|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-09-2008, 03:49 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 27
OS: Windows XP SP2
|
No Icon No Taskbar Just Wallpaper
Hi there,
My computer had been acting strangely these past few days after I downloaded a video codec from a website. I forget which website. After I had downloaded it, my wallpaper changes to a blue one and when it come to the screensaver, there will be like insect eating it.... But luckily i managed to resolve the problem and revert it back to my normal wallpaper and screensaver. But unfortunately, the worst of all is still in my computer which is having no icon and taskbar and only the wallpaper. Sometime it appear and then disappear. I tried many ways to remove it but to no avail. Well, I hope you guys can resolve this A.S.A.P since I need this computer for work. Thanks in advance. Here is the log: Deckard's System Scanner v20071014.68 Run by Home on 2008-06-09 18:21:29 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 57: 2008-06-09 10:21:51 UTC - RP1129 - Deckard's System Scanner Restore Point 56: 2008-06-09 06  34 UTC - RP1128 - Restore Operation55: 2008-06-06 15:16:34 UTC - RP1127 - Installed Ad-Aware 54: 2008-06-06 12:30:26 UTC - RP1126 - Installed AdwareAlert 53: 2008-06-06 11:54:53 UTC - RP1125 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2008-03-30 18:18:40 UTC - RP1073 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Home.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:25:48, on 09/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\VM_STI.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Documents and Settings\Home\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Home.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\imapi.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {07DF7501-A4E0-452E-B36C-170614D115D8} - (no file) O2 - BHO: (no name) - {189A78B1-CEB8-45FD-9C12-4B9C8A965A58} - C:\WINDOWS\system32\tuvTlmLE.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {7298ECDD-7C93-4EF8-9296-3BE188269346} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {81DBF13B-9EE9-43D4-96E9-E1270DE1DDA7} - C:\WINDOWS\system32\byXPiIca.dll O2 - BHO: (no name) - {8FC89E07-D848-41E5-A9AB-2CB71591EFAC} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {988E6186-A4F2-4192-BE95-7A91C8F458F2} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: QXK Olive - {C607C322-F4DF-44B7-98F5-FCAE55BADEA0} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE KINSTONE USB PC Camera O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ParetoLogic Anti-Spyware] "C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" -NM -hidesplash O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe O4 - Startup: ImationFlashDetect.lnk = C:\Program Files\Imation\ImationFlashDetect.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} - https://www.windowsonecare.com/insta...SSWebAgent.CAB O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll O20 - Winlogon Notify: tuvTlmLE - C:\WINDOWS\SYSTEM32\tuvTlmLE.dll O21 - SSODL: adgpfoxs - {693D26B7-D602-43B5-943E-5373D6065550} - (no file) O21 - SSODL: erpobmsw - {30779CEC-6651-4432-A961-6A3A59A4B253} - (no file) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 10891 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20071005-214200-383 O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing) backup-20071005-214200-603 O2 - BHO: (no name) - {EB4B152B-81A7-411F-9967-C5BFD6AA69B2} - C:\WINDOWS\system32\geede.dll (file missing) backup-20071005-214200-686 O2 - BHO: (no name) - {8BB99093-CF31-4AB9-9B4D-0EF876979162} - C:\WINDOWS\system32\woiiiuaa.dll (file missing) -- File Associations ----------------------------------------------------------- .js - JSFile - shell\open\command - NOTEPAD.EXE %1 .vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Teefer (Teefer for NT) - c:\windows\system32\drivers\teefer.sys <Not Verified; Sygate Technologies, Inc.; Sygate Teefer Driver> R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt> R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path Manager® (32-bit)> R2 npkcrypt - c:\program files\wizet\maplestory\npkcrypt.sys <Not Verified; INCA Internet Co., Ltd.; nProtect KeyCrypt Driver> R2 sbbotdi - c:\program files\speedbit video accelerator\sbbotdi.sys <Not Verified; SpeedBit Ltd.; Speedbit TDI Driver> R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> S3 NSNDIS5 (NSNDIS5 NDIS Protocol Driver) - c:\windows\system32\nsndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); NetStumbler> S3 ZSMC301b (KINSTONE USB PC Camera) - c:\windows\system32\drivers\usbvm31b.sys <Not Verified; VM; > -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 MpService - c:\program files\canon\multipass4\mpservic.exe <Not Verified; Canon Inc.; Canon MultiPASS> R2 sp_rssrv (Spyware Terminator Realtime Shield Service) - "c:\program files\spyware terminator\sp_rsser.exe" <Not Verified; Crawler.com; Crawler Spyware Terminator> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-09 15:00:49 404 --a------ C:\WINDOWS\Tasks\Pareto UNS.job 2008-06-09 15:00:32 446 --a------ C:\WINDOWS\Tasks\ParetoLogic Anti-Spyware.job 2008-06-09 15:00:25 410 --a------ C:\WINDOWS\Tasks\ParetoLogic Update.job 2008-06-09 14:53:51 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job 2007-10-05 17:42:53 402 --ah----- C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job -- Files created between 2008-05-09 and 2008-06-09 ----------------------------- 2008-06-09 17:41:05 0 d-------- C:\Program Files\SpywareBlaster 2008-06-09 15:05:07 0 d-------- C:\Program Files\Enigma Software Group 2008-06-09 15:00:31 0 d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware 2008-06-09 15:00:24 0 d-------- C:\Program Files\ParetoLogic 2008-06-09 15:00:22 0 d-------- C:\Program Files\Common Files\ParetoLogic 2008-06-07 12:14:08 190196 --ahs---- C:\WINDOWS\system32\acIiPXyb.ini2 2008-06-07 12:13:28 320256 --a------ C:\WINDOWS\system32\byXPiIca.dll 2008-06-07 01:26:35 77312 --a------ C:\WINDOWS\system32\ztvunace26.dll 2008-06-07 01:26:34 162304 --a------ C:\WINDOWS\system32\ztvunrar36.dll 2008-06-07 01:26:33 69632 --a------ C:\WINDOWS\system32\ztvcabinet.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> 2008-06-07 01:26:32 75264 --a------ C:\WINDOWS\system32\unacev2.dll 2008-06-07 01:26:31 153088 --a------ C:\WINDOWS\system32\UNRAR3.dll 2008-06-07 01:26:25 0 d-------- C:\Documents and Settings\Home\Application Data\Simply Super Software 2008-06-07 01:26:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software 2008-06-07 01:26:24 0 d-------- C:\Program Files\Trojan Remover 2008-06-06 23:16:41 0 d-------- C:\Program Files\Lavasoft 2008-06-06 23:16:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-06 23:16:03 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-06 21:23:38 0 d-------- C:\Program Files\Panda Security 2008-06-06 14:50:49 0 dr-h----- C:\Documents and Settings\Home\Recent 2008-06-06 14:34:44 0 d-------- C:\Documents and Settings\Administrator\Application Data\Spyware Terminator 2008-06-06 13:00:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-05 21:53:50 141312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-06-05 21:53:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator 2008-06-05 21:53:46 0 d-------- C:\Documents