|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-05-2008, 07:54 AM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Browser anarchy!
Picked up some sort of virus. The browser, either IE7 or Firefox2/3 rather randomly jump to a selection of sites, presumably a form of adware. IE7 now takes several minutes (really!) to find its first connection (home page is Google) and some of the functionality has gone. Firefox is better (no delay with first connection) but again some functionality has gone. The ability to use a URL link in Outlook has become almost unusable.
I realise from reading some of your previous strands that I have a bit of a mess and I need to turf out some of the rubbish! Anyways here is the log: Deckard's System Scanner v20071014.68 Run by Perry on 2008-07-05 11:13:53 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 121: 2008-07-05 10:14:03 UTC - RP1107 - Deckard's System Scanner Restore Point 120: 2008-07-04 22:47:11 UTC - RP1106 - Avg8 Update 119: 2008-07-04 22:46:57 UTC - RP1105 - Avg8 Update 118: 2008-07-04 09:43:46 UTC - RP1104 - Software Distribution Service 3.0 117: 2008-07-04 09:08:43 UTC - RP1103 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2008-04-06 21  20 UTC - RP987 - Software Distribution Service 3.0Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-07-05 11:26:08 Platform: Windows XP Service Pack 3 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Sun\AppServer\lib\appservService.exe C:\Program Files\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Sun\AppServer\jdk\bin\java.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\PDesk\pdesk.exe C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\soundman.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAKE.EXE C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Documents and Settings\Perry\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar3.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [EPSON PictureMate 100] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAKE.EXE /P21 "EPSON PictureMate 100" /O6 "USB003" /M "PictureMate 100" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {00000161-9980-0010-8000-00AA00389B71} () - http://codecs.microsoft.com/codecs/i386/msaud.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...0C/wmv9dmo.cab O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...tent/opuc3.cab O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} (Seagate DiscWizard English) - http://www.seagate.com/support/disc/...n/npdscwiz.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1154335810937 O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - http://www.seagate.com/support/disc/...npseatools.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: SunJavaSystemAppserver9PE (AppServer9PE) - Unknown owner - C:\Sun\AppServer\lib\appservService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 12932 bytes -- File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 hpt374 - c:\windows\system32\drivers\hpt374.sys <Not Verified; HighPoint Technologies, Inc.; HPT374> R0 hptpro - c:\windows\system32\drivers\hptpro.sys <Not Verified; HighPoint Technologies, Inc.; HighPoint Filter Driver> S3 humaxfl (HUMAX - Filter Driver) - c:\windows\system32\drivers\humaxfl.sys <Not Verified; HUMAX Co., Ltd.; Humax STB Library> S3 humaxst (HUMAX - Stub Driver) - c:\windows\system32\drivers\humaxst.sys <Not Verified; HUMAX Co., Ltd.; Humax STB Library> S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> S3 USBCamera (Bulk USB Device) - c:\windows\system32\drivers\bulk533.sys <Not Verified; USB BULK; Platform SDK Sample Code> S3 UtilNT - c:\windows\system32\drivers\utilnt.sys <Not Verified; Matrox Graphics Inc.; Matrox Graphics Inc. UtilNt> S3 VirtualFD - c:\prog installers\vfd\vfd.sys (file missing) S4 Ca533av (USB PC Camera) - c:\windows\system32\drivers\ca533av.sys <Not Verified; Digital Camera; Digital Camera Driver> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 AdobeActiveFileMonitor4.0 (Adobe Active File Monitor V4) - c:\program files\adobe\photoshop elements 4.0\photoshopelementsfileagent.exe R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 AppServer9PE (SunJavaSystemAppserver9PE) - c:\sun\appserver\lib\appservservice.exe "c:\sun\appserver\bin\asadmin.bat start-domain --user perry domain1" "c:\sun\appserver\bin\asadmin.bat stop-domain domain1" R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> R2 EPSONStatusAgent2 (EPSON Printer Status Agent2) - c:\program files\common files\epson\ebapi\sagent2.exe <Not Verified; SEIKO EPSON CORPORATION; EPSON Bidirectional Printer> S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-07-05 11:17:08 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-07-05 04:00:29 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job -- Files created between 2008-06-05 and 2008-07-05 ----------------------------- 2008-07-04 11:17:41 0 d-------- C:\WINDOWS\LastGood.Tmp 2008-07-04 11 53 0 d-------- C:\WINDOWS\system32\scripting2008-07-04 11 53 0 d-------- C:\WINDOWS\l2schemas2008-07-04 11 52 0 d-------- C:\WINDOWS\system32\en2008-07-04 11 51 0 d-------- C:\WINDOWS\system32\bits2008-07-04 11:02:30 0 d-------- C:\WINDOWS\ServicePackFiles 2008-07-04 10:28:27 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-23 23:55:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-06-23 23:55:30 0 d-------- C:\Documents and Settings\Perry\Application Data\Azureus 2008-06-23 23:54:23 0 d-------- C:\Program Files\Vuze 2008-06-16 10:52:42 0 d-------- C:\WINDOWS\Replay Media Catcher 2008-06-16 10:52:15 0 d-------- C:\Program Files\Replay Media Catcher 2008-06-09 20:03:22 0 d--h----- C:\$AVG8.VAULT$ -- Find3M Report --------------------------------------------------------------- 2008-07-04 12:31:58 0 d-------- C:\Documents and Settings\Perry\Application Data\AVGTOOLBAR 2008-07-04 11:47:58 0 d-------- C:\Program Files\Messenger 2008-07-04 11 51 0 d-------- C:\Program Files\Movie Maker2008-07-04 11:02:04 0 d-------- C:\Program Files\Windows NT 2008-07-04 01:57:11 0 d-------- C:\Program