|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-10-2007, 01:48 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Virus keep popping up in Content.IE5
Please help...
I ran AVG, Spybot, AdAware but they couldn't find anything.  Whenever I use IE and go to any site (my homepage is blank), I get a virus warning in Content.IE5. I heal the viruses, empty the junk+offline content, reopen the IE, go to some website, and keep getting the virus warning... again and again...So please help me. This is my log. Thank you! ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 2:30:36 PM, on 8/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\MATLAB7\webserver\bin\win32\matlabserver.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Downloads\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://h20239.www2.hp.com/techcenter...p_syscheck.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {23D236EA-B936-4B2B-900C-D0E8DBBF9570} (BugsGameStarts Class) - https://secure3.playpark.com/start/p...iGameStart.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://game7.bigfishgames.com/Reef/e...2.1.0.0.48.cab O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) - http://www.cramster.com/DRM/Client/FileOpen.CAB O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB7\webserver\bin\win32\matlabserver.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
08-10-2007, 05:42 PM
|
#2 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
Quote:
__________________
Question - what have you done for the community today? |
|
|
|
|
|
08-10-2007, 06:00 PM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Re: Virus keep popping up in Content.IE5
AVG Resident Shield gives me the warning:
Threat Detected!Then I usually click "heal", and the program say "Object was successfully healed", but then another warning come up: Threat Detected!And sometimes many more warning pop up. The folder name change a little bit, but the infected files are still body(1).jpg and title(1).jpg C:\Documents and Setting\Akinajang Akina\Local SEttings\Temporary Internet Files\Content.IE5\X~Random name~X\title(1).jpg or body(1).jpg Everytime I use IE, the virus warning will pop up even after I empty the temp file + Content.IE5 (except index.dat). Also, if I stay at my hompage (blank page), there wil be no warning. But as soon as I go to any website, I'll get the warning. Last edited by hwstdez; 08-10-2007 at 06:22 PM. |
|
|
|
|
08-10-2007, 06:04 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
Let's a peekaboo.
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe 2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that & a fresh Hijackthis log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
08-10-2007, 06:18 PM
|
#5 (permalink) | ||
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Re: Virus keep popping up in Content.IE5
Combo Fix log:
Quote:
Here's Hijack This log: Quote:
Last edited by hwstdez; 08-10-2007 at 06:41 PM. |
||
|
|
|
|
08-10-2007, 06:34 PM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
Post the header from the combofix log.
__________________
Question - what have you done for the community today? |
|
|
|
|
08-10-2007, 06:39 PM
|
#7 (permalink) | |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Re: Virus keep popping up in Content.IE5
oops sorry~
Quote:
|
|
|
|
|
|
08-10-2007, 06:43 PM
|
#8 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
Quote:
Log appears clean but let's do a perfuntory scan Using Internet Explorer, visit http://www.kaspersky.com/service?chapter=161739400 Answer Yes, when prompted to install an ActiveX component.
__________________
Question - what have you done for the community today? |
|
|
|
|
|
08-10-2007, 06:45 PM
|
#9 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
This is to be performed after you have posted the required logs.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
__________________
Question - what have you done for the community today? |
|
|
|
|
08-10-2007, 11:23 PM
|
#10 (permalink) | |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Re: Virus keep popping up in Content.IE5
This is the scan report:
Quote:
Thank you for your help in advance. Last edited by hwstdez; 08-10-2007 at 11:27 PM. |
|
|
|
|
|
08-10-2007, 11:29 PM
|
#11 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
C:\WINDOWS\system32\dbxDgrevCheck.dll
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
%systemdrive%\VundoFix Backups
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Question - what have you done for the community today? |
|
|
|
|
08-10-2007, 11:38 PM
|
#13 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
Quote:
__________________
Question - what have you done for the community today? |
|
|
|
|
|
08-11-2007, 12:10 AM
|
#14 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Re: Virus keep popping up in Content.IE5
It still happens. Although, the first time I try, everything's fine.
I visit google.com and when I look closely at the status bar at the bottom of the IE browser, it says "Downloading data http://web.123563.com/title.jpg..." and "Downloadind data http://web.123563.com/body.jpg..." and then 2 virus warnings pop up. This happens when I visit other sites too. Last edited by hwstdez; 08-11-2007 at 12:15 AM. |
|
|
|
|
08-11-2007, 12:31 AM
|
#15 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
This happens for IE only?
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 12:32 AM
|
#16 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
 Please download this tool > System Repair Engineer
Note: You may have to rename SREngLog.log to SREngLog.txt before attaching
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 01:13 AM
|
#17 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Re: Virus keep popping up in Content.IE5
Yes, for IE only. When I use firefox, everything is fine.
