after you're clean.

Right click the running icon of Spywareguard located in the system tray
Go to Menu > File > Exit and confirm the programs close.

===========

Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.

Quote:

@echo off
sc stop "Boonty Games"
sc delete "Boonty Games"
exit

Double click FixServices.bat. A window will open and close. This is normal.

============

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

Please remember to close all other windows, including browsers then click Fix checked.

==================

Delete the following Folder indicated in BLUE if it still exists.

C:\Program Files\Common Files\BOONTY Shared

=============

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6u2.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u1-windowsi586-p.exe to install the newest version.

=============

Run Deckard's System Scanner (DSS) again

Close all applications and windows.
Double-click on DSS.exe to run it, and follow the prompts.
When the scan is complete, one text file will open - main.txt
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt in your reply.

edifiz · 07-14-2007, 11:51 AM

There is an option which says

'The Java SE Runtime Environment (JRE) allows end-users to run Java applications. '

No where does it say the following

'The J2SE Runtime Environment (JRE) allows end-users to run Java applications'

07-04-2007, 01:44 PM	#2 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Activescan.txt Incident Status Location Adware:adware/outerinfo Not disinfected Windows Registry Spyware:spyware/shopnav Not disinfected Windows Registry Spyware:spyware/clientman Not disinfected Windows Registry Adware:adware/rxtoolbar Not disinfected Windows Registry Adware:adware/transponder Not disinfected Windows Registry Adware:adware/zsearch Not disinfected Windows Registry Adware:adware/sidesearch Not disinfected Windows Registry Adware:adware/flashtrack Not disinfected Windows Registry Adware:Adware/PurityScan Not disinfected C:\4FB.tmp[¦++\Yazzle1552OinAdmin.exe] Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@apmebf[2].txt Spyware:Cookie/OfferOptimizer Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@offeroptimizer[1].txt Spyware:Cookie/OfferOptimizer Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@offeroptimizer[3].txt Spyware:Cookie/Rightmedia Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@rightmedia[1].txt Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\rbx0@earthlink.net\Cookies\owner@tickle[2].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Cookies\owner@com[1].txt Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Owner\Local Settings\Temp\sdexe.exe Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Rupa\Cookies\rupa@apmebf[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Rupa\Cookies\rupa@atdmt[1].txt Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Rupa\Cookies\rupa@perf.overture[1].txt Adware:Adware/DollarRevenue Not disinfected C:\Program Files\Common Files\{3018F0D7-07CA-1033-0826-020409200001}\Uninst.exe Adware:Adware/Maxifiles Not disinfected C:\Program Files\Common Files\{B018F0D7-07CA-1033-0826-020409200001}\services.dll Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\6C901D50-2D65-46BF-9493-B98F14 Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\871350F8-4A13-40F7-897F-E05C8F Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\FB5EED50-C92F-4F5E-A256-A1E54D Potentially unwanted tool:Application/Altnet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B553C825-5AFC-4D60-AB83-FF60AD\FC0E4DDF-B929-4E85-A3CA-4D3723 Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\02CA684E-DD42-418A-98DC-6D7142 Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\036AFBE3-2FC5-4B2C-9520-FD1E99 Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\05D97AE4-AAF7-4DE3-91D5-E62F42 Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\0B90EB3B-FA59-44F2-BAE3-1AC2C0 Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\1182EB76-8E49-4B31-B3CF-B4F81A Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\33EB0D65-B83A-40DA-AAB7-D329CA Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\41D5F93A-538F-4CC4-A9DD-3C4390 Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\4C9986D0-D509-429E-861D-7A6684 Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\56BEA6AD-1066-4F96-B20F-6A519E Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\652699A5-310D-4A20-9DFF-DF80EA Adware:Adware/Gator Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\D178E335-8466-4BEA-A08C-5AC1A5\F17B65BA-4C6D-4F35-9982-6BAB68 Spyware:Cookie/Maxserving Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1A.tmp Spyware:Cookie/RealMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1D.tmp Adware:Adware/DelFinMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1D2.tmp\vmstmp.exe Adware:Adware/IPInsight Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1DB.tmp Spyware:Cookie/RealMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq21B.tmp Spyware:Cookie/Belnk Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq53.tmp Spyware:Cookie/Belnk Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq54.tmp Spyware:Cookie/Maxserving Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9.tmp Spyware:Cookie/RealMedia Not disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9F.tmp Adware:Adware/Maxifiles Not disinfected C:\WINDOWS\b122.exe Virus:Trj/Downloader.OLY Disinfected C:\WINDOWS\retadpu72.exe Virus:Trj/Banker.FWD Disinfected C:\WINDOWS\system32\mpeg4dec0.dll Virus:Trj/Banker.FQH Disinfected C:\WINDOWS\system32\wzip32.exe