Files\Paragon Software 2008-06-26 10:52:06 0 d-------- C:\Documents and Settings\Perry\Application Data\Mozilla 2008-06-16 10:28:02 0 d-------- C:\Program Files\Replay AV 8 2008-06-16 09:09:27 0 d-------- C:\Documents and Settings\Perry\Application Data\Apple Computer 2008-06-04 11:14:23 0 d-------- C:\Program Files\Sony Ericsson 2008-06-04 11:13:14 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony 2008-06-04 11:09:07 0 d-------- C:\Program Files\Sony 2008-06-04 11:08:01 0 d-------- C:\Program Files\QuickTime 2008-06-04 11:07:30 0 d-------- C:\Program Files\QuickTime Alternative 2008-06-04 11:05:02 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Setup 2008-06-04 11:04:34 0 d-------- C:\Program Files\Sony Setup 2008-06-04 10:58:20 0 d-------- C:\Program Files\Avanquest update 2008-06-04 10:58:19 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-04 10:14:45 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Ericsson 2008-06-04 10:10:25 0 d-------- C:\Program Files\Common Files 2008-05-26 08:53:09 0 d-------- C:\Program Files\Apple Software Update 2008-05-23 03:13:30 0 d-------- C:\Program Files\iTunes 2008-05-23 03:13:15 0 d-------- C:\Program Files\iPod 2008-05-23 03:12:03 0 d-------- C:\Program Files\Bonjour 2008-05-23 03:09:05 0 d-------- C:\Program Files\Common Files\Apple 2008-05-21 01:54:03 0 d-------- C:\Program Files\AVG -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 03/07/2008 23:27 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [03/07/2008 23:27 2055960] [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Matrox Powerdesk"="C:\WINDOWS\system32\PDesk\PDesk.exe" [21/09/2001 17:35] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [09/09/2005 01:18] "SoundMan"="SOUNDMAN.EXE" [17/08/2005 19:39 C:\WINDOWS\soundman.exe] "MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [03/12/2002 12:00] "EPSON PictureMate 100"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAKE.exe" [06/05/2005 06:00] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [14/08/2007 08:05] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 18:53] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25/03/2008 04:28] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [03/11/2006 20:20] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/03/2008 01:55] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [03/07/2008 23:27] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 01:12] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [12/03/2007 13:49] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/04/2008 01:12] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/05/2007 08:42] "kdx"="C:\Program Files\Kontiki\KHost.exe" [27/11/2007 12:58] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [22/10/2007 09:58] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [20/02/2008 17:19] "yaiooci"="c:\documents and settings\perry\local settings\application data\yaiooci.exe" [23/06/2008 23:47] C:\Documents and Settings\Perry\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 9:16:50 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [12/30/2005 12:10:24 PM] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [5/8/2007 8:42:04 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- Hosts ----------------------------------------------------------------------- 127.0.0.1 207-87-18-203.wsmg.digex.net 127.0.0.1 Garden.ngadcenter.net 127.0.0.1 Ogilvy.ngadcenter.net 127.0.0.1 ResponseMedia-ad.flycast.com 127.0.0.1 Suissa-ad.flycast.com 127.0.0.1 UGO.eu-adcenter.net 127.0.0.1 VNU.eu-adcenter.net 127.0.0.1 a32.g.a.yimg.com 127.0.0.1 ad-adex3.flycast.com 127.0.0.1 ad.adsmart.net 2 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-07-05 11:35:18 ------------ |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-09-2008, 05:54 PM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. For Windows XP Service Pack 3, you may use the Recovery Console package for Windows XP Service Pack 2 appropriate for your Operating System, XP Home or XP Professional. As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
07-09-2008, 08:06 PM
|
#3 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
Sorry - these are back to front - here is the new DSS log:
Deckard's System Scanner v20071014.68 Run by Perry on 2008-07-10 02:55:55 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Perry.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:58:39, on 10/07/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Sun\AppServer\lib\appservService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\svchost.exe C:\Sun\AppServer\jdk\bin\java.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\PDesk\PDesk.exe C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\Search And Destroy\SearchAndDestroy.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Perry\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Perry.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKCU\..\Run: [SearchAndDestroyScheduler] C:\Program Files\Search And Destroy\SearchAndDestroy.exe SCHEDULER O4 - HKCU\..\Run: [SearchAndDestroyT] C:\Program Files\Search And Destroy\SearchAndDestroy.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} - http://www.seagate.com/support/disc/...n/npdscwiz.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase5036.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1154335810937 O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - http://www.seagate.com/support/disc/...npseatools.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - http://driveragent.com/files/driveragent.