Oh, the virus warning also pop up when I try to start an online game called "Audition". The game browser will load a notice page from its website (http://audition.nexon.net/Game/notice.html) before I can log in to the game. So I assume that the game browser uses IE to load the page. I'm not sure about this though. Anyway, I'll try System Repair Engineer that you suggested. |
|
|
|
|
08-11-2007, 01:16 AM
|
#18 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
It's hiding somewhere within IE. We'll have to dig it out
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 01:19 AM
|
#19 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 15
OS: XP Pro
|
Re: Virus keep popping up in Content.IE5
here's the log from System Repair Engineer:
Code:
2007-08-11,02:18:42
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed
Follow item(s) have been choosed:
All Boot Items (Including Registry, Startup Folders, Services and so on)
Browser Add-ons
Runing Processes (Including process model information)
File Associations
Winsock Provider
Autorun.Inf
HOSTS File
Process Privileges Scan
Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"> [N/A]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ATIPTA><"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"> [ATI Technologies, Inc.]
<hpWirelessAssistant><"C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe"> [Hewlett-Packard Company]
<SynTPLpr><"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<SynTPEnh><"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"> [(Verified)Microsoft Windows Publisher]
<eabconfg.cpl><"C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start> [Hewlett-Packard ]
<Cpqset><C:\Program Files\HPQ\Default Settings\cpqset.exe> []
<LSBWatcher><c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe> [Hewlett-Packard Company]
<BluetoothAuthenticationAgent><"rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent> [(Verified)Microsoft Windows Publisher]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [(Verified)Microsoft Windows Publisher]
<MSPY2002><"C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><"C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><"C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName> [(Verified)Microsoft Windows Publisher]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<Share-to-Web Namespace Daemon><"C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"> [Hewlett-Packard]
<ISUSPM Startup><"C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup> [InstallShield Software Corporation]
<LVCOMSX><C:\WINDOWS\system32\LVCOMSX.EXE> [Logitech Inc.]
<AVG7_CC><C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP> [GRISOFT, s.r.o.]
<QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<HP Software Update><C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe> [Hewlett-Packard Co.]
<ZoneAlarm Client><"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"> [(Verified)Check Point Software Technologies Ltd.]
<SunJavaUpdateSched><"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
<WinlogonNotify: WgaLogon><WgaLogon.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
<WinlogonNotify: WRNotifier><WRLogonNTF.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4b218e3e-bc98-4770-93d3-2731b9329278}]
<Internet Explorer><%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MSKDetectorExe><; "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" /uninstall> [McAfee, Inc.]
<QuickTime Task><; "C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<Zone Labs Client><; "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"> [(Verified)Check Point Software Technologies Ltd.]
==================================
Startup Folders
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>
[BTTray]
<C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk --> C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [Broadcom Corporation.]><N>
==================================
Services
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[AVG7 Alert Manager Server / Avg7Alrt][Running/Auto Start]
<C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe><GRISOFT, s.r.o.>
[AVG7 Update Service / Avg7UpdSvc][Running/Auto Start]
<C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe><GRISOFT, s.r.o.>
[AVG E-mail Scanner / AVGEMS][Running/Auto Start]
<C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe><GRISOFT, s.r.o.>
[Bluetooth Service / btwdins][Running/Auto Start]
<C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation.>
[Cisco Systems, Inc. VPN Service / CVPND][Running/Auto Start]
<"C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"><Cisco Systems, Inc.>
[Google Updater Service / gusvc][Stopped/Manual Start]