and Settings\Home\Application Data\Spyware Terminator 2008-06-05 21:53:41 0 d-------- C:\Program Files\Spyware Terminator 2008-06-05 20:39:18 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-06-05 19:09:20 0 d-------- C:\Program Files\IObit 2008-06-05 18:21:36 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-05 18:20:52 0 d-------- C:\Program Files\Spyware Doctor 2008-06-05 18:20:52 0 d-------- C:\Documents and Settings\Home\Application Data\PC Tools 2008-06-05 17:44:41 0 d-------- C:\Program Files\Windows Defender 2008-06-05 17:12:58 126453 --ahs---- C:\WINDOWS\system32\PYcJQXbc.ini2 2008-06-05 16:58:15 33920 --a------ C:\WINDOWS\system32\tuvTlmLE.dll 2008-06-03 22:19:13 0 d-------- C:\Documents and Settings\Home\EurekaLog 2008-06-02 02:27:28 487479 --a------ C:\WINDOWS\system32\SkinMagic.dll <Not Verified; Appspeed Inc.; Appspeed SkinMagic Toolkit> 2008-06-02 02:27:28 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; > 2008-06-02 02:27:28 7277568 --a------ C:\WINDOWS\system32\iPodmedia.dll 2008-06-02 02:27:28 719872 --a------ C:\WINDOWS\system32\devil.dll <Not Verified; Abysmal Software; Developer's Image Library (DevIL)> 2008-06-02 02:27:28 0 d-------- C:\WINDOWS\system32\avsplugin 2008-06-02 02:27:28 313344 --a------ C:\WINDOWS\system32\avisynth.dll <Not Verified; The Public; Avisynth 2.5> 2008-06-02 02:27:28 0 d-------- C:\Program Files\Smallvideosoft 2008-05-29 21:34:37 0 d-------- C:\Documents and Settings\Home\Application Data\Hamachi 2008-05-29 21:34:05 0 d-------- C:\Program Files\Hamachi 2008-05-28 19:37:05 0 d-------- C:\Program Files\Network Stumbler 2008-05-27 02:54:35 0 d-------- C:\Program Files\CubedLabs YouTube Download & Convert 2008-05-27 02:37:34 34 --ah----- C:\WINDOWS\system32\DVDRippper_sysquict.dat 2008-05-27 02:37:26 0 d-------- C:\Program Files\Abcc Free FLV to AVI WMV MPEG MP4 MOV Converter 2008-05-19 23:50:57 0 d-------- C:\Documents and Settings\Home\Application Data\WinRAR -- Find3M Report --------------------------------------------------------------- 2008-06-09 15:00:22 0 d-------- C:\Program Files\Common Files 2008-06-09 13:33:38 0 d-------- C:\Documents and Settings\Home\Application Data\AVG7 2008-04-21 20:51:35 0 d-------- C:\Program Files\MSN Messenger 2008-04-21 20:50:44 0 d-------- C:\Program Files\Windows Live 2008-04-21 20:49:46 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-18 00:43:53 0 d-------- C:\Documents and Settings\Home\Application Data\Real 2008-04-18 00:38:01 0 d-------- C:\Program Files\Common Files\xing shared 2008-04-18 00:37:52 0 d-------- C:\Program Files\Common Files\Real 2008-04-18 00:37:34 0 d-------- C:\Program Files\Real 2008-03-21 15:05:29 32768 --a------ C:\WINDOWS\system32\GTGina.dll <Not Verified; Gemtek; GTGina Dynamic Link Library> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07DF7501-A4E0-452E-B36C-170614D115D8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{189A78B1-CEB8-45FD-9C12-4B9C8A965A58}] 05/06/2008 16:58 33920 --a------ C:\WINDOWS\system32\tuvTlmLE.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7298ECDD-7C93-4EF8-9296-3BE188269346}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{81DBF13B-9EE9-43D4-96E9-E1270DE1DDA7}] 07/06/2008 12:13 320256 --a------ C:\WINDOWS\system32\byXPiIca.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8FC89E07-D848-41E5-A9AB-2CB71591EFAC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{988E6186-A4F2-4192-BE95-7A91C8F458F2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C607C322-F4DF-44B7-98F5-FCAE55BADEA0}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [20/06/2005 18:53] "SoundMan"="SOUNDMAN.EXE" [09/02/2004 16:54 C:\WINDOWS\SOUNDMAN.EXE] "MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe" [01/11/2002 16:13] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/12/2007 01:41] "nwiz"="nwiz.exe" [05/12/2007 01:41 C:\WINDOWS\system32\nwiz.exe] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [15/12/2004 19:01] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [17/04/2008 18:53] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [15/10/2004 19:40] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/10/2006 09:36] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/12/2007 01:41] "SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [30/03/2008 00:06] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [18/04/2008 00:37] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [03/11/2006 19:20] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [10/04/2008 15:14] "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [03/06/2008 20:33] "SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [23/01/2008 15:47] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 20:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/10/2004 00:24] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/09/2007 14:29] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 16:45] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [28/01/2008 11:43] "ParetoLogic Anti-Spyware"="C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" [05/06/2008 03:14] C:\Documents and Settings\Home\Start Menu\Programs\Startup\ hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [29/05/2008 21:34:05] ImationFlashDetect.lnk - C:\Program Files\Imation\ImationFlashDetect.exe [21/01/2007 19:48:25] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 22:05:26] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispScrSavPage"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{189A78B1-CEB8-45FD-9C12-4B9C8A965A58}"= C:\WINDOWS\system32\tuvTlmLE.dll [05/06/2008 16:58 33920] "{51C55F9E-C308-4c95-89AB-8858D8AFD819}"= C:\Program Files\ParetoLogic\Anti-Spyware\PASShlExt.dll [05/06/2008 03:14 98304] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvTlmLE] tuvTlmLE.dll 05/06/2008 16:58 33920 C:\WINDOWS\system32\tuvTlmLE.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\byXPiIca [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe *Newly Created Service* - GTNDIS5 -- End of Deckard's System Scanner: finished at 2008-06-09 18:29:42 ------------ Last edited by xchocochips; 06-09-2008 at 03:55 AM. |
|
     |
| Sponsored Links |
|
06-15-2008, 09:07 AM
|
#3 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: No Icon No Taskbar Just Wallpaper
Hello and welcome to TSF
Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below. ========= Please run Deckard's System Scanner once again, this time using these instructions: Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "%userprofile%\desktop\dss.exe" /config Click on Extra Log and tick all boxes below that. Click Scan! When finished, it shall produce two logs for you. Post those logs in your next reply. ========== Logs Required C:\Deckard\System Scanner\main.txt C:\Deckard\System Scanner\extra.txt<---Attached
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information.  Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
06-15-2008, 11:44 AM
|
#4 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 27
OS: Windows XP SP2
|
Re: No Icon No Taskbar Just Wallpaper
Now the problem seems to be gone just like that. My computer had been showing strange things lately such as mention in the previous post but I doubt the malware had been fully removed. Its just gone like that without me doing anything.