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: SunJavaSystemAppserver9PE (AppServer9PE) - Unknown owner - C:\Sun\AppServer\lib\appservService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 10353 bytes -- Files created between 2008-06-10 and 2008-07-10 ----------------------------- 2008-07-10 02:56:30 0 d-------- C:\Program Files\Trend Micro 2008-07-10 02:25:56 0 --a------ C:\WINDOWS\system32\MSVolume.dll 2008-07-10 02:15:08 68096 --a------ C:\WINDOWS\zip.exe 2008-07-10 02:15:08 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-10 02:15:08 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-10 02:15:08 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-10 02:15:08 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-10 02:15:08 98816 --a------ C:\WINDOWS\sed.exe 2008-07-10 02:15:08 80412 --a------ C:\WINDOWS\grep.exe 2008-07-10 02:15:08 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-10 00:32:53 0 d-------- C:\WINDOWS\Search And Destroy 2008-07-10 00:32:21 0 d-------- C:\Program Files\Search And Destroy 2008-07-09 01:10:30 0 d-------- C:\Program Files\Windows Live Safety Center 2008-07-07 23:57:00 0 d-------- C:\ie-spyad_zo 2008-07-07 23:22:51 0 d-------- C:\Program Files\SpywareBlaster 2008-07-07 12:29:03 0 d-------- C:\Program Files\Panda Security 2008-07-04 11 53 0 d-------- C:\WINDOWS\system32\scripting2008-07-04 11 53 0 d-------- C:\WINDOWS\l2schemas2008-07-04 11 52 0 d-------- C:\WINDOWS\system32\en2008-07-04 11 51 0 d-------- C:\WINDOWS\system32\bits2008-07-04 11:02:30 0 d-------- C:\WINDOWS\ServicePackFiles 2008-07-04 10:28:27 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-23 23:55:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-06-23 23:55:30 0 d-------- C:\Documents and Settings\Perry\Application Data\Azureus 2008-06-23 23:54:23 0 d-------- C:\Program Files\Vuze 2008-06-16 10:52:42 0 d-------- C:\WINDOWS\Replay Media Catcher 2008-06-16 10:52:15 0 d-------- C:\Program Files\Replay Media Catcher -- Find3M Report --------------------------------------------------------------- 2008-07-07 23:42:06 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-07-07 12:15:56 0 d-------- C:\Program Files\MUSICMATCH 2008-07-07 12:15:45 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-07 12:15:07 0 d-------- C:\Program Files\Symantec 2008-07-04 12:31:58 0 d-------- C:\Documents and Settings\Perry\Application Data\AVGTOOLBAR 2008-07-04 11:47:58 0 d-------- C:\Program Files\Messenger 2008-07-04 11 51 0 d-------- C:\Program Files\Movie Maker2008-07-04 11:02:04 0 d-------- C:\Program Files\Windows NT 2008-07-04 01:57:11 0 d-------- C:\Program Files\Paragon Software 2008-06-26 10:52:06 0 d-------- C:\Documents and Settings\Perry\Application Data\Mozilla 2008-06-16 10:28:02 0 d-------- C:\Program Files\Replay AV 8 2008-06-16 09:09:27 0 d-------- C:\Documents and Settings\Perry\Application Data\Apple Computer 2008-06-04 11:14:23 0 d-------- C:\Program Files\Sony Ericsson 2008-06-04 11:13:14 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony 2008-06-04 11:09:07 0 d-------- C:\Program Files\Sony 2008-06-04 11:08:01 0 d-------- C:\Program Files\QuickTime 2008-06-04 11:07:30 0 d-------- C:\Program Files\QuickTime Alternative 2008-06-04 11:05:02 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Setup 2008-06-04 11:04:34 0 d-------- C:\Program Files\Sony Setup 2008-06-04 10:58:20 0 d-------- C:\Program Files\Avanquest update 2008-06-04 10:14:45 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Ericsson 2008-06-04 10:10:25 0 d-------- C:\Program Files\Common Files 2008-05-26 08:53:09 0 d-------- C:\Program Files\Apple Software Update 2008-05-23 03:13:30 0 d-------- C:\Program Files\iTunes 2008-05-23 03:13:15 0 d-------- C:\Program Files\iPod 2008-05-23 03:12:03 0 d-------- C:\Program Files\Bonjour 2008-05-23 03:09:05 0 d-------- C:\Program Files\Common Files\Apple 2008-05-21 01:54:03 0 d-------- C:\Program Files\AVG -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 03/07/2008 23:27 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [03/07/2008 23:27 2055960] [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Matrox Powerdesk"="C:\WINDOWS\system32\PDesk\PDesk.exe" [21/09/2001 17:35] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [09/09/2005 01:18] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [14/08/2007 08:05] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 18:53] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25/03/2008 04:28] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/03/2008 01:55] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [03/07/2008 23:27] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 01:12] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [12/03/2007 13:49] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/04/2008 01:12] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/05/2007 08:42] "kdx"="C:\Program Files\Kontiki\KHost.exe" [27/11/2007 12:58] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [22/10/2007 09:58] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [20/02/2008 17:19] "SearchAndDestroyScheduler"="C:\Program Files\Search And Destroy\SearchAndDestroy.exe" [07/06/2008 00:23] "SearchAndDestroyT"="C:\Program Files\Search And Destroy\SearchAndDestroy.exe" [07/06/2008 00:23] C:\Documents and Settings\Perry\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16/03/2005 21:16:50] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [30/12/2005 12:10:24] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [08/05/2007 08:42:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-07-10 03:01:54 ------------ |
|
|
|
|
07-09-2008, 08:08 PM
|
#4 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
and here is the Combofix log:
ComboFix 08-07-09.2 - Perry 2008-07-10 2:16:19.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.301 [GMT 1:00] Running from: C:\Prog installers\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Perry\Local Settings\Application Data\cmiioio.dat C:\Documents and Settings\Perry\Local Settings\Application Data\cmiioio.exe c:\Documents and Settings\Perry\Local Settings\Application Data\cmiioio_nav.dat c:\Documents and Settings\Perry\Local Settings\Application Data\cmiioio_navps.dat C:\WINDOWS\system32\MSVolume.dll C:\WINDOWS\system32\nvs2.inf . ((((((((((((((((((((((((( Files Created from 2008-06-10 to 2008-07-10 ))))))))))))))))))))))))))))))) . 2008-07-10 00:32 . 2008-07-10 00:32 <DIR> d-------- C:\WINDOWS\Search And Destroy 2008-07-10 00:32 . 2008-07-10 00:32 <DIR> d-------- C:\Program Files\Search And Destroy 2008-07-09 01:10 . 2008-07-09 01:20 <DIR> d-------- C:\Program Files\Windows Live Safety Center 2008-07-07 23:57 . 2008-07-07 23:57 <DIR> d-------- C:\ie-spyad_zo 2008-07-07 23:22 . 2008-07-07 23:27 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-07-07 12:30 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-07-07 12:29 . 2008-07-07 12:29 <DIR> d-------- C:\Program Files\Panda Security 2008-07-05 11:13 . 2008-07-05 11:13 <DIR> d-------- C:\Deckard 2008-07-04 11:06 . 2008-07-04 11:06 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-07-04 11:06 . 2008-07-04 11:06 <DIR> d-------- C:\WINDOWS\system32\en 2008-07-04 11:06 . 2008-07-04 11:06 <DIR> d-------- C:\WINDOWS\system32\bits 2008-07-04 11:06 . 2008-07-04 11:06 <DIR> d-------- C:\WINDOWS\l2schemas 2008-07-04 11:02 . 2008-07-04 11:07 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-07-04 10:28 . 2008-07-04 10:28 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-07-04 10:06 . 2008-04-14 01:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll 2008-07-04 10:05 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2008-07-04 10:04 . 2008-04-14 01:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll 2008-06-27 11:36 . 2008-06-27 11:36 0 --a------ C:\hb_5.tmp 2008-06-23 23:55 . 2008-06-26 10:45 <DIR> d-------- C:\Documents and Settings\Perry\Application Data\Azureus 2008-06-23 23:55 . 2008-06-23 23:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-06-23 23:54 . 2008-06-23 23:54 <DIR> d-------- C:\Program Files\Vuze 2008-06-20 18:46 . 2008-06-20 18:46 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 18:46 . 2008-06-20 18:46 147,968 -----c--- C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 12:51 . 2008-06-20 12:51 361,600 -----c--- C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 12:40 . 2008-06-20 12:40 138,496 -----c--- C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 12:08 . 2008-06-20 12:08 225,856 -----c--- C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-16 10:52 . 2008-06-16 10:52 <DIR> d-------- C:\WINDOWS\Replay Media Catcher 2008-06-16 10:52 . 2008-06-17 23:47 <DIR> d-------- C:\Program Files\Replay Media Catcher 2008-06-11 09:55 . 2008-06-13 12:05 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 09:55 . 2008-06-13 12:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-11 09:55 . 2008-05-08 15:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-10 01:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki 2008-07-09 03:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-07-07 22:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-07 22:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-07 11:15 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-07 11:15 --------- d-----w C:\Program Files\Symantec 2008-07-07 11:15 --------- d-----w C:\Program Files\MUSICMATCH 2008-07-04 11:31 --------- d-----w C:\Documents and Settings\Perry\Application Data\AVGTOOLBAR 2008-07-04 00:57 --------- d-----w C:\Program Files\Paragon Software 2008-07-03 22:26 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys 2008-07-03 22:26 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll 2008-06-25 23:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink 2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-16 09:28 --------- d-----w C:\Program Files\Replay AV 8 2008-06-16 08:09 --------- d-----w C:\Documents and Settings\Perry\Application Data\Apple Computer 2008-06-07 13:53 40,464 ----a-w C:\WINDOWS\system32\drivers\hotcore3.sys 2008-06-07 13:53 4,244,744 ----a-w C:\WINDOWS\system32\qtp-mt334.dll 2008-06-07 13:53 33,072 ----a-w C:\WINDOWS\system32\drivers\UimBus.sys 2008-06-07 13:53 217,152 ----a-w C:\WINDOWS\system32\drivers\UimFIO.sys 2008-06-07 13:53 130,688 ----a-w C:\WINDOWS\system32\drivers\Uim_IM.sys 2008-06-07 13:53 13,576 ----a-w C:\WINDOWS\system32\wnaspi32.dll 2008-06-04 10:30 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-06-04 10:30 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-06-04 10:16 21,672 ----a-w C:\WINDOWS\system32\drivers\ggsemc.sys 2008-06-04 10:16 13,352 ----a-w C:\WINDOWS\system32\drivers\ggflt.sys 2008-06-04 10:16 1,419,232 ----a-w C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-06-04 10:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2008-06-04 10:14 --------- d-----w C:\Program Files\Sony Ericsson 2008-06-04 10:13 --------- d-----w C:\Documents and Settings\Perry\Application Data\Sony 2008-06-04 10:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony 2008-06-04 10:09 --------- d-----w C:\Program Files\Sony 2008-06-04 10:08 --------- d-----w C:\Program Files\QuickTime 2008-06-04 10:07 --------- d-----w C:\Program Files\QuickTime Alternative 2008-06-04 10:05 --------- d-----w C:\Documents and Settings\Perry\Application Data\Sony Setup 2008-06-04 10:04 --------- d-----w C:\Program Files\Sony Setup 2008-06-04 09:58 --------- d-----w C:\Program Files\Avanquest update 2008-06-04 09:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-06-04 09:14 --------- d-----w C:\Documents and Settings\Perry\Application Data\Sony Ericsson 2008-05-26 07:53 --------- d-----w C:\Program Files\Apple Software Update 2008-05-23 02:13 --------- d-----w C:\Program Files\iTunes 2008-05-23 02:13 --------- d-----w C:\Program Files\iPod 2008-05-23 02:12 --------- d-----w C:\Program Files\Bonjour 2008-05-23 02:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-23 02:09 --------- d-----w C:\Program Files\Common Files\Apple 2008-05-23 02:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2008-05-21 00:54 --------- d-----w C:\Program Files\AVG 2008-05-21 00:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-05-09 10:53 90,112 ----a-w C:\WINDOWS\system32\wshext.dll 2008-05-09 10:53 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll 2008-05-09 10:53 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll 2008-05-09 10:53 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll 2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe 2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe 2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 04:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll 2008-04-14 04:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 04:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll 2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll 2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll 2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll 2008-04-14 00:10 102,912 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-13 19:27 2,188,928 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:43 9,728 ------w C:\WINDOWS\system32\comsdupd.exe 2008-04-13 18:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe 2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:31 2,065,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 18:14 76,800 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll 2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll 2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-13 16:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 16:22 48,128 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-13 15:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2007-12-28 17:35 540,213 ----a-w C:\Program Files\Autoruns.zip 2000-06-05 16:47 32,768 ----a-w C:\Program Files\mozilla firefox\plugins\AppSub32.dll 2007-03-09 08:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 01:12 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2007-03-12 13:49 153136] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 01:12 1695232] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-08 08:42 68856] "kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-11-27 12:58 1032376] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-10-22 09:58 1885464] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 17:19 356352] "SearchAndDestroyScheduler"="C:\Program Files\Search And Destroy\SearchAndDestroy.exe" [2008-06-07 00:23 11640832] "SearchAndDestroyT"="C:\Program Files\Search And Destroy\SearchAndDestroy.exe" [2008-06-07 00:23 11640832] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Matrox Powerdesk"="C:\WINDOWS\system32\PDesk\PDesk.exe" [2001-09-21 17:35 622592] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 01:18 57344] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-14 08:05 1836544] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53 153136] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-09 01:55 185896] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-03 23:27 1232152] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 01:12 15360] C:\Documents and Settings\Perry\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 21:16:50 113664] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2005-12-30 12:10:24 135680] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-05-08 08:42:04 124912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= C:\PROGRA~1\REPLAY~2\iac25_32.ax "VIDC.SP54"= SP5X_32.DLL "VIDC.SP55"= SP5X_32.DLL "VIDC.SP56"= SP5X_32.DLL "VIDC.SP57"= SP5X_32.DLL "VIDC.SP58"= SP5X_32.DLL "VIDC.dv50"= smdvCodec.dll "VIDC.dv25"= smdvCodec.dll "VIDC.dvh1"= smdvCodec.dll "mixer"= APTRRNTm.dll "wave"= APTRRNTm.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"= "C:\\Program Files\\Kontiki\\KService.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Replay AV 8\\Tuner.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"= "C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"= "C:\\Program Files\\Vuze\\Azureus.exe"= R0 hotcore3;hc3ServiceName;C:\WINDOWS\system32\drivers\hotcore3.sys [2008-06-07 14:53] R0 hpt374;hpt374;C:\WINDOWS\system32\DRIVERS\hpt374.sys [2002-03-13 10:42] R0 hptpro;hptpro;C:\WINDOWS\system32\DRIVERS\hptpro.sys [2002-03-11 10:49] R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-03 23:26] R2 AppServer9PE;SunJavaSystemAppserver9PE;C:\Sun\AppServer\lib\appservService.exe C:\Sun\AppServer\bin\asadmin.bat start-domain --user Perry domain1 C:\Sun\AppServer\bin\asadmin.bat stop-domain domain1 [] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 23:27] R2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2004-08-04 00:08] R3 AVMWAN;AVM NDIS WAN CAPI Driver;C:\WINDOWS\system32\DRIVERS\avmwan.sys [2001-08-17 13:13] R3 fpcibase;AVM ISDN-Controller FRITZ!Card PCI;C:\WINDOWS\system32\DRIVERS\fpcibase.sys [2001-08-17 13:14] R3 G550DH;G550DH;C:\WINDOWS\system32\DRIVERS\g550dhm.sys [2001-09-28 19:13] S3 APLMp50;APLMp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\APLMp50.sys [2006-11-29 06:46] S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-06-04 11:16] S3 humaxfl;HUMAX - Filter Driver;C:\WINDOWS\system32\DRIVERS\humaxfl.sys [2004-06-25 01:31] S3 humaxst;HUMAX - Stub Driver;C:\WINDOWS\system32\DRIVERS\humaxst.sys [2004-06-25 01:31] S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 18:31] S3 USBCamera;Bulk USB Device;C:\WINDOWS\system32\Drivers\Bulk533.sys [2002-07-25 12:19] S3 UtilNT;UtilNT;C:\WINDOWS\system32\drivers\UtilNT.sys [2000-04-18 00:32] S4 Ca533av;USB PC Camera;C:\WINDOWS\system32\Drivers\Ca533av.sys [2002-08-22 17:19] . Contents of the 'Scheduled Tasks' folder "2008-07-05 10:17:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-10 02:24:29 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\MSVolume.dll 0 bytes scan completed successfully hidden files: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Sun\AppServer\lib\appservService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\mgabg.exe C:\Sun\AppServer\jdk\bin\java.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe . ************************************************************************** . Completion time: 2008-07-10 2:30:26 - machine was rebooted [Perry] ComboFix-quarantined-files.txt 2008-07-10 01:30:19 Pre-Run: 75,715,833,856 bytes free Post-Run: 75,761,360,896 bytes free 277 --- E O F --- 2008-07-07 00:20:10 |
|
|
|
|
07-09-2008, 08:41 PM
|
#5 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
Did you have trouble installing the Windows Recovery Console with ComboFix??
That looks a bit better, though I think you've installed a rogue application. I need more information, please. Create an uninstall list:
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
07-10-2008, 03:30 AM
|
#6 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
Hi Bob - It's great having your help! As you can see I've thrown the kitchen sink at this problem and the computer is now overflowing with scanners and anti-harmware of all colors! My employer's tame IT geeks recommended 'Search & Destroy' but I'm not sure installing it achieved an awful lot!
I followed the procedure for Installing the Recovery Console but it didn't work. Fortunately the PC survived the Combofix 'bath'! I do have a complete clone of my System HD in case anything drastic happens. Right at this moment I haven't seen a rogue web page open since the clean, but IE still has problems despite a re-install. Anyways - here is the uninstall list - I note somethings are apparently installed twice and there is definitely a lot of unused trash to clear out when I get a day to go through it all. 7-Zip 4.55 beta Adobe Bridge 1.0 Adobe Bridge CS3 Adobe Camera Raw 4.0 Adobe Color Common Settings Adobe Color Common Settings Adobe Common File Installer Adobe Encore DVD 2.0 Adobe Flash Player ActiveX Adobe Flash Player Plugin Adobe Help Center 2.0 Adobe Help Viewer CS3 Adobe OnLocation CS3 Beta Adobe Photoshop Elements 4.0 Adobe Reader 8.1.2 Adobe Setup Adobe Shockwave Player Adobe Stock Photos 1.0 Adobe Update Manager CS3 allTunes Apple Mobile Device Support Apple Software Update Audacity 1.2.6 Avanquest update AVG Free 8.0 AviSynth 2.5 BBC iPlayer Download Manager BBC iPlayer Download Manager Bonjour BootDisk2BootStick 0.10 Canon ScanGear Toolbox CS 2.2 Cuttermaran 1.66 Disc2Phone DiscWizard for Windows DVD Decrypter (Remove Only) DVD Shrink 3.2 EasyRecovery Lite Enhanced Sound Card Driver 8.0 EPSON Attach To Email EPSON File Manager EPSON Printer Software EPSON Scan Assistant FolderMatch v3.4.8 getPlus(R)_dll Google Desktop Google Earth Google Updater GUI for dvdauthor 0.99 HaftiX v. 1.1.7 HijackThis 2.0.2 Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) HP Drive Key Boot Utility Intel Application Accelerator InterActual Player iPod for Windows 2005-09-06 iPod for Windows 2006-03-23 iPod for Windows 2006-06-28 iTunes J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 9 Java Platform, Enterprise Edition 5 SDK Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) 6 Update 5 Java(TM) 6 Update 6 Java(TM) SE Development Kit 6 Update 1 Java(TM) SE Runtime Environment 6 Update 1 Macromedia Flash Player 8 Matrox Graphics Software (remove only) Media eLinker Micromega Software System EasyScan Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (3.0) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 6.0 Parser (KB933579) Nero 7 Premium neroxml Nikon Scan nLite 1.4.1 Norton Ghost Panda ActiveScan 2.0 Paragon Drive Backup 8.51 Personal Paragon Drive Backup™ 9 Personal QuickTime QuickTime QuickTime Alternative 1.75 RealPlayer Realtek AC'97 Audio REALTEK Gigabit and Fast Ethernet NIC Driver Replay AV 8 Replay Converter 2.8 Replay Media Catcher RTLSetup Seagate DiscWizard English Seagate SeaTools English Online Search And Destroy SeaTools Enterprise Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Sony Ericsson Media Manager 1.1 Sony Ericsson PC Suite 3.209.00 Sound Laundry 2.5 Sound Rescue Terratec 2.0 SpywareBlaster 4.1 Starry Night Backyard 3.1 Switch SymmTime TMPGEnc DVD Author 2.0 Trial Version TMPGEnc Plus 2.5 TransMac version 7.3 Uniblue RegistryBooster 2 Update for Windows XP (KB951978) Update Service USB 2.0 Setup program VideoReDo/Plus Version 2-1-2-417 Vuze WavePad Uninstall WDN4OAK+ Windows Defender Signatures Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows Vista Upgrade Advisor Windows XP Service Pack 3 WinPcap 4.0 WinRAR archiver XviD 1.1 final uninstall Yahoo! Toolbar YouSendIt Application Plug-in SDK |
|
|
|
|
07-10-2008, 08:17 AM
|
#7 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
The Search And Destroy which has been installed is not Spybot Search & Destroy from Safer Networking. It needs be uninstalled, as it's a rogue.
Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add or Remove Programs) if they exist: Search And Destroy --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Place a check next to the following entries if they exist (make sure you do not miss any) and click Fix Checked O4 - HKCU\..\Run: [SearchAndDestroyScheduler] C:\Program Files\Search And Destroy\SearchAndDestroy.exe SCHEDULER O4 - HKCU\..\Run: [SearchAndDestroyT] C:\Program Files\Search And Destroy\SearchAndDestroy.exe Close HijackThis now. --------------------------------------------------------------------------------------------- Locate and delete these folders: C:\WINDOWS\Search And Destroy C:\Program Files\Search And Destroy --------------------------------------------------------------------------------------------- Please download Malwarebytes' Anti-Malware to your desktop.