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[HP WMI Interface / hpqwmi][Running/Manual Start]
<C:\Program Files\HPQ\SHARED\HPQWMI.exe><Hewlett-Packard Development Company, L.P.>
[iPod Service / iPodService][Stopped/Manual Start]
<"C:\Program Files\iPod\bin\iPodService.exe"><Apple Computer, Inc.>
[LightScribeService Direct Disc Labeling Service / LightScribeService][Running/Auto Start]
<"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"><>
[MATLAB Server / matlabserver][Running/Auto Start]
<C:\MATLAB7\webserver\bin\win32\matlabserver.exe><N/A>
[NMIndexingService / NMIndexingService][Stopped/Disabled]
<"C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"><N/A>
[TrueVector Internet Monitor / vsmon][Running/Auto Start]
<C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service><Zone Labs, LLC>
==================================
Drivers
[AliIde / AliIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD Processor Driver / AmdK8][Running/System Start]
<system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[AVG7 Kernel / Avg7Core][Running/System Start]
<\SystemRoot\System32\Drivers\avg7core.sys><GRISOFT, s.r.o.>
[AVG7 Wrap Driver / Avg7RsW][Running/System Start]
<\SystemRoot\System32\Drivers\avg7rsw.sys><GRISOFT, s.r.o.>
[AVG7 Resident Driver XP / Avg7RsXP][Running/System Start]
<\SystemRoot\System32\Drivers\avg7rsxp.sys><GRISOFT, s.r.o.>
[AVG7 Clean Driver / AvgClean][Running/System Start]
<\SystemRoot\System32\Drivers\avgclean.sys><GRISOFT, s.r.o.>
[AVG Network Redirector / AvgTdi][Running/Auto Start]
<\SystemRoot\System32\Drivers\avgtdi.sys><GRISOFT, s.r.o.>
[Broadcom 802.11 Network Adapter Driver / BCM43XX][Running/Manual Start]
<system32\DRIVERS\bcmwl5.sys><Broadcom Corporation>
[Bluetooth Bus Enumerator / BTKRNL][Running/Manual Start]
<system32\DRIVERS\btkrnl.sys><Broadcom Corporation.>
[WIDCOMM USB Bluetooth Driver / BTWUSB][Stopped/Manual Start]
<System32\Drivers\btwusb.sys><Broadcom Corporation.>
[Conexant AMC Audio / CAMCAUD][Running/Manual Start]
<system32\drivers\camc6aud.sys><Conexant Systems Inc.>
[CAMCHALA / CAMCHALA][Running/Manual Start]
<system32\drivers\camc6hal.sys><Conexant Systems Inc.>
[catchme / catchme][Stopped/Manual Start]
<\??\C:\DOCUME~1\AKINAJ~1\LOCALS~1\Temp\catchme.sys><N/A>
[Cisco Systems VPN Adapter / CVirtA][Stopped/Manual Start]
<system32\DRIVERS\CVirtA.sys><Cisco Systems, Inc.>
[Cisco Systems Inc. IPSec Driver / CVPNDRVA][Running/Manual Start]
<\??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys><Cisco Systems, Inc.>
[Deterministic Network Enhancer Miniport / DNE][Running/Manual Start]
<system32\DRIVERS\dne2000.sys><Deterministic Networks, Inc.>
[eabfiltr / eabfiltr][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\EABFiltr.sys><Hewlett-Packard Company>
[eabusb / eabusb][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\eabusb.sys><Hewlett-Packard Company>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[HSFHWATI / HSFHWATI][Running/Manual Start]
<system32\DRIVERS\HSFHWATI.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP][Running/Manual Start]
<system32\DRIVERS\HSF_DP.sys><Conexant Systems, Inc.>
[Logitech USB Monitor Filter / LVUSBSta][Stopped/Manual Start]
<system32\drivers\lvusbsta.sys><Logitech Inc.>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[HP Pci Information / pciinfo][Stopped/Auto Start]
<\??\C:\DOCUME~1\AKINAJ~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys><N/A>
[Logitech QuickCam Express(PID_0928) / PID_0928][Stopped/Manual Start]
<system32\DRIVERS\LV561AV.SYS><Logitech Inc.>
[Microsoft IntelliPoint Filter Driver / Point32][Stopped/Manual Start]
<system32\DRIVERS\point32.sys><Microsoft Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SMC IrCC Miniport Device Driver / SMCIRDA][Stopped/Manual Start]
<system32\DRIVERS\smcirda.sys><SMC>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[srescan / srescan][Running/Boot Start]
<\SystemRoot\system32\ZoneLabs\srescan.sys><Zone Labs, LLC>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[tifm21 / tifm21][Running/Manual Start]
<system32\drivers\tifm21.sys><Texas Instruments>
[vaxscsi / vaxscsi][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\vaxscsi.sys><Alcohol Soft Co., Ltd.>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[vsdatant / vsdatant][Running/System Start]
<System32\vsdatant.sys><Zone Labs, LLC>
[winachsf / winachsf][Running/Manual Start]
<system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
[WinDriver / WinDriver][Running/Auto Start]
<\SystemRoot\System32\drivers\windrvr.sys><Jungo>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[XilinxPC4Driver / XilinxPC4Driver][Running/Auto Start]
<\SystemRoot\System32\drivers\XPC4DRVR.SYS><Xilinx, Inc.>
==================================