07-07-2007, 10:35 AM	#3 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz bump

07-09-2007, 05:28 PM	#4 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz y is my query not being addressed ??? i noticed that the ones posted after mine r being looked into ?? can i atleast knw the reason y mines not being addressed ??

07-10-2007, 07:44 AM	#5 (permalink)
Clark76 Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: Cleveland, Ohio Posts: 1,673 OS: XP Pro, Vista, Ubuntu 8.10	Re: HijackThis Log File - Edifiz Hello and Welcome. Apologies for any delay in replying, but we have been rather busy lately. I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p Please be patient with me during this time. You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. __________________ Proud Member of ASAP Proud Member of UNITE If you feel we've helped you, Please Donate to the Forum

07-10-2007, 07:54 AM	#6 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz thank you soo much ... yeah i will b patient :)

07-10-2007, 07:51 PM	#8 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	ComboFix.txt "Owner" - 2007-07-10 21:44:09 - ComboFix 07-07-10.5 - Service Pack 2 ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Owner\MYDOCU~1.\smbols~1 C:\Program Files\Common Files\{3018F~1 C:\Program Files\Common Files\{3018F~1\Uninst.exe C:\Program Files\Common Files\{B018F~1 C:\Program Files\Common Files\{B018F~1\services.dll C:\Program Files\Common Files\uninstall information C:\Program Files\inetget2 C:\Program Files\ipwindows C:\WINDOWS\b122.exe C:\WINDOWS\curity~1 C:\WINDOWS\hosts C:\WINDOWS\wr.txt ((((((((((((((((((((((((( Files Created from 2007-06-11 to 2007-07-11 ))))))))))))))))))))))))))))))) 2007-07-10 21:43 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-07 06:28 <DIR> d-------- C:\Program Files\Peterson's 2007-07-06 21:22 <DIR> d-------- C:\DOCUME~1\Owner\.javaws 2007-07-06 21:18 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-07-04 15:23 <DIR> d-------- C:\Deckard 2007-07-04 09:16 <DIR> d-------- C:\TSF 2007-06-24 16:38 <DIR> d-------- C:\Program Files\Apple Software Update 2007-06-22 22:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear 2007-06-17 12:40 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\12Voip 2007-06-16 08:43 <DIR> d-------- C:\Program Files\iCall (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-07 01:32:12 335 ----a-w C:\WINDOWS\nsreg.dat 2007-07-07 01:22:17 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-04 18:03:22 -------- d-----w C:\Program Files\Windows Defender 2007-07-04 18:02:16 -------- d-----w C:\Program Files\SpywareGuard 2007-07-04 18:01:42 -------- d-----w C:\Program Files\QuickTime 2007-07-04 17:53:20 -------- d-----w C:\Program Files\iTunes 2007-07-04 17:50:46 -------- d-----w C:\Program Files\FinePixViewer 2007-07-04 17:50:34 -------- d-----w C:\Program Files\EarthLink TotalAccess 2007-07-04 13:56:13 -------- d-----w C:\Program Files\iWin Games 2007-07-04 13:04:31 -------- d-----w C:\Program Files\Yahoo! Games 2007-07-04 12:55:14 -------- d-----w C:\Program Files\Winamp 2007-06-28 14:44:42 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Skype 2007-06-24 20:42:46 -------- d-----w C:\Program Files\iPod 2007-05-20 17:08:32 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\GetRightToGo 2007-05-20 02:21:02 -------- d-----w C:\Program Files\ReflexiveArcade 2007-05-18 19:17:37 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\FloodLightGames 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}] 2006-10-26 11:28 440384 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-01-12 20:38 63128 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2}] 2003-08-02 23:24 192512 -ra------ C:\Program Files\SpywareGuard\dlprotect.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B5F2E08-6F39-479a-B547-B2026E4C7EDF}] 2003-12-08 16:26 401408 --a------ C:\Program Files\EarthLink TotalAccess\PnEL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\PROGRA~1\VIRUSP~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}] 2004-08-13 18:42 155648 --a------ C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}] 2006-01-17 16:04 282624 --a------ C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 18:12] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-21 21:01] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 23:32] "mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2005-03-15 09:58] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46] "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 18:07] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-07-12 22:28] "IridiumTimeWizard"="D:\My Documents\rupa\tp\iridium.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 22:49] "FreeCall"="C:\program files\freecall.com\freecall\freecall.exe" [] "12Voip"="C:\Program Files\12Voip.com\12Voip\12Voip.exe" [] "E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2003-12-08 15:51] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 10:13] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3b67d10-7fba-11db-bbbd-00c0a8895ef3}] AutoRun\command- wd_windows_tools\setup.exe Contents of the 'Scheduled Tasks' folder 2007-06-24 20:38:56 C:\WINDOWS\tasks\AppleSoftwareUpdate.job 2007-06-04 06:16:01 C:\WINDOWS\tasks\MP Scheduled Scan.job 2007-07-11 00:27:14 C:\WINDOWS\tasks\Symantec NetDetect.job ************************************************************************ catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-10 21:48:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 2007-07-10 21:49:16 C:\ComboFix-quarantined-files.txt ... 2007-07-10 21:48 --- E O F ---