Thanks for helping me anyway and here is the log: Deckard's System Scanner v20071014.68 Run by Home on 2008-06-16 02:34:53 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Home.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:35:00, on 16/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Canon\MultiPASS4\MPTBox.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Imation\ImationFlashDetect.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Home\desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Home.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\PROGRA~1\SPEEDB~1\proxy.pac O2 - BHO: (no name) - {017D90B5-F081-4119-99ED-3231F0E744C8} - C:\WINDOWS\system32\byXPiIca.dll (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {07DF7501-A4E0-452E-B36C-170614D115D8} - (no file) O2 - BHO: (no name) - {189A78B1-CEB8-45FD-9C12-4B9C8A965A58} - C:\WINDOWS\system32\tuvTlmLE.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {7298ECDD-7C93-4EF8-9296-3BE188269346} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8FC89E07-D848-41E5-A9AB-2CB71591EFAC} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {988E6186-A4F2-4192-BE95-7A91C8F458F2} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: QXK Olive - {C607C322-F4DF-44B7-98F5-FCAE55BADEA0} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE KINSTONE USB PC Camera O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: ImationFlashDetect.lnk = C:\Program Files\Imation\ImationFlashDetect.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} - https://www.windowsonecare.com/insta...SSWebAgent.CAB O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll O20 - Winlogon Notify: tuvTlmLE - tuvTlmLE.dll (file missing) O21 - SSODL: adgpfoxs - {693D26B7-D602-43B5-943E-5373D6065550} - (no file) O21 - SSODL: erpobmsw - {30779CEC-6651-4432-A961-6A3A59A4B253} - (no file) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 10734 bytes -- Files created between 2008-05-16 and 2008-06-16 ----------------------------- 2008-06-13 03:12:07 0 d-------- C:\Program Files\Sun 2008-06-09 17:41:05 0 d-------- C:\Program Files\SpywareBlaster 2008-06-09 15:05:07 0 d-------- C:\Program Files\Enigma Software Group 2008-06-09 15:00:31 0 d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware 2008-06-07 12:14:08 79627 --ahs---- C:\WINDOWS\system32\acIiPXyb.ini2 2008-06-07 01:26:25 0 d-------- C:\Documents and Settings\Home\Application Data\Simply Super Software 2008-06-06 23:16:41 0 d-------- C:\Program Files\Lavasoft 2008-06-06 23:16:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-06 23:16:03 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-06 21:23:38 0 d-------- C:\Program Files\Panda Security 2008-06-06 14:50:49 0 dr-h----- C:\Documents and Settings\Home\Recent 2008-06-06 14:34:44 0 d-------- C:\Documents and Settings\Administrator\Application Data\Spyware Terminator 2008-06-06 13:00:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-05 20:39:18 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-06-05 19:09:20 0 d-------- C:\Program Files\IObit 2008-06-05 18:21:36 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-05 18:20:52 0 d-------- C:\Program Files\Spyware Doctor 2008-06-05 18:20:52 0 d-------- C:\Documents and Settings\Home\Application Data\PC Tools 2008-06-05 17:44:41 0 d-------- C:\Program Files\Windows Defender 2008-06-05 17:12:58 126453 --ahs---- C:\WINDOWS\system32\PYcJQXbc.ini2 2008-06-03 22:19:13 0 d-------- C:\Documents and Settings\Home\EurekaLog 2008-06-02 02:27:28 487479 --a------ C:\WINDOWS\system32\SkinMagic.dll <Not Verified; Appspeed Inc.; Appspeed SkinMagic Toolkit> 2008-06-02 02:27:28 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; > 2008-06-02 02:27:28 7277568 --a------ C:\WINDOWS\system32\iPodmedia.dll 2008-06-02 02:27:28 719872 --a------ C:\WINDOWS\system32\devil.dll <Not Verified; Abysmal Software; Developer's Image Library (DevIL)> 2008-06-02 02:27:28 0 d-------- C:\WINDOWS\system32\avsplugin 2008-06-02 02:27:28 313344 --a------ C:\WINDOWS\system32\avisynth.dll <Not Verified; The Public; Avisynth 2.5> 2008-06-02 02:27:28 0 d-------- C:\Program Files\Smallvideosoft 2008-05-29 21:34:37 0 d-------- C:\Documents and Settings\Home\Application Data\Hamachi 2008-05-28 19:37:05 0 d-------- C:\Program Files\Network Stumbler 2008-05-27 02:54:35 0 d-------- C:\Program Files\CubedLabs YouTube Download & Convert 2008-05-27 02:37:34 34 --ah----- C:\WINDOWS\system32\DVDRippper_sysquict.dat 2008-05-27 02:37:26 0 d-------- C:\Program Files\Abcc Free FLV to AVI WMV MPEG MP4 MOV Converter 2008-05-19 23:50:57 0 d-------- C:\Documents and Settings\Home\Application Data\WinRAR -- Find3M Report --------------------------------------------------------------- 2008-06-15 19:45:22 0 d-------- C:\Documents and Settings\Home\Application Data\AVG7 2008-06-13 13:05:25 0 d-------- C:\Program Files\SpeedBit Video Accelerator 2008-06-13 03:09:47 0 d-------- C:\Program Files\Java 2008-06-12 23:58:36 0 d-------- C:\Program Files\Common Files 2008-04-21 20:51:35 0 d-------- C:\Program Files\MSN Messenger 2008-04-21 20:50:44 0 d-------- C:\Program Files\Windows Live 2008-04-21 20:49:46 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-18 00:43:53 0 d-------- C:\Documents and Settings\Home\Application Data\Real 2008-04-18 00:38:01 0 d-------- C:\Program Files\Common Files\xing shared 2008-04-18 00:37:52 0 d-------- C:\Program Files\Common Files\Real 2008-04-18 00:37:34 0 d-------- C:\Program Files\Real 2008-03-21 15:05:29 32768 --a------ C:\WINDOWS\system32\GTGina.dll <Not Verified; Gemtek; GTGina Dynamic Link Library> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{017D90B5-F081-4119-99ED-3231F0E744C8}] C:\WINDOWS\system32\byXPiIca.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07DF7501-A4E0-452E-B36C-170614D115D8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{189A78B1-CEB8-45FD-9C12-4B9C8A965A58}] C:\WINDOWS\system32\tuvTlmLE.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7298ECDD-7C93-4EF8-9296-3BE188269346}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8FC89E07-D848-41E5-A9AB-2CB71591EFAC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{988E6186-A4F2-4192-BE95-7A91C8F458F2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C607C322-F4DF-44B7-98F5-FCAE55BADEA0}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [20/06/2005 18:53] "SoundMan"="SOUNDMAN.EXE" [09/02/2004 16:54 C:\WINDOWS\SOUNDMAN.EXE] "MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe" [01/11/2002 16:13] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/12/2007 01:41] "nwiz"="nwiz.exe" [05/12/2007 01:41 C:\WINDOWS\system32\nwiz.exe] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [15/12/2004 19:01] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [17/04/2008 18:53] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [15/10/2004 19:40] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/10/2006 09:36] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/12/2007 01:41] "SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [30/03/2008 00:06] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [18/04/2008 00:37] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [03/11/2006 19:20] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [10/04/2008 15:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 20:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/10/2004 00:24] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/09/2007 14:29] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 16:45] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [28/01/2008 11:43] C:\Documents and Settings\Home\Start Menu\Programs\Startup\ ImationFlashDetect.lnk - C:\Program Files\Imation\ImationFlashDetect.exe [21/01/2007 19:48:25] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 22:05:26] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispScrSavPage"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{189A78B1-CEB8-45FD-9C12-4B9C8A965A58}"= C:\WINDOWS\system32\tuvTlmLE.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvTlmLE] tuvTlmLE.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\byXPiIca [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe -- End of Deckard's System Scanner: finished at 2008-06-16 02:36:01 ------------ |
|
|
|
|
06-15-2008, 01:03 PM
|
#5 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: No Icon No Taskbar Just Wallpaper
Hello again
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ========== S& D Spybot's Tea Timer While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
---------- Windows Defender Please disable your Windows Defender Real-time Protection, as it may hinder the removal of some entries.
========== Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O2 - BHO: (no name) - {017D90B5-F081-4119-99ED-3231F0E744C8} - C:\WINDOWS\system32\byXPiIca.dll (file missing) O2 - BHO: (no name) - {07DF7501-A4E0-452E-B36C-170614D115D8} - (no file) O2 - BHO: (no name) - {189A78B1-CEB8-45FD-9C12-4B9C8A965A58} - C:\WINDOWS\system32\tuvTlmLE.dll (file missing) O2 - BHO: (no name) - {7298ECDD-7C93-4EF8-9296-3BE188269346} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8FC89E07-D848-41E5-A9AB-2CB71591EFAC} - (no file) O2 - BHO: (no name) - {988E6186-A4F2-4192-BE95-7A91C8F458F2} - (no file) O2 - BHO: QXK Olive - {C607C322-F4DF-44B7-98F5-FCAE55BADEA0} - (no file) O20 - Winlogon Notify: tuvTlmLE - tuvTlmLE.dll (file missing) O21 - SSODL: adgpfoxs - {693D26B7-D602-43B5-943E-5373D6065550} - (no file) O21 - SSODL: erpobmsw - {30779CEC-6651-4432-A961-6A3A59A4B253} - (no file) Please remember to close all other windows, including browsers then click Fix checked. ========= Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========= Logs Required C:\Combofix.txt Hijackthis Log
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
06-15-2008, 11:51 PM
|
#6 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 27
OS: Windows XP SP2
|
Re: No Icon No Taskbar Just Wallpaper
Ok... Here is the two logs.
ComboFix 08-06-15.4 - Home 2008-06-16 14:33:10.1 - NTFSx86 Running from: C:\Documents and Settings\Home\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Home\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point . ADS - svchost.exe: deleted 68 bytes in 1 streams. ADS - ntoskrnl.exe: deleted 228 bytes in 1 streams. ADS - explorer.exe: deleted 228 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\acIiPXyb.ini C:\WINDOWS\system32\acIiPXyb.ini2 C:\WINDOWS\system32\agkjbdka.ini C:\WINDOWS\system32\aikklskd.ini C:\WINDOWS\system32\aoqyxexo.ini C:\WINDOWS\system32\cikynklx.ini C:\WINDOWS\system32\ckoghdkw.ini C:\WINDOWS\system32\csuhbpfn.ini C:\WINDOWS\system32\dseqaxex.ini C:\WINDOWS\system32\eyqwybyk.ini C:\WINDOWS\system32\guyviict.ini C:\WINDOWS\system32\gxgptrqt.ini C:\WINDOWS\system32\iesfbydp.ini C:\WINDOWS\system32\kmqgbdgb.ini C:\WINDOWS\system32\ldushwjh.ini C:\WINDOWS\system32\lquqsopg.ini C:\WINDOWS\system32\lxuhxbeh.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nlngpsyy.ini C:\WINDOWS\system32\oavmoitv.ini C:\WINDOWS\system32\pjqqickr.ini C:\WINDOWS\system32\PYcJQXbc.ini C:\WINDOWS\system32\PYcJQXbc.ini2 C:\WINDOWS\system32\qclmpdou.ini C:\WINDOWS\system32\qnpikwtv.ini C:\WINDOWS\system32\quyljros.ini C:\WINDOWS\system32\reoamhcw.ini C:\WINDOWS\system32\thcfxyxe.ini C:\WINDOWS\system32\thjytymr.ini C:\WINDOWS\system32\tpdlqmjx.ini C:\WINDOWS\system32\twtkcack.ini C:\WINDOWS\system32\uveosdtn.ini C:\WINDOWS\system32\uxxpiumo.ini C:\WINDOWS\system32\vpxxaxfs.ini C:\WINDOWS\system32\wprsecbk.ini C:\WINDOWS\system32\xqpgjqub.ini C:\WINDOWS\system32\xtwhpajs.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ASC3550P -------\Legacy_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2008-05-16 to 2008-06-16 ))))))))))))))))))))))))))))))) . 2008-06-13 03:12 . 2008-06-13 03:12 <DIR> d-------- C:\Program Files\Sun 2008-06-13 00:34 . 2008-06-13 00:34 127 --a------ C:\WINDOWS\system32\MRT.INI 2008-06-13 00:08 . 2008-06-13 00:22 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-06-11 22:36 . 2008-04-14 19:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 22:36 . 2008-04-14 19:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-09 18:12 . 2008-06-09 18:12 <DIR> d-------- C:\Deckard 2008-06-09 17:41 . 2008-06-09 17:41 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-09 17:41 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-06-09 15:05 . 2008-06-09 15:05 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-06-09 15:00 . 2008-06-09 15:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware 2008-06-07 01:26 . 2008-06-07 01:26 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Simply Super Software 2008-06-06 23:16 . 2008-06-06 23:16 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-06 23:16 . 2008-06-06 23:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-06 23:16 . 2008-06-06 23:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-06 21:23 . 2008-06-06 21:33 <DIR> d-------- C:\Program Files\Panda Security 2008-06-06 14:34 . 2008-06-06 14:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Spyware Terminator 2008-06-06 13:48 . 2008-06-06 13:48 95 --a------ C:\WINDOWS\wininit.ini 2008-06-06 13:00 . 2008-06-06 13:00 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-06 13:00 . 2008-06-06 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-05 20:39 . 2008-06-05 20:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-06-05 19:09 . 2008-06-05 19:09 <DIR> d-------- C:\Program Files\IObit 2008-06-05 18:21 . 2008-06-16 14:32 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-05 18:21 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-05 18:21 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-05 18:21 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-05 18:21 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-05 18:20 . 2008-06-16 14:14 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-05 18:20 . 2008-06-05 18:20 <DIR> d-------- C:\Documents and Settings\Home\Application Data\PC Tools 2008-06-05 17:44 . 2008-06-05 17:44 <DIR> d-------- C:\Program Files\Windows Defender 2008-06-05 17:14 . 2008-06-05 17:14 95,232 --a------ C:\WINDOWS\system32\xixjubfl.dll.vir 2008-06-03 22:19 . 2008-06-03 22:19 <DIR> d-------- C:\Documents and Settings\Home\EurekaLog 2008-06-02 02:27 . 2008-06-02 02:27 <DIR> d-------- C:\WINDOWS\system32\avsplugin 2008-06-02 02:27 . 2008-06-02 02:27 <DIR> d-------- C:\Program Files\Smallvideosoft 2008-06-02 02:27 . 2007-03-12 17:49 7,277,568 --a------ C:\WINDOWS\system32\iPodmedia.dll 2008-06-02 02:27 . 2004-05-26 20:37 719,872 --a------ C:\WINDOWS\system32\devil.dll 2008-06-02 02:27 . 2006-10-17 22:29 487,479 --a------ C:\WINDOWS\system32\SkinMagic.dll 2008-06-02 02:27 . 2006-12-31 10:16 313,344 --a------ C:\WINDOWS\system32\avisynth.dll 2008-06-02 02:27 . 2007-02-16 07:10 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-06-02 02:02 . 2008-06-02 02:02 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-02 02:02 . 2008-06-02 02:02 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-29 21:34 . 2008-06-09 14:03 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Hamachi 2008-05-29 21:34 . 2008-05-29 21:34 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-05-28 19:37 . 2008-05-28 19:37 <DIR> d-------- C:\Program Files\Network Stumbler 2008-05-27 02:54 . 2008-05-27 16:03 <DIR> d-------- C:\Program Files\CubedLabs YouTube Download & Convert 2008-05-27 02:37 . 2008-05-07 21:12 <DIR> d-------- C:\Program Files\Abcc Free FLV to AVI WMV MPEG MP4 MOV Converter 2008-05-27 02:37 . 