--------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
07-11-2008, 05:11 AM
|
#8 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
OK - got rid of Search & Destroy (got suckered into that hook, line & sinker!) but 'Hijack This' is not working properly. It does the System Scan but as soon as I try to do ANYTHING in the resultant window it locks up and doesn't respond. I tried reloading it and even downloading a new copy from TrendSecure but same result.
I'm guessing that part of my Windows system is now corrupted, I've never had much luck running a 'repair' from the installation CD (which is pre-SP1 let alone SP3!) but I guess I might have to bite the bullet sometime. The Anti-Malware scan was clean: Malwarebytes' Anti-Malware 1.20 Database version: 938 Windows 5.1.2600 Service Pack 3 12:08:05 11/07/2008 mbam-log-7-11-2008 (12-08-05).txt Scan type: Full Scan (C:\|) Objects scanned: 154683 Time elapsed: 1 hour(s), 10 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) |
|
|
|
|
07-11-2008, 08:12 AM
|
#9 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
Try performing a HijackThis scan in safe mode.
Restart your computer and boot into Safe Mode by tapping the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers. --------------------------------------------------------------------------------------------- Also, you can run DSS in normal mode, and post that log.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
07-11-2008, 06:54 PM
|
#10 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
No - doesn't work in safe mode either. Here is the DSS scan log:
-- HijackThis (run as Perry.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:34:29, on 12/07/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Sun\AppServer\lib\appservService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\svchost.exe C:\Sun\AppServer\jdk\bin\java.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\PDesk\PDesk.exe C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe C:\Documents and Settings\Perry\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Perry.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKCU\..\R=un: [SearchAndDestroyScheduler] C:\Program Files\Search And Destroy\SearchAndDestroy.exe SCHEDULER O4 - HKCU\..\Run: [SearchAndDestroyT] C:\Program Files\Search And Destroy\SearchAndDestroy.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} - http://www.seagate.com/support/disc/...n/npdscwiz.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase5036.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1154335810937 O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - http://www.seagate.com/support/disc/...npseatools.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - http://driveragent.com/files/driveragent.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: SunJavaSystemAppserver9PE (AppServer9PE) - Unknown owner - C:\Sun\AppServer\lib\appservService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 10530 bytes -- Files created between 2008-06-12 and 2008-07-12 ----------------------------- 2008-07-11 10:52:12 0 d-------- C:\Documents and Settings\Perry\Application Data\Malwarebytes 2008-07-11 10:52:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-11 10:52:08 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-10 02:56:30 0 d-------- C:\Program Files\Trend Micro 2008-07-10 02:25:56 0 --a------ C:\WINDOWS\system32\MSVolume.dll 2008-07-10 02:15:08 68096 --a------ C:\WINDOWS\zip.exe 2008-07-10 02:15:08 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-10 02:15:08 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-10 02:15:08 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-10 02:15:08 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-10 02:15:08 98816 --a------ C:\WINDOWS\sed.exe 2008-07-10 02:15:08 80412 --a------ C:\WINDOWS\grep.exe 2008-07-10 02:15:08 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-09 01:10:30 0 d-------- C:\Program Files\Windows Live Safety Center 2008-07-07 23:57:00 0 d-------- C:\ie-spyad_zo 2008-07-07 23:22:51 0 d-------- C:\Program Files\SpywareBlaster 2008-07-07 12:29:03 0 d-------- C:\Program Files\Panda Security 2008-07-04 11 53 0 d-------- C:\WINDOWS\system32\scripting2008-07-04 11 53 0 d-------- C:\WINDOWS\l2schemas2008-07-04 11 52 0 d-------- C:\WINDOWS\system32\en2008-07-04 11 51 0 d-------- C:\WINDOWS\system32\bits2008-07-04 11:02:30 0 d-------- C:\WINDOWS\ServicePackFiles 2008-07-04 10:28:27 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-23 23:55:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-06-23 23:55:30 0 d-------- C:\Documents and Settings\Perry\Application Data\Azureus 2008-06-23 23:54:23 0 d-------- C:\Program Files\Vuze 2008-06-16 10:52:42 0 d-------- C:\WINDOWS\Replay Media Catcher 2008-06-16 10:52:15 0 d-------- C:\Program Files\Replay Media Catcher -- Find3M Report --------------------------------------------------------------- 2008-07-07 23:42:06 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-07-07 12:15:56 0 d-------- C:\Program Files\MUSICMATCH 2008-07-07 12:15:45 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-07 12:15:07 0 d-------- C:\Program Files\Symantec 2008-07-04 12:31:58 0 d-------- C:\Documents and Settings\Perry\Application Data\AVGTOOLBAR 2008-07-04 11:47:58 0 d-------- C:\Program Files\Messenger 2008-07-04 11 51 0 d-------- C:\Program Files\Movie Maker2008-07-04 11:02:04 0 d-------- C:\Program Files\Windows NT 2008-07-04 01:57:11 0 d-------- C:\Program Files\Paragon Software 2008-06-26 10:52:06 0 d-------- C:\Documents and Settings\Perry\Application Data\Mozilla 2008-06-16 10:28:02 0 d-------- C:\Program Files\Replay AV 8 2008-06-16 09:09:27 0 d-------- C:\Documents and Settings\Perry\Application Data\Apple Computer 2008-06-04 11:14:23 0 d-------- C:\Program Files\Sony Ericsson 2008-06-04 11:13:14 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony 2008-06-04 11:09:07 0 d-------- C:\Program Files\Sony 2008-06-04 11:08:01 0 d-------- C:\Program Files\QuickTime 2008-06-04 11:07:30 0 d-------- C:\Program Files\QuickTime Alternative 2008-06-04 11:05:02 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Setup 2008-06-04 11:04:34 0 d-------- C:\Program Files\Sony Setup 2008-06-04 10:58:20 0 d-------- C:\Program Files\Avanquest update 2008-06-04 