07-10-2007, 09:43 PM	#9 (permalink)
Clark76 Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: Cleveland, Ohio Posts: 1,673 OS: XP Pro, Vista, Ubuntu 8.10	Re: HijackThis Log File - Edifiz Please clear out your Yahoo Quarantine folder – C:\Program Files\Yahoo!\YPSR\ Quarantine – Note: just empty the folder, do not delete the folder. Then clear out your Microsoft AntiSpyware Quarantine folder - C:\Program Files\Microsoft AntiSpyware\ Quarantine – Note: just empty the folder, do not delete the folder. ============= Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. __________________ Proud Member of ASAP Proud Member of UNITE If you feel we've helped you, Please Donate to the Forum

07-11-2007, 09:53 AM	#10 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz i didnt find any 'Save as Text' button once the scan was done .. I am trying once again .. will let u knw soon ... thanks

07-11-2007, 10:31 AM	#11 (permalink)
Clark76 Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: Cleveland, Ohio Posts: 1,673 OS: XP Pro, Vista, Ubuntu 8.10	Re: HijackThis Log File - Edifiz See if this helps: __________________ Proud Member of ASAP Proud Member of UNITE If you feel we've helped you, Please Donate to the Forum

07-11-2007, 11:21 AM	#12 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	KASPERSKY.txt ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Wednesday, July 11, 2007 1:19:42 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 11/07/2007 Kaspersky Anti-Virus database records: 361185 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 86054 Number of viruses found: 14 Number of infected objects: 34 Number of suspicious objects: 0 Duration of the scan process: 01:46:32 Infected Object Name / Virus Name / Last Action C:\4FB.tmp/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\4FB.tmp NSIS: infected - 1 skipped C:\Deckard\System Scanner\backup\DOCUME~1\Owner\LOCALS~1\Temp\ye_dil_mange_more.exe Infected: not-virus:BadJoke.Win32.Delf.h skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012007071120070712\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_31c.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_870.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DF3D3B.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\BWDocMap.pht Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\BWInfopakMap.pht Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chandir.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chandir.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chn.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\chn.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\D0000000.FCS Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\inuse.txt Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\L0000014.FCS Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\main.log Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_die.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_die.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_dnd.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_dnd.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_ext.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_ext.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_rcv.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\prs_rcv.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\storydb.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Owner\Data\storydb.idx Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\billing_Owner.log Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\client_Owner.log Object is locked skipped C:\Program Files\Yahoo!\Messenger\logs\network_Owner.log Object is locked skipped C:\QooBox\Quarantine\C\Program Files\Common Files\{B018F~1\services.dll.vir Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream/data0002 Infected: not-a-virus:AdWare.Win32.Rond.a skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir NSIS: infected - 3 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc1.tmp\vmstmp.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.c skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc131\FC0E4DDF-B929-4E85-A3CA-4D3723/mySetp.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.o skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc131\FC0E4DDF-B929-4E85-A3CA-4D3723 CAB: infected - 1 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\02CA684E-DD42-418A-98DC-6D7142 Infected: not-a-virus:AdWare.Win32.Gator.6051 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\036AFBE3-2FC5-4B2C-9520-FD1E99 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\05D97AE4-AAF7-4DE3-91D5-E62F42 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\0B90EB3B-FA59-44F2-BAE3-1AC2C0 Infected: not-a-virus:AdWare.Win32.Gator.5017 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\1182EB76-8E49-4B31-B3CF-B4F81A Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\33EB0D65-B83A-40DA-AAB7-D329CA Infected: not-a-virus:AdWare.Win32.Gator.5017 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\41D5F93A-538F-4CC4-A9DD-3C4390 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\4C9986D0-D509-429E-861D-7A6684 Infected: not-a-virus:AdWare.Win32.Gator.3124 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\56BEA6AD-1066-4F96-B20F-6A519E Infected: not-a-virus:AdWare.Win32.Gator.5017 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\652699A5-310D-4A20-9DFF-DF80EA Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped C:\RECYCLER\S-1-5-21-725345543-1500820517-839522115-1003\Dc139\F17B65BA-4C6D-4F35-9982-6BAB68 Infected: not-a-virus:AdWare.Win32.Gator.5115 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094586.