2008-05-27 02:37 34 --ah----- C:\WINDOWS\system32\DVDRippper_sysquict.dat 2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-16 05:58 --------- d-----w C:\Documents and Settings\Home\Application Data\AVG7 2008-06-13 05:05 --------- d-----w C:\Program Files\SpeedBit Video Accelerator 2008-06-12 19:09 --------- d-----w C:\Program Files\Java 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-29 03:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 03:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 03:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-21 12:51 --------- d-----w C:\Program Files\MSN Messenger 2008-04-21 12:50 --------- d-----w C:\Program Files\Windows Live 2008-04-21 12:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-21 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-04-17 16:38 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-17 16:37 --------- d-----w C:\Program Files\Real 2008-04-17 16:37 --------- d-----w C:\Program Files\Common Files\Real 2008-04-17 10:53 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\AVG7 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-21 07:05 32,768 ----a-w C:\WINDOWS\system32\GTGina.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{017D90B5-F081-4119-99ED-3231F0E744C8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07DF7501-A4E0-452E-B36C-170614D115D8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{189A78B1-CEB8-45FD-9C12-4B9C8A965A58}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7298ECDD-7C93-4EF8-9296-3BE188269346}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8FC89E07-D848-41E5-A9AB-2CB71591EFAC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{988E6186-A4F2-4192-BE95-7A91C8F458F2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C607C322-F4DF-44B7-98F5-FCAE55BADEA0}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-08 14:29 68856] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 00:24 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2005-06-20 18:53 1056768] "SoundMan"="SOUNDMAN.EXE" [2004-02-09 16:54 65024 C:\WINDOWS\SOUNDMAN.EXE] "MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe" [2002-11-01 16:13 167936] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-12-15 19:01 40960] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-17 18:53 579584] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-03-30 00:06 2729584] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-18 00:37 185896] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 19:49 219136] C:\Documents and Settings\Home\Start Menu\Programs\Startup\ ImationFlashDetect.lnk - C:\Program Files\Imation\ImationFlashDetect.exe [2007-01-21 19:48:25 806912] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvTlmLE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2006-10-30 09:36 256576 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-10-25 18:58 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\WIZET\\MapleStory\\Patcher.exe"= "C:\\WINDOWS\\system32\\rtcshare.exe"= "C:\\Program Files\\Counter-Strike 1.6\\hl.exe"= "C:\\Program Files\\WIZET\\MapleStory\\MapleStory.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R2 sbbotdi;sbbotdi;C:\PROGRA~1\SPEEDB~1\sbbotdi.sys [2008-03-30 00:06] R2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe [2008-03-30 00:06] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 10:12] . Contents of the 'Scheduled Tasks' folder "2007-10-05 09:42:53 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job" - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1 "2008-06-16 06:41:01 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe "2008-06-10 10:00:00 C:\WINDOWS\Tasks\Pareto UNS.job" - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-16 14:38:35 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant] "ImagePath"="" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Sygate\SPF\Smc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Canon\MultiPASS4\mpservic.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe . ************************************************************************** . Completion time: 2008-06-16 14:43:41 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-16 06:43:20 Pre-Run: 14,652,973,056 bytes free Post-Run: 14,518,632,448 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 255 --- E O F --- 2008-06-13 18 54----------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:47:49, on 16/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Canon\MultiPASS4\MPTBox.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe C:\Program Files\Imation\ImationFlashDetect.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\PROGRA~1\SPEEDB~1\proxy.pac O2 - BHO: (no name) - {017D90B5-F081-4119-99ED-3231F0E744C8} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {07DF7501-A4E0-452E-B36C-170614D115D8} - (no file) O2 - BHO: (no name) - {189A78B1-CEB8-45FD-9C12-4B9C8A965A58} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {7298ECDD-7C93-4EF8-9296-3BE188269346} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {8FC89E07-D848-41E5-A9AB-2CB71591EFAC} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {988E6186-A4F2-4192-BE95-7A91C8F458F2} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - {C607C322-F4DF-44B7-98F5-FCAE55BADEA0} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE KINSTONE USB PC Camera O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: ImationFlashDetect.lnk = C:\Program Files\Imation\ImationFlashDetect.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} - https://www.windowsonecare.com/insta...SSWebAgent.CAB O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll O20 - Winlogon Notify: tuvTlmLE - C:\WINDOWS\ O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 9781 bytes |
|
|
|
|
06-16-2008, 04:03 AM
|
#7 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: No Icon No Taskbar Just Wallpaper
Hello again
Please make sure SpyBot`s TeaTimer is disabled, it seems to be interfering with the fixes, also Windows Defender, see my last post on how to achieve this. ========= Download ATF-Cleaner by Atribune to your desktop.Do not run just yet, we will shortly ========= Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ======== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
======== Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ======== Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ======== Logs Required C:\Combofix.txt Kaspersky Scan Log Hijackthis Log How is your system running now.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
|
06-16-2008, 07:26 PM
|
#8 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 27
OS: Windows XP SP2
|
Re: No Icon No Taskbar Just Wallpaper
Sorry for the late reply. My computer seems to be a little faster than before. It responds well to my click and doesn't take so much time to load but I feel that it is not that smooth at some times. Ok, here is the 3 logs.