10:14:45 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Ericsson 2008-06-04 10:10:25 0 d-------- C:\Program Files\Common Files 2008-05-26 08:53:09 0 d-------- C:\Program Files\Apple Software Update 2008-05-23 03:13:30 0 d-------- C:\Program Files\iTunes 2008-05-23 03:13:15 0 d-------- C:\Program Files\iPod 2008-05-23 03:12:03 0 d-------- C:\Program Files\Bonjour 2008-05-23 03:09:05 0 d-------- C:\Program Files\Common Files\Apple 2008-05-21 01:54:03 0 d-------- C:\Program Files\AVG -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 03/07/2008 23:27 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [03/07/2008 23:27 2055960] [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Matrox Powerdesk"="C:\WINDOWS\system32\PDesk\PDesk.exe" [21/09/2001 17:35] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [09/09/2005 01:18] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [14/08/2007 08:05] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 18:53] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25/03/2008 04:28] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/03/2008 01:55] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [03/07/2008 23:27] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 01:12] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [12/03/2007 13:49] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/04/2008 01:12] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/05/2007 08:42] "kdx"="C:\Program Files\Kontiki\KHost.exe" [27/11/2007 12:58] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [22/10/2007 09:58] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [20/02/2008 17:19] "SearchAndDestroyScheduler"="C:\Program Files\Search And Destroy\SearchAndDestroy.exe" [] "SearchAndDestroyT"="C:\Program Files\Search And Destroy\SearchAndDestroy.exe" [] C:\Documents and Settings\Perry\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16/03/2005 21:16:50] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [30/12/2005 12:10:24] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [08/05/2007 08:42:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-07-12 01:37:49 ------------ |
|
|
|
|
07-11-2008, 07:31 PM
|
#11 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
Do you get an error message of any sort when you try to use HijackThis? If so, what exactly?
Copy and paste the following into Notepad (don't forget to copy and paste REGEDIT4): Quote:
 Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards. --------------------------------------------------------------------------------------------- Locate and delete this file: C:\WINDOWS\system32\MSVolume.dll --------------------------------------------------------------------------------------------- Reboot. Run DSS once again, and post it's log.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
07-12-2008, 02:25 AM
|
#12 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
OK - done that. The Hijackthis system scan produces a log in a window but if you try to do anything with it, like scroll down to the lines of interest, then it shows the hourglass symbol and then a 'Not Responding' message. Actually - I've just noticed that the 'thermometer' never actually goes right to the end during the scan.
Anyways - here is the new DSS scan: Deckard's System Scanner v20071014.68 Run by Perry on 2008-07-12 08:44:23 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Perry.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:47:00, on 12/07/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Sun\AppServer\lib\appservService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Sun\AppServer\jdk\bin\java.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\PDesk\PDesk.exe C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Perry\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Perry.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} - http://www.seagate.com/support/disc/...n/npdscwiz.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase5036.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1154335810937 O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - http://www.seagate.com/support/disc/...npseatools.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - http://driveragent.com/files/driveragent.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: SunJavaSystemAppserver9PE (AppServer9PE) - Unknown owner - C:\Sun\AppServer\lib\appservService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 10381 bytes -- Files created between 2008-06-12 and 2008-07-12 ----------------------------- 2008-07-11 10:52:12 0 d-------- C:\Documents and Settings\Perry\Application Data\Malwarebytes 2008-07-11 10:52:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-11 10:52:08 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-10 02:56:30 0 d-------- C:\Program Files\Trend Micro 2008-07-10 02:15:08 68096 --a------ C:\WINDOWS\zip.exe 2008-07-10 02:15:08 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-10 02:15:08 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-10 02:15:08 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-10 02:15:08 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-10 02:15:08 98816 --a------ C:\WINDOWS\sed.exe 2008-07-10 02:15:08 80412 --a------ C:\WINDOWS\grep.exe 2008-07-10 02:15:08 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-09 01:10:30 0 d-------- C:\Program Files\Windows Live Safety Center 2008-07-07 23:57:00 0 d-------- C:\ie-spyad_zo 2008-07-07 23:22:51 0 d-------- C:\Program Files\SpywareBlaster 2008-07-07 12:29:03 0 d-------- C:\Program Files\Panda Security 2008-07-04 11 53 0 d-------- C:\WINDOWS\system32\scripting2008-07-04 11 53 0 d-------- C:\WINDOWS\l2schemas2008-07-04 11 52 0 d-------- C:\WINDOWS\system32\en2008-07-04 11 51 0 d-------- C:\WINDOWS\system32\bits2008-07-04 11:02:30 0 d-------- C:\WINDOWS\ServicePackFiles 2008-07-04 10:28:27 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-23 23:55:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-06-23 23:55:30 0 d-------- C:\Documents and Settings\Perry\Application Data\Azureus 2008-06-23 23:54:23 0 d-------- C:\Program Files\Vuze 2008-06-16 10:52:42 0 d-------- C:\WINDOWS\Replay Media Catcher 2008-06-16 10:52:15 0 d-------- C:\Program Files\Replay Media Catcher -- Find3M