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094587.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094588.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094718.dll Infected: not-a-virus:AdWare.Win32.AdMedia.g skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094741.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094742.dll Infected: Trojan-Spy.Win32.Banker.cmd skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1226\A0094743.exe Infected: Trojan-Downloader.Win32.Banload.aoo skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095298.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.Rond.a skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.u skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\A0095299.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{9058E312-0553-49ED-BD46-7DA0792AAFA7}\RP1233\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

07-11-2007, 11:22 AM	#13 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz thanks i got it :)

07-12-2007, 07:31 AM	#15 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	ComboFix Log- this is the log that popped up after the scan "Owner" - 2007-07-12 9:22:01 - ComboFix 07-07-10.5 - Service Pack 2 Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\4FB.tmp ((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 ))))))))))))))))))))))))))))))) 2007-07-11 07:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab 2007-07-10 21:43 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-07 06:28 <DIR> d-------- C:\Program Files\Peterson's 2007-07-06 21:22 <DIR> d-------- C:\DOCUME~1\Owner\.javaws 2007-07-06 21:18 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-07-04 15:23 <DIR> d-------- C:\Deckard 2007-07-04 09:16 <DIR> d-------- C:\TSF 2007-06-24 16:38 <DIR> d-------- C:\Program Files\Apple Software Update 2007-06-22 22:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear 2007-06-17 12:40 <DIR> d-------- C:\DOCUME~1\Owner\APPLIC~1\12Voip 2007-06-16 08:43 <DIR> d-------- C:\Program Files\iCall (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-07 01:32:12 335 ----a-w C:\WINDOWS\nsreg.dat 2007-07-07 01:22:17 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-04 18:03:22 -------- d-----w C:\Program Files\Windows Defender 2007-07-04 18:02:16 -------- d-----w C:\Program Files\SpywareGuard 2007-07-04 18:01:42 -------- d-----w C:\Program Files\QuickTime 2007-07-04 17:53:20 -------- d-----w C:\Program Files\iTunes 2007-07-04 17:50:46 -------- d-----w C:\Program Files\FinePixViewer 2007-07-04 17:50:34 -------- d-----w C:\Program Files\EarthLink TotalAccess 2007-07-04 13:56:13 -------- d-----w C:\Program Files\iWin Games 2007-07-04 13:04:31 -------- d-----w C:\Program Files\Yahoo! Games 2007-07-04 12:55:14 -------- d-----w C:\Program Files\Winamp 2007-06-28 14:44:42 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Skype 2007-06-24 20:42:46 -------- d-----w C:\Program Files\iPod 2007-05-20 17:08:32 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\GetRightToGo 2007-05-20 02:21:02 -------- d-----w C:\Program Files\ReflexiveArcade 2007-05-18 19:17:37 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\FloodLightGames 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}] 2006-10-26 11:28 440384 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-01-12 20:38 63128 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2}] 2003-08-02 23:24 192512 -ra------ C:\Program Files\SpywareGuard\dlprotect.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B5F2E08-6F39-479a-B547-B2026E4C7EDF}] 2003-12-08 16:26 401408 --a------ C:\Program Files\EarthLink TotalAccess\PnEL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\PROGRA~1\VIRUSP~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}] 2004-08-13 18:42 155648 --a------ C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}] 2006-01-17 16:04 282624 --a------ C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 18:12] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-04-21 21:01] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 23:32] "mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2005-03-15 09:58] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46] "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 18:07] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-07-12 22:28] "IridiumTimeWizard"="D:\My Documents\rupa\tp\iridium.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 22:49] "FreeCall"="C:\program files\freecall.com\freecall\freecall.exe" [] "12Voip"="C:\Program Files\12Voip.com\12Voip\12Voip.exe" [] "E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2003-12-08 15:51] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 10:13] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] Contents of the 'Scheduled Tasks' folder 2007-06-24 20:38:56 C:\WINDOWS\tasks\AppleSoftwareUpdate.job 2007-06-04 06:16:01 C:\WINDOWS\tasks\MP Scheduled Scan.job 2007-07-12 11:11:33 C:\WINDOWS\tasks\Symantec NetDetect.job ************************************************************************ catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-12 09:27:55 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 2007-07-12 9:29:00 C:\ComboFix-quarantined-files.txt ... 2007-07-12 09:28 C:\ComboFix2.txt ... 2007-07-10 21:49 --- E O F ---