Browser Add-ons
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[FGCatchUrl]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar4.dll, Google Inc.>
[FlashGet GetFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[Java Plug-in 1.6.0_02]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[&Research]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@btrez.dll,-4015]
{CCA281CA-C863-46ef-9331-5C8D4460577F} <, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar4.dll, Google Inc.>
[CKAVWebScan Object]
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} <C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll, Kaspersky Lab>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[BugsGameStarts Class]
{23D236EA-B936-4B2B-900C-D0E8DBBF9570} <C:\WINDOWS\Downloaded Program Files\ThaiGameStart.dll, Yedang Online.inc. >
[CPlayFirstDinerDash2Control Object]
{639658F3-B141-4D6B-B936-226F75A5EAC3} <C:\WINDOWS\Downloaded Program Files\DinerDash2.1.0.0.48.dll, PlayFirst, Inc.>
[Java Plug-in 1.6.0_02]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_02]
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_02]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll, Sun Microsystems, Inc.>
[FoInstaller Class]
{CE8267C2-D41A-4A50-A69D-F32B5C289F14} <C:\WINDOWS\Downloaded Program Files\FileOpenInstall.dll, FileOpen Systems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Google Script Object]
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar4.dll, Google Inc.>
[QuickTime Object]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[CKAVWebScan Object]
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} <C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll, Kaspersky Lab>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar4.dll, Google Inc.>
[Shockwave ActiveX Control]
{233C1507-6A77-46A4-9443-F871F945D258} <, N/A>
[BugsGameStarts Class]
{23D236EA-B936-4B2B-900C-D0E8DBBF9570} <C:\WINDOWS\Downloaded Program Files\ThaiGameStart.dll, Yedang Online.inc. >
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[FGCatchUrl]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[RealPlayer RAM Download Handler]
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[HtmlDlgSafeHelper Class]
{3050F819-98B5-11CF-BB82-00AA00BDCE0B} <C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[Microsoft Office Control]
{4453D895-F2A1-4A38-A285-1EF9BD3F6D5D} <C:\PROGRA~1\MICROS~4\OFFICE11\AUTHZAX.DLL, Microsoft Corporation>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[CKAVReportCtrl Object]
{6117669B-8C2D-41FA-A6D9-9E484B999CF0} <C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll, Kaspersky Lab>
[CPlayFirstDinerDash2Control Object]
{639658F3-B141-4D6B-B936-226F75A5EAC3} <C:\WINDOWS\Downloaded Program Files\DinerDash2.1.0.0.48.dll, PlayFirst, Inc.>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Calendar Control 11.0]
{8E27C92B-1264-101C-8A2F-040224009C02} <C:\Program Files\Microsoft Office\OFFICE11\MSCAL.OCX, Microsoft Corporation>
[IETimeBehaviorFactory Class]
{A4639D29-774E-11D3-A490-00C04F6843FB} <C:\PROGRA~1\COMMON~1\MICROS~1\MSORUN\MSORUN.DLL, Microsoft Corporation>
[IEAnimBehaviorFactory Class]
{A4639D2F-774E-11D3-A490-00C04F6843FB} <C:\PROGRA~1\COMMON~1\MICROS~1\MSORUN\MSORUN.DLL, Microsoft Corporation>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar4.dll, Google Inc.>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\system\msadc\msadco.dll, Microsoft Corporation>
[IWS Photo Upload Tool]
{BDE39388-8A55-4349-94F3-C7A5266779EA} <C:\PROGRA~1\MI048C~1\IMAGEU~1\OFFICE~1.DLL, Microsoft® Corporation>
[AUDIO__MID Moniker Class]
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__WAV Moniker Class]
{CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__MPEG Moniker Class]
{CD3AFA89-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[FoInstaller Class]
{CE8267C2-D41A-4A50-A69D-F32B5C289F14} <C:\WINDOWS\Downloaded Program Files\FileOpenInstall.dll, FileOpen Systems, Inc.>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[GetInfo Class]
{D5184A39-CBDF-4A4F-AC1A-7A45A852C883} <C:\PROGRA~1\Yahoo!\Common\yverinfo.dll, Yahoo! Inc.>
[MessengerChecker Class]
{DA4F543C-C8A9-4E88-9A79-548CBB46F18F} <C:\Program Files\Yahoo!\Messenger\YPagerChecker.dll, Yahoo! Inc.>
[FlashGet GetFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[FGAutoLive]
{F90D830D-C175-4bbe-82C7-FF94669A4C42} <C:\Program Files\FlashGet\fgupdate.dll, www.flashget.com>
[FGCatchUrl]
{FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[&Download All with FlashGet]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[&Download with FlashGet]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[E&xport to Microsoft Excel]