ComboFix 08-06-15.4 - Home 2008-06-16 21:39:12.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.619 [GMT 8:00] Running from: C:\Documents and Settings\Home\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Home\Desktop\CFscript.txt * Created a new restore point FILE :: C:\WINDOWS\imsins.BAK C:\WINDOWS\system32\SkinMagic.dll C:\WINDOWS\system32\xixjubfl.dll.vir C:\WINDOWS\Tasks\Pareto UNS.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Application Data\Spyware Terminator C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard3.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\appguard4.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg01.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg02.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\bg07.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\clamguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\clamguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\Enhance_security.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\info.ini C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\Install_wsg.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard3.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard4.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\intguard5.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.inf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\language.ini C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\li.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\li2.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\offlinehelp.html C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\ScanAdvanced2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scancustom.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scancustom2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\ScanExtension2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfast.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfast2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfull.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scanfull2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\Scanfullvirus2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\scansmart2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\Scanvirus2a.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\Scanvirus2b.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\Scanvirus2c.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard0.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard1.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard2.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\sysguard3.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\top.gif C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util01.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util02.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util03.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\LanguageAct\util04.rtf C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\reports.dat C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\scan_0001.dat C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\scan_0002.dat C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\Reports\supportReport.txt C:\Documents and Settings\Administrator\Application Data\Spyware Terminator\scanConfig.xml C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware\5.5\Logs\PAS-09-06-08-19-38-37.xml C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware\5.5\quarantine.db C:\Documents and Settings\Home\Application Data\Simply Super Software C:\Documents and Settings\Home\Application Data\Simply Super Software\Trojan Remover\pat7.exe C:\Documents and Settings\Home\Application Data\Simply Super Software\Trojan Remover\pax2.exe C:\Program Files\Enigma Software Group C:\Program Files\Enigma Software Group\SpyHunter\AXList.txt C:\Program Files\Enigma Software Group\SpyHunter\scan.log C:\Program Files\Enigma Software Group\SpyHunter\spyhunter.log C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterInstance.lock C:\Program Files\Enigma Software Group\SpyHunter\support.log C:\WINDOWS\imsins.BAK C:\WINDOWS\system32\SkinMagic.dll C:\WINDOWS\system32\xixjubfl.dll.vir C:\WINDOWS\Tasks\Pareto UNS.job . ((((((((((((((((((((((((( Files Created from 2008-05-16 to 2008-06-16 ))))))))))))))))))))))))))))))) . 2008-06-13 03:12 . 2008-06-13 03:12 <DIR> d-------- C:\Program Files\Sun 2008-06-13 00:34 . 2008-06-13 00:34 127 --a------ C:\WINDOWS\system32\MRT.INI 2008-06-11 22:36 . 2008-04-14 19:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 22:36 . 2008-04-14 19:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-09 18:12 . 2008-06-09 18:12 <DIR> d-------- C:\Deckard 2008-06-09 17:41 . 2008-06-09 17:41 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-09 17:41 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-06-06 23:16 . 2008-06-06 23:16 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-06 23:16 . 2008-06-06 23:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-06 23:16 . 2008-06-06 23:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-06 21:23 . 2008-06-06 21:33 <DIR> d-------- C:\Program Files\Panda Security 2008-06-06 13:48 . 2008-06-06 13:48 95 --a------ C:\WINDOWS\wininit.ini 2008-06-06 13:00 . 2008-06-06 13:00 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-06 13:00 . 2008-06-06 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-05 20:39 . 2008-06-05 20:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-06-05 19:09 . 2008-06-05 19:09 <DIR> d-------- C:\Program Files\IObit 2008-06-05 18:21 . 2008-06-16 21:30 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-05 18:21 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-05 18:21 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-05 18:21 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-05 18:21 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-05 18:20 . 2008-06-16 14:14 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-05 18:20 . 2008-06-05 18:20 <DIR> d-------- C:\Documents and Settings\Home\Application Data\PC Tools 2008-06-05 17:44 . 2008-06-05 17:44 <DIR> d-------- C:\Program Files\Windows Defender 2008-06-03 22:19 . 2008-06-03 22:19 <DIR> d-------- C:\Documents and Settings\Home\EurekaLog 2008-06-02 02:27 . 2008-06-02 02:27 <DIR> d-------- C:\WINDOWS\system32\avsplugin 2008-06-02 02:27 . 2008-06-02 02:27 <DIR> d-------- C:\Program Files\Smallvideosoft 2008-06-02 02:27 . 2007-03-12 17:49 7,277,568 --a------ C:\WINDOWS\system32\iPodmedia.dll 2008-06-02 02:27 . 2004-05-26 20:37 719,872 --a------ C:\WINDOWS\system32\devil.dll 2008-06-02 02:27 . 2006-12-31 10:16 313,344 --a------ C:\WINDOWS\system32\avisynth.dll 2008-06-02 02:27 . 2007-02-16 07:10 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-06-02 02:02 . 2008-06-02 02:02 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-02 02:02 . 2008-06-02 02:02 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-29 21:34 . 2008-06-09 14:03 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Hamachi 2008-05-29 21:34 . 2008-05-29 21:34 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-05-28 19:37 . 2008-05-28 19:37 <DIR> d-------- C:\Program Files\Network Stumbler 2008-05-27 02:54 . 2008-05-27 16:03 <DIR> d-------- C:\Program Files\CubedLabs YouTube Download & Convert 2008-05-27 02:37 . 2008-05-07 21:12 <DIR> d-------- C:\Program Files\Abcc Free FLV to AVI WMV MPEG MP4 MOV Converter 2008-05-27 02:37 . 2008-05-27 02:37 34 --ah----- C:\WINDOWS\system32\DVDRippper_sysquict.dat 2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-16 13:30 --------- d-----w C:\Documents and Settings\Home\Application Data\AVG7 2008-06-13 05:05 --------- d-----w C:\Program Files\SpeedBit Video Accelerator 2008-06-12 19:09 --------- d-----w C:\Program Files\Java 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-29 03:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 03:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 03:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-21 12:51 --------- d-----w C:\Program Files\MSN Messenger 2008-04-21 12:50 --------- d-----w C:\Program Files\Windows Live 2008-04-21 12:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-21 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-04-17 16:38 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-17 16:37 --------- d-----w C:\Program Files\Real 2008-04-17 16:37 --------- d-----w C:\Program Files\Common Files\Real 2008-04-17 10:53 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\AVG7 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-21 07:05 32,768 ----a-w C:\WINDOWS\system32\GTGina.