07-12-2007, 07:32 AM	#16 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz the above log popped up once the scan was done ... it IS NOT the one saved as C:/combofix.txt

07-12-2007, 07:40 AM	#17 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz I keep gettin this warning from Spywareguard Browser Protection Alert An attempt to change your homepage has been detected Warning! Your IE homepage has been changed you IE local machine homepage has been changed from http://uk.yahoo.com?.home=msgr to about blank What would you like to do ? Restore old value Keep new value Is this normal ??? and what am i supposed to select ???

07-12-2007, 07:43 AM	#18 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	main.txt Deckard's System Scanner v20070611.50 Run by Owner on 2007-07-12 at 09:41:09 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-07-12 09:41:25 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16473) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\SpywareGuard\sgmain.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Google\Google Talk\googletalk.exe C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe C:\WINDOWS\explorer.exe C:\TSF\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/?.home=msgr R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: PnIEBrowserHelperObj Class - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Virus Protection\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [IridiumTimeWizard] D:\My Documents\rupa\tp\iridium.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [FreeCall] "C:\program files\freecall.com\freecall\freecall.exe" -nosplash -minimized O4 - HKCU\..\Run: [12Voip] "C:\Program Files\12Voip.com\12Voip\12Voip.exe" -nosplash -minimized O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O16 - DPF: Yahoo! Freecell Solitaire () - http://presence.games.yahoo.com/yog/y/fs10_x.cab O16 - DPF: Yahoo! MahJong Solitaire () - http://download.games.yahoo.com/game.../y/mjst4_x.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...22/wmv9VCM.CAB O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} () - http://download.abacast.com/download...basetup161.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{87126DBE-0C47-43B0-93FB-2408B31B1FC1}: NameServer = 207.69.188.185,207.69.188.186 O18 - Protocol: bw+0 - {459f93be-477c-45ac-b9bd-1f010c483399} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: offline-8876480 - {459F93BE-477C-45AC-B9BD-1F010C483399} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Boonty Games - Unknown owner - "C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" -- Files created between 2007-06-12 and 2007-07-12 ----------------------------- 2007-07-11 07:56:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-07-07 06:28:15 0 d-------- C:\Program Files\Peterson's 2007-07-06 21:22:45 0 d-------- C:\Documents and Settings\Owner\.javaws 2007-07-06 21:18:40 0 d--h----- C:\Program Files\Zero G Registry 2007-07-06 17:56:38 0 dr-h----- C:\Documents and Settings\Owner\Recent 2007-07-04 09:16:15 0 d-------- C:\TSF 2007-06-24 16:38:52 0 d-------- C:\Program Files\Apple Software Update 2007-06-22 22:08:57 0 d-------- C:\Documents and Settings\All Users\Application Data\JollyBear 2007-06-17 12:40:58 0 d-------- C:\Documents and Settings\Owner\Application Data\12Voip 2007-06-16 08:43:16 0 d-------- C:\Program Files\iCall -- Find3M Report --------------------------------------------------------------- 2007-07-06 21:32:23 0 