<res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000, N/A>
[Send To &Bluetooth]
<C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm, N/A>
==================================
Running Processes
[PID: 1072 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1120 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1160 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4114]
[PID: 1204 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1216 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1360 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4114]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2496]
[PID: 1392 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1504 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1664 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1736 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1976 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 920 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\bthcrp.dll] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\WidcommSdk.dll] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\wbtapi.dll] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\system32\pdf995mon.dll] [N/A, ]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0]
[PID: 1936 / SYSTEM][C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe] [GRISOFT, s.r.o., 7.5.0.453]
[C:\PROGRA~1\Grisoft\AVGFRE~1\avgklib.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\PROGRA~1\Grisoft\AVGFRE~1\avglog.dll] [GRISOFT, s.r.o., 7.5.0.429]
[C:\Program Files\Grisoft\AVG Free\avgcfg.dll] [GRISOFT, s.r.o., 7.5.0.460]
[C:\Program Files\Grisoft\AVG Free\avglng.dll] [GRISOFT, s.r.o., 7.5.0.429]
[C:\Program Files\Grisoft\AVG Free\avgamint.dll] [GRISOFT, s.r.o., 7.5.0.435]
[C:\Program Files\Grisoft\AVG Free\avgamsps.dll] [GRISOFT, s.r.o., 7.5.0.407]
[PID: 1956 / SYSTEM][C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe] [GRISOFT, s.r.o., 7.5.0.420]
[PID: 2024 / SYSTEM][C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe] [GRISOFT, s.r.o., 7.5.0.474]
[C:\PROGRA~1\Grisoft\AVGFRE~1\libsasl.dll] [GRISOFT, s.r.o., 7.5.0.407]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\PROGRA~1\Grisoft\AVGFRE~1\avglog.dll] [GRISOFT, s.r.o., 7.5.0.429]
[C:\Program Files\Grisoft\AVG Free\avgcfg.dll] [GRISOFT, s.r.o., 7.5.0.460]
[C:\Program Files\Grisoft\AVG Free\avgklib.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\Program Files\Grisoft\AVG Free\avglng.dll] [GRISOFT, s.r.o., 7.5.0.429]
[C:\Program Files\Grisoft\AVG Free\avgscan.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\Program Files\Grisoft\AVG Free\avgunarc.dll] [GRISOFT, s.r.o., 7.5.0.474]
[C:\PROGRA~1\Grisoft\AVGFRE~1\saslcrammd5.dll] [GRISOFT, s.r.o., 7.5.0.407]
[C:\PROGRA~1\Grisoft\AVGFRE~1\sasldigestmd5.dll] [GRISOFT, s.r.o., 7.5.0.407]
[C:\PROGRA~1\Grisoft\AVGFRE~1\sasllogin.dll] [GRISOFT, s.r.o., 7.5.0.407]
[C:\PROGRA~1\Grisoft\AVGFRE~1\saslplain.dll] [GRISOFT, s.r.o., 7.5.0.407]
[C:\Program Files\Grisoft\AVG Free\avgmail.dll] [GRISOFT, s.r.o., 7.5.0.429]
[C:\PROGRA~1\Grisoft\AVGFRE~1\avgemcps.dll] [GRISOFT, s.r.o., 7.5.0.420]
[PID: 252 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 268 / SYSTEM][C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe] [Broadcom Corporation., 4.0.1.900]
[PID: 304 / SYSTEM][C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe] [Cisco Systems, Inc., 4.6.04.0043]
[C:\WINDOWS\system32\vsdata.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\VSINIT.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\ZoneLabs\dbghelp.dll] [Microsoft Corporation, 6.2.0013.1 (DbgBuild.030619-2209)]
[C:\WINDOWS\system32\vspubapi.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\VSUTIL.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\vsmonapi.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\ZoneLabs\fbl.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\vsxml.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\zlcomm.dll] [Zone Labs, LLC, 7.0.337.000]
[C:\WINDOWS\system32\ZLCommDB.dll] [Zone Labs, LLC, 7.0.337.000]
[PID: 364 / SYSTEM][C:\Program Files\Common Files\LightScribe\LSSrvc.exe] [, 1.0.21.1]
[C:\Program Files\Common Files\LightScribe\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[PID: 428 / SYSTEM][C:\MATLAB7\webserver\bin\win32\matlabserver.exe] [N/A, ]
[C:\MATLAB7\bin\win32\libeng.dll] [The MathWorks Inc., 7.0.0.12365]
[C:\MATLAB7\bin\win32\libut.dll] [The MathWorks Inc., 7.0.0.12365]
[C:\MATLAB7\bin\win32\icuuc24.dll] [IBM Corporation and others, 2, 4, 0, 0]
[C:\MATLAB7\bin\win32\icudt24l.dll] [N/A, ]
[C:\MATLAB7\bin\win32\icuin24.dll] [IBM Corporation and others, 2, 4, 0, 0]