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys . ((((((((((((((((((((((((((((( snapshot@2008-06-16_14.42.57.40 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-16 06:37:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-16 13:10:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-08 14:29 68856] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2005-06-20 18:53 1056768] "SoundMan"="SOUNDMAN.EXE" [2004-02-09 16:54 65024 C:\WINDOWS\SOUNDMAN.EXE] "MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe" [2002-11-01 16:13 167936] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-12-15 19:01 40960] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-17 18:53 579584] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-03-30 00:06 2729584] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-18 00:37 185896] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 19:49 219136] C:\Documents and Settings\Home\Start Menu\Programs\Startup\ ImationFlashDetect.lnk - C:\Program Files\Imation\ImationFlashDetect.exe [2007-01-21 19:48:25 806912] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2006-10-30 09:36 256576 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-10-25 18:58 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\WIZET\\MapleStory\\Patcher.exe"= "C:\\WINDOWS\\system32\\rtcshare.exe"= "C:\\Program Files\\Counter-Strike 1.6\\hl.exe"= "C:\\Program Files\\WIZET\\MapleStory\\MapleStory.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R2 sbbotdi;sbbotdi;C:\PROGRA~1\SPEEDB~1\sbbotdi.sys [2008-03-30 00:06] R2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe [2008-03-30 00:06] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 10:12] *Newly Created Service* - CATCHME *Newly Created Service* - GTNDIS5 . Contents of the 'Scheduled Tasks' folder "2007-10-05 09:42:53 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job" - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1 "2008-06-16 13:13:19 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-16 21:40:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\vsdatant] "ImagePath"="" . Completion time: 2008-06-16 21:43:28 ComboFix-quarantined-files.txt 2008-06-16 13:42:26 ComboFix2.txt 2008-06-16 06:43:42 Pre-Run: 14,520,279,040 bytes free Post-Run: 14,497,681,408 bytes free 244 --- E O F --- 2008-06-13 18 54-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, June 17, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, June 16, 2008 18:34:49 Records in database: 874123 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 45833 Threat name: 4 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 01:48:38 File name / Threat name / Threats count C:\MapleDream\MapleDreamT003.exe Infected: Trojan-PSW.Win32.LdPinch.rnd 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xixjubfl.dll.vir.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.yag 1 C:\VundoFix Backups\geede.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.fp 1 C:\VundoFix Backups\qlyhdubj.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.kb 1 C:\VundoFix Backups\vkyxngoe.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.kb 1 The selected area was scanned. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:21:59, on 17/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Canon\MultiPASS4\MPTBox.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Imation\ImationFlashDetect.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\PROGRA~1\SPEEDB~1\proxy.pac O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE KINSTONE USB PC Camera O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: ImationFlashDetect.lnk = C:\Program Files\Imation\ImationFlashDetect.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} - https://www.windowsonecare.com/insta...SSWebAgent.CAB O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 9009 bytes |
|
|
|
|
06-17-2008, 05:21 AM
|
#9 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: No Icon No Taskbar Just Wallpaper
Hello again
Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "%userprofile%\desktop\dss.exe" /daft * Read the disclaimer and click okay. * Click on the Scan button. *Click the Fix button. * Re-scan and save a logfile. By default, it will save as daft.txt. Post the contents of that file with your next post. ========= Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ======== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ====== Logs Required Daft.txt C:\Combofix.txt Hijackthis Log
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
|
06-18-2008, 07:34 AM
|
#10 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 27
OS: Windows XP SP2
|
Re: No Icon No Taskbar Just Wallpaper
Hi again
These is all the 3 logs. DAFT Log saved on 2008-06-18 21:40:57 ----------------------------------------------------------------------- All associations okay! ComboFix 08-06-15.4 - Home 2008-06-18 21:42:31.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.590 [GMT 8:00] Running from: C:\Documents and Settings\Home\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Home\Desktop\CFscript.txt * Created a new restore point FILE :: C:\MapleDream\MapleDreamT003.exe C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\MapleDream\MapleDreamT003.exe C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 ))))))))))))))))))))))))))))))) . 2008-06-18 01:55 . 2008-06-18 01:55 <DIR> d-------- C:\Documents and Settings\Homie 2008-06-16 22:17 . 2008-06-16 22:17 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Nexon 2008-06-16 22:07 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-16 22:06 . 2008-06-16 22:06 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-13 03:12 . 2008-06-13 03:12 <DIR> d-------- C:\Program Files\Sun 2008-06-13 00:34 . 2008-06-13 00:34 127 --a------ C:\WINDOWS\system32\MRT.INI 2008-06-11 22:36 . 2008-04-14 19:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 22:36 . 2008-04-14 19:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-09 18:12 . 2008-06-09 18:12 <DIR> d-------- C:\Deckard 2008-06-09 17:41 . 2008-06-09 17:41 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-09 17:41 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-06-06 23:16 . 2008-06-06 23:16 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-06 23:16 . 2008-06-06 23:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-06 23:16 . 2008-06-06 23:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-06 21:23 . 2008-06-06 21:33 <DIR> d-------- C:\Program Files\Panda Security 2008-06-06 13:00 . 2008-06-06 13:00 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-06 13:00 . 2008-06-06 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-05 20:39 . 2008-06-05 20:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-06-05 19:09 . 2008-06-05 19:09 <DIR> d-------- C:\Program Files\IObit 2008-06-05 18:21 . 2008-06-18 17:28 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-05 18:21 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-05 18:21 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-05 18:21 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-05 18:21 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-05 18:20 . 2008-06-16 14:14 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-06-05 18:20 . 2008-06-05 18:20 <DIR> d-------- C:\Documents and Settings\Home\Application Data\PC Tools 2008-06-05 17:44 . 2008-06-05 17:44 <DIR> d-------- C:\Program Files\Windows Defender 2008-06-03 22:19 . 2008-06-03 22:19 <DIR> d-------- C:\Documents and Settings\Home\EurekaLog 2008-06-02 02:27 . 2008-06-02 02:27 <DIR> d-------- C:\WINDOWS\system32\avsplugin 2008-06-02 02:27 . 2008-06-02 02:27 <DIR> d-------- C:\Program Files\Smallvideosoft 2008-06-02 02:27 . 2007-03-12 17:49 7,277,568 --a------ C:\WINDOWS\system32\iPodmedia.dll 2008-06-02 02:27 . 2004-05-26 20:37 719,872 --a------ C:\WINDOWS\system32\devil.dll 2008-06-02 02:27 . 2006-12-31 10:16 313,344 --a------ C:\WINDOWS\system32\avisynth.dll 2008-06-02 02:27 . 2007-02-16 07:10 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-06-02 02:02 . 2008-06-02 02:02 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-02 02:02 . 2008-06-02 02:02 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-29 21:34 . 2008-06-09 14:03 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Hamachi 2008-05-29 21:34 . 2008-05-29 21:34 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-05-28 19:37 . 2008-05-28 19:37 <DIR> d-------- C:\Program Files\Network Stumbler 2008-05-27 02:54 . 2008-05-27 16:03 <DIR> d-------- C:\Program Files\CubedLabs YouTube Download & Convert 2008-05-27 02:37 . 2008-05-07 21:12 <DIR> d-------- C:\Program Files\Abcc Free FLV to AVI WMV MPEG MP4 MOV Converter 2008-05-27 02:37 . 2008-05-27 02:37 34 --ah----- C:\WINDOWS\system32\DVDRippper_sysquict.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-18 09:28 --------- d-----w C:\Documents and Settings\Home\Application Data\AVG7 2008-06-16 14:07 --------- d-----w C:\Program Files\Java 2008-06-13 05:05 --------- d-----w C:\Program Files\SpeedBit Video Accelerator 2008-05-16 03:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-29 03:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 03:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 03:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-21 12:51 --------- d-----w C:\Program Files\MSN Messenger 2008-04-21 12:50 --------- d-----w C:\Program Files\Windows Live 2008-04-21 12:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-21 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-21 07:05 32,768 ----a-w C:\WINDOWS\system32\GTGina.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys . ((((((((((((((((((((((((((((( snapshot@2008-06-16_14.42.57.40 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-16 06:37:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-18 09:27:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-02-21 17:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe + 2008-03-24 17:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe - 2008-02-21 17:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-24 17:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe - 2008-02-21 18:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe + 2008-03-24 18:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-08 14:29 68856] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2005-06-20 18:53 1056768] "SoundMan"="SOUNDMAN.EXE" [2004-02-09 16:54 65024 C:\WINDOWS\SOUNDMAN.EXE] "MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe" [2002-11-01 16:13 167936] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-12-15 19:01 40960] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-17 18:53 579584] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-03-30 00:06 2729584] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-18 00:37 185896] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 19:49 219136] C:\Documents and Settings\Home\Start Menu\Programs\Startup\ ImationFlashDetect.lnk - C:\Program Files\Imation\ImationFlashDetect.exe [2007-01-21 19:48:25 806912] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2006-10-30 09:36 256576 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-10-25 18:58 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\WIZET\\MapleStory\\Patcher.exe"= "C:\\WINDOWS\\system32\\rtcshare.exe"= "C:\\Program Files\\Counter-Strike 1.6\\hl.exe"= "C:\\Program Files\\WIZET\\MapleStory\\MapleStory.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R2 sbbotdi;sbbotdi;C:\PROGRA~1\SPEEDB~1\sbbotdi.sys [2008-03-30 00:06] R2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe [2008-03-30 00:06] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 10:12] *Newly Created Service* - GTNDIS5 . Contents of the 'Scheduled Tasks' folder "2007-10-05 09:42:53 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job" - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1 "2008-06-18 09:31:18 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-18 21:44:16 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\vsdatant] "ImagePath"="" . Completion time: 2008-06-18 21:45:39 ComboFix-quarantined-files.txt 2008-06-18 13:45:27 ComboFix2.txt 2008-06-16 13:43:29 ComboFix3.txt 2008-06-16 06:43:42 Pre-Run: 14,050,734,080 bytes free Post-Run: 14,497,443,840 bytes free 183 --- E O F --- 2008-06-13 18 54Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:33:11, on 18/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Canon\MultiPASS4\MPTBox.exe C:\WINDOWS\VM_STI.EXE C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Imation\ImationFlashDetect.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\PROGRA~1\SPEEDB~1\proxy.pac O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE KINSTONE USB PC Camera O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: ImationFlashDetect.lnk = C:\Program Files\Imation\ImationFlashDetect.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} - https://www.windowsonecare.com/insta...SSWebAgent.CAB O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 9041 bytes Last edited by xchocochips; 06-18-2008 at 07:36 AM. |
|
|
|
|
06-18-2008, 07:56 AM
|
#11 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: No Icon No Taskbar Just Wallpaper
Hello again
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) Please remember to close all other windows, including browsers then click Fix checked. ========== You can keep ATF-Cleaner if you wish. ========== Well done,your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. =========== Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Ad-Aware Spybot S&D Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
|
06-18-2008, 08:59 AM
|
#12 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 27
OS: Windows XP SP2
|
Re: No Icon No Taskbar Just Wallpaper
Hey, do I need to download all Anti-Spyware product? I currently have Ad-Aware and Spybot S&D in my computer. Will they conflict each other?
And one more thing, how to make sure my computer is working efficiently from time to time? I found out that after awhile my computer seems to performing at slower speed. Currently my computer is performing at a good condition after all these guides by you. Any idea which firewall is good or should I stick to my current firewall which is Sygate Personal Firewall? Thanks again. Last edited by xchocochips; 06-18-2008 at 09:01 AM. |
|
|
|
|
06-18-2008, 12:23 PM
|
#13 (permalink) | |||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: No Icon No Taskbar Just Wallpaper
Quote:
# Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software. # Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox. # Restrict the actions of potentially unwanted sites in Internet Explorer. Quote:
Quote:
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|||
|
|
|
|
06-18-2008, 01:09 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 27
OS: Windows XP SP2
|
Re: No Icon No Taskbar Just Wallpaper
Well, thanks again for all these help that was given to me by you. I am certainly going to be more careful next time when I surf the net so that these types of problem won't exist again. Once thank you very much for helping me out.
Will you be deleting this thread? I might need those useful links in the future to help me out in the future. |
|
|
|
|
06-18-2008, 01:13 PM
|
#15 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 4,452
OS: XP
|
Re: No Icon No Taskbar Just Wallpaper
No, i will be moving this thread into the resolved forum, just put this thread in your favorites/bookmarks, depending on which browser you use.
__________________
Member of ASAP since 2007 Member of UNITE since 2008 **Notice to BT customers** BT-Phorm spyware to go live before the end of 2009- for more information please visit No DPI website for more information. Phorm, previously known as 121Media were responsible for the Apropos rootkit, see Here for more information on said rootkit. If we have helped you in anyway,please consider Donating |
|
|
|
| Thread Tools | |
|
|