d-------- C:\Documents and Settings\Owner\Application Data\Mozilla 2007-07-06 21:32:12 335 --a------ C:\WINDOWS\nsreg.dat 2007-07-06 21:22:17 0 d-------- C:\Program Files\Java 2007-07-06 21:22:17 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-07-04 14:03:22 0 d-------- C:\Program Files\Windows Defender 2007-07-04 14:02:16 0 d-------- C:\Program Files\SpywareGuard 2007-07-04 14:01:42 0 d-------- C:\Program Files\QuickTime 2007-07-04 13:53:20 0 d-------- C:\Program Files\iTunes 2007-07-04 13:50:46 0 d-------- C:\Program Files\FinePixViewer 2007-07-04 13:50:34 0 d-------- C:\Program Files\EarthLink TotalAccess 2007-07-04 09:56:13 0 d-------- C:\Program Files\iWin Games 2007-07-04 09:04:31 0 d-------- C:\Program Files\Yahoo! Games 2007-07-04 08:55:14 0 d-------- C:\Program Files\Winamp 2007-06-28 10:44:42 0 d-------- C:\Documents and Settings\Owner\Application Data\Skype 2007-06-24 16:42:46 0 d-------- C:\Program Files\iPod 2007-06-06 17:48:49 0 d-------- C:\Documents and Settings\Owner\Application Data\Adobe 2007-05-20 13:08:32 0 d-------- C:\Documents and Settings\Owner\Application Data\GetRightToGo 2007-05-19 22:21:02 0 d-------- C:\Program Files\ReflexiveArcade 2007-05-18 15:17:37 0 d-------- C:\Documents and Settings\Owner\Application Data\FloodLightGames -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {4A368E80-174F-4872-96B5-0B27DDD11DB2} C:\Program Files\SpywareGuard\dlprotect.dll {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} C:\Program Files\EarthLink TotalAccess\PnEL.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\VIRUSP~1\SPYBOT~1\SDHelper.dll {9394EDE7-C8B5-483E-8773-474BF36AF6E4} C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe" "REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN" "mmtask"="\"C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe\"" "LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe" "LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe " "Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot" "LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe" "IridiumTimeWizard"="D:\\My Documents\\rupa\\tp\\iridium.exe" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet" "FreeCall"="\"C:\\program files\\freecall.com\\freecall\\freecall.exe\" -nosplash -minimized" "12Voip"="\"C:\\Program Files\\12Voip.com\\12Voip\\12Voip.exe\" -nosplash -minimized" "E6TaskPanel"="\"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe\" -winstart" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ALUAlert"="C:\\Program Files\\Symantec\\LiveUpdate\\ALUNotify.exe" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source REG_SZ http://us.f208.mail.yahoo.com/ym/Sho...&view=a&head=b [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="hkcmd" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\hkcmd.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="igfxtray" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\igfxtray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKCU" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 -- End of Deckard's System Scanner: finished at 2007-07-12 at 09:42:13 ---------

07-14-2007, 11:51 AM	#20 (permalink)
edifiz Registered User Join Date: Mar 2006 Posts: 94 OS: WINDOWS XP	Re: HijackThis Log File - Edifiz There is an option which says 'The Java SE Runtime Environment (JRE) allows end-users to run Java applications. ' No where does it say the following 'The J2SE Runtime Environment (JRE) allows end-users to run Java applications'