[C:\MATLAB7\bin\win32\icuio24.dll] [IBM Corporation and others, 2, 4, 0, 0]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\MATLAB7\bin\win32\libmx.dll] [The MathWorks Inc., 7.0.0.12365]
[C:\MATLAB7\bin\win32\libz.dll] [N/A, ]
[c:\matlab7\bin\win32\mwoles05.dll] [N/A, ]
[c:\matlab7\bin\win32\mvalue.dll] [N/A, ]
[c:\matlab7\bin\win32\comcli.dll] [N/A, ]
[c:\matlab7\bin\win32\m_dispatcher.dll] [N/A, ]
[c:\matlab7\bin\win32\xerces-c_2_1_0.dll] [Apache Software Foundation, 2, 1, 0]
[c:\matlab7\bin\win32\mpath.dll] [The MathWorks Inc., 7.0.0.14278]
[c:\matlab7\bin\win32\libmwservices.dll] [N/A, ]
[c:\matlab7\bin\win32\datasvcs.dll] [N/A, ]
[c:\matlab7\bin\win32\udd.dll] [N/A, ]
[c:\matlab7\bin\win32\mcos.dll] [N/A, ]
[c:\matlab7\bin\win32\uiw.dll] [The MathWorks Inc., 7.0.0.18578]
[c:\matlab7\bin\win32\libmwhardcopy.dll] [N/A, ]
[c:\matlab7\bin\win32\m_interpreter.dll] [The MathWorks Inc., 7.0.0.17225a]
[c:\matlab7\bin\win32\m_ir.dll] [N/A, ]
[c:\matlab7\bin\win32\libmex.dll] [The MathWorks Inc., 7.0.0.12365]
[c:\matlab7\bin\win32\mlib.dll] [N/A, ]
[c:\matlab7\bin\win32\m_parser.dll] [The MathWorks Inc., 7.0.0.14278]
[c:\matlab7\bin\win32\ir_xfmr.dll] [N/A, ]
[c:\matlab7\bin\win32\libmat.dll] [The MathWorks Inc., 7.0.0.12365]
[c:\matlab7\bin\win32\m_pcodeio.dll] [N/A, ]
[c:\matlab7\bin\win32\m_pcodegen.dll] [N/A, ]
[c:\matlab7\bin\win32\libmwgui.dll] [N/A, ]
[c:\matlab7\bin\win32\bridge.dll] [N/A, ]
[c:\matlab7\bin\win32\jmi.dll] [The MathWorks Inc., 7.0.0.14434]
[c:\matlab7\bin\win32\hg.dll] [The MathWorks Inc., 7.0.0.19355a]
[c:\matlab7\bin\win32\libuij.dll] [N/A, ]
[c:\matlab7\bin\win32\numerics.dll] [The MathWorks Inc., 7.0.0.14894]
[c:\matlab7\bin\win32\libfftw3.dll] [N/A, ]
[c:\matlab7\bin\win32\libfftw3f.dll] [N/A, ]
[c:\matlab7\bin\win32\libmwlapack.dll] [N/A, ]
[c:\matlab7\bin\win32\libmwumfpack.dll] [N/A, ]
[c:\matlab7\bin\win32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[c:\matlab7\bin\win32\udd_mi.dll] [The MathWorks Inc., 7.0.0.14245]
[c:\matlab7\bin\win32\uinone.dll] [N/A, ]
[c:\Matlab7\bin\win32\atlas_Athlon.dll] [N/A, ]
[C:\MATLAB7\bin\win32\lapack.dll] [N/A, ]
[C:\MATLAB7\bin\win32\DFORRT.dll] [Compaq Computer Corporation, 6.6 - 893 (Update A)]
[C:\MATLAB7\bin\win32\MFC71ENU.DLL] [Microsoft Corporation, 7.10.3077.0]
[PID: 568 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 740 / SYSTEM][c:\matlab7\bin\win32\matlab.exe] [The MathWorks Inc., 7.0.0.19156a]
[c:\matlab7\bin\win32\mcr.dll] [N/A, ]
[c:\matlab7\bin\win32\mpath.dll] [The MathWorks Inc., 7.0.0.14278]
[c:\matlab7\bin\win32\libut.dll] [The MathWorks Inc., 7.0.0.12365]
[c:\matlab7\bin\win32\icuuc24.dll] [IBM Corporation and others, 2, 4, 0, 0]
[c:\matlab7\bin\win32\icudt24l.dll] [N/A, ]
[c:\matlab7\bin\win32\icuin24.dll] [IBM Corporation and others, 2, 4, 0, 0]
[c:\matlab7\bin\win32\icuio24.dll] [IBM Corporation and others, 2, 4, 0, 0]
[c:\matlab7\bin\win32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[c:\matlab7\bin\win32\mwoles05.dll] [N/A, ]
[c:\matlab7\bin\win32\mvalue.dll] [N/A, ]
[c:\matlab7\bin\win32\libmx.dll] [The MathWorks Inc., 7.0.0.12365]
[c:\matlab7\bin\win32\libz.dll] [N/A, ]
[c:\matlab7\bin\win32\comcli.dll] [N/A, ]
[c:\matlab7\bin\win32\m_dispatcher.dll] [N/A, ]
[c:\matlab7\bin\win32\xerces-c_2_1_0.dll] [Apache Software Foundation, 2, 1, 0]
[c:\matlab7\bin\win32\libmwservices.dll] [N/A, ]
[c:\matlab7\bin\win32\datasvcs.dll] [N/A, ]
[c:\matlab7\bin\win32\udd.dll] [N/A, ]
[c:\matlab7\bin\win32\mcos.dll] [N/A, ]
[c:\matlab7\bin\win32\uiw.dll] [The MathWorks Inc., 7.0.0.18578]
[c:\matlab7\bin\win32\libmwhardcopy.dll] [N/A, ]
[c:\matlab7\bin\win32\m_interpreter.dll] [The MathWorks Inc., 7.0.0.17225a]
[c:\matlab7\bin\win32\m_ir.dll] [N/A, ]
[c:\matlab7\bin\win32\libmex.dll] [The MathWorks Inc., 7.0.0.12365]
[c:\matlab7\bin\win32\mlib.dll] [N/A, ]
[c:\matlab7\bin\win32\m_parser.dll] [The MathWorks Inc., 7.0.0.14278]
[c:\matlab7\bin\win32\ir_xfmr.dll] [N/A, ]
[c:\matlab7\bin\win32\libmat.dll] [The MathWorks Inc., 7.0.0.12365]
[c:\matlab7\bin\win32\m_pcodeio.dll] [N/A, ]
[c:\matlab7\bin\win32\m_pcodegen.dll] [N/A, ]
[c:\matlab7\bin\win32\libmwgui.dll] [N/A, ]
[c:\matlab7\bin\win32\bridge.dll] [N/A, ]
[c:\matlab7\bin\win32\jmi.dll] [The MathWorks Inc., 7.0.0.14434]
[c:\matlab7\bin\win32\hg.dll] [The MathWorks Inc., 7.0.0.19355a]
[c:\matlab7\bin\win32\libuij.dll] [N/A, ]
[c:\matlab7\bin\win32\numerics.dll] [The MathWorks Inc., 7.0.0.14894]
[c:\matlab7\bin\win32\libfftw3.dll] [N/A, ]
[c:\matlab7\bin\win32\libfftw3f.dll] [N/A, ]
[c:\matlab7\bin\win32\libmwlapack.dll] [N/A, ]
[c:\matlab7\bin\win32\libmwumfpack.dll] [N/A, ]
[c:\matlab7\bin\win32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[c:\matlab7\bin\win32\udd_mi.dll] [The MathWorks Inc., 7.0.0.14245]
[c:\matlab7\bin\win32\uinone.dll] [N/A, ]
[c:\matlab7\bin\win32\mlautoregister.dll] [N/A, ]
[c:\Matlab7\bin\win32\atlas_Athlon.dll] [N/A, ]
[c:\matlab7\bin\win32\lapack.dll] [N/A, ]
[c:\matlab7\bin\win32\DFORRT.dll] [Compaq Computer Corporation, 6.6 - 893 (Update A)]
[c:\matlab7\bin\win32\MFC71ENU.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\atioglxx.dll] [ATI Technologies Inc., 6.14.10.5014]
[c:\matlab7\sys\java\jre\win32\jre1.4.2\bin\client\jvm.dll] [N/A, ]
[c:\matlab7\sys\java\jre\win32\jre1.4.2\bin\hpi.dll] [N/A, ]
[c:\matlab7\sys\java\jre\win32\jre1.4.2\bin\verify.dll] [N/A, ]
[c:\matlab7\sys\java\jre\win32\jre1.4.2\bin\java.dll] [N/A, ]
[c:\matlab7\sys\java\jre\win32\jre1.4.2\bin\zip.dll] [N/A, ]
[C:\MATLAB7\sys\java\jre\win32\jre1.4.2\bin\awt.dll] [N/A, ]
[C:\MATLAB7\sys\java\jre\win32\jre1.4.2\bin\fontmanager.dll] [N/A, ]
[c:\matlab7\bin\win32\jmi_mi.dll] [N/A, ]
[C:\WINDOWS\Resources\themes\Luna\Luna.msstyles] [Microsoft, 1, 0, 0, 1]
[c:\matlab7\bin\win32\glren.dll] [The MathWorks Inc., 6.0.0.19901]
[c:\matlab7\bin\win32\libmwbuiltins.dll] [The MathWorks Inc., 7.0.0.12365]
[PID: 1824 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2688 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4114]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2496]
[PID: 2804 / Akinajang Akina][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] [N/A, ]
[C:\WINDOWS\system32\btncopy.dll] [Broadcom Corporation., 4.0.1.900]
[PID: 2912 / SYSTEM][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3104 / Akinajang Akina][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5145]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5145]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.ENU] [ATI Technologies, Inc., 6.14.10.5145]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5145]
[PID: 3120 / Akinajang Akina][C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe] [Hewlett-Packard Company, 1, 1, 1, 2]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[PID: 3128 / Akinajang Akina][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[PID: 3136 / Akinajang Akina][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[PID: 3216 / Akinajang Akina][C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe] [Hewlett-Packard , 5, 1, 1, 2]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\Program Files\HPQ\Quick Launch Buttons\CPQINFO.DLL] [Hewlett-Packard , 5, 1, 1, 2]
[C:\Program Files\HPQ\Quick Launch Buttons\HPQPRES.DLL] [Hewlett-Packard , 5, 1, 1, 2]
[PID: 3264 / Akinajang Akina][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3476 / Akinajang Akina][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3510]
[PID: 3484 / Akinajang Akina][C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe] [Hewlett-Packard, 2,3,0,0\ 162]
[C:\Program Files\Hewlett-Packard\HP Share-to-Web\S2WNSRES.DLL] [Hewlett-Packard, 2, 6, 0, 162]
[C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll] [N/A, ]
[PID: 3520 / Akinajang Akina][C:\WINDOWS\system32\LVCOMSX.EXE] [Logitech Inc., 8.4.1.1092]
[C:\WINDOWS\system32\lvmaenum.dll] [Logitech Inc., 8.4.1.1092]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[PID: 3536 / Akinajang Akina][C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe] [GRISOFT, s.r.o., 7.5.0.460]
[C:\PROGRA~1\Grisoft\AVGFRE~1\AvgTMgr.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\PROGRA~1\Grisoft\AVGFRE~1\AvgCtrl.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\PROGRA~1\Grisoft\AVGFRE~1\AvgAbout.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\PROGRA~1\Grisoft\AVGFRE~1\AvgTest.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\PROGRA~1\Grisoft\AVGFRE~1\AvgTRes.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\PROGRA~1\Grisoft\AVGFRE~1\AvgSet.dll] [, ]
[C:\MATLAB7\bin\win32\MFC71ENU.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\PROGRA~1\Grisoft\AVGFRE~1\avglog.dll] [GRISOFT, s.r.o., 7.5.0.429]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\Program Files\Grisoft\AVG Free\avgcfg.dll] [GRISOFT, s.r.o., 7.5.0.460]
[C:\Program Files\Grisoft\AVG Free\avgklib.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\Program Files\Grisoft\AVG Free\avglng.dll] [GRISOFT, s.r.o., 7.5.0.429]
[C:\Program Files\Grisoft\AVG Free\AVGRES.DLL] [N/A, ]
[C:\Program Files\Grisoft\AVG Free\avgcckrn.dll] [GRISOFT, s.r.o., 7.5.0.460]
[C:\Program Files\Grisoft\AVG Free\avgvault.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\Program Files\Grisoft\AVG Free\avgrep.dll] [GRISOFT, s.r.o., 7.5.0.448]
[C:\Program Files\Grisoft\AVG Free\avgunarc.dll] [GRISOFT, s.r.o., 7.5.0.474]
[C:\PROGRA~1\Grisoft\AVGFRE~1\avgemsui.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\PROGRA~1\Grisoft\AVGFRE~1\avgemcps.dll] [GRISOFT, s.r.o., 7.5.0.420]
[C:\Program Files\Grisoft\AVG Free\avgscan.dll] [GRISOFT, s.r.o., 7.5.0.458]
[C:\Program Files\Grisoft\AVG Free\avgcore.dll] [GRISOFT, s.r.o., 7.5.0.476]
[C:\Program Files\Grisoft\AVG Free\avgamsps.dll] [GRISOFT, s.r.o., 7.5.0.407]
[C:\Program Files\Grisoft\AVG Free\avgf.dll] [N/A, ]
[PID: 3552 / Akinajang Akina][C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe] [Hewlett-Packard Co., 50.0.146.000]
[PID: 3600 / Akinajang Akina][C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe] [Sun Microsystems, Inc., 6.0.20.6]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[PID: 3700 / Akinajang Akina][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[PID: 3748 / Akinajang Akina][C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe] [, 2, 6, 0, 162]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\Program Files\Hewlett-Packard\HP Share-to-Web\S2WNSRES.DLL] [Hewlett-Packard, 2, 6, 0, 162]
[C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll] [N/A, ]
[PID: 3876 / Akinajang Akina][C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\wbtapi.dll] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\btosif.dll] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\btwhidcs.DLL] [Broadcom Corporation., 4.0.1.900]
[C:\Program Files\WIDCOMM\Bluetooth Software\BtBalloon.dll] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\btrez.dll] [Broadcom Corporation., 4.0.1.900]
[C:\WINDOWS\system32\CSH.dll] [Blue Sky Software Corporation, 2.00.039]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] [N/A, ]
[PID: 3872 / SYSTEM][C:\Program Files\HPQ\SHARED\HPQWMI.exe] [Hewlett-Packard Development Company, L.P., 1, 0, 4, 3]
[PID: 2444 / Akinajang Akina][C:\Program Files\Mozilla Firefox\firefox.exe] [Mozilla Corporation, 1.8.0.9: 2006120612]
[C:\Program Files\Mozilla Firefox\js3250.dll] [Netscape Communications Corporation, 4.0]
[C:\Program Files\Mozilla Firefox\nspr4.dll] [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\Mozilla Firefox\xpcom_core.dll] [Mozilla Foundation, 1.8.0.9: 2006120612]
[C:\Program Files\Mozilla Firefox\plc4.dll] [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\Mozilla Firefox\plds4.dll] [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\Mozilla Firefox\smime3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\nss3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\softokn3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\ssl3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\xpcom_compat.dll] [Mozilla Foundation, 1.8.0.9: 2006120612]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\Program Files\Mozilla Firefox\components\jar50.dll] [Mozilla Foundation, 1.8.0.9: 2006120612]
[C:\Program Files\Mozilla Firefox\nssckbi.dll] [Netscape Communications Corporation, 1.53]
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] [N/A, ]
[PID: 2896 / Akinajang Akina][C:\SysEngr\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.13.0.1 02Feb05]
[C:\SysEngr\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
File Associations
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock Provider
N/A
==================================
Autorun.Inf
N/A
==================================
HOSTS File
127.0.0.1 localhost
==================================
Process Privileges Scan
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 268, C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 740, C:\MATLAB7\BIN\WIN32\MATLAB.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3104, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3120, C:\PROGRAM FILES\HPQ\HP WIRELESS ASSISTANT\HP WIRELESS ASSISTANT.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3216, C:\PROGRAM FILES\HPQ\QUICK LAUNCH BUTTONS\EABSERVR.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3476, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3484, C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3520, C:\WINDOWS\SYSTEM32\LVCOMSX.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3536, C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3552, C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3748, C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3876, C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BTTRAY.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2444, C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE]
==================================
API HOOK
N/A
==================================
Hidden Process
N/A
==================================
Last edited by hwstdez; 08-11-2007 at 01:21 AM. |
|
|
|
|
08-11-2007, 01:24 AM
|
#20 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Virus keep popping up in Content.IE5
Please do the SRENG scan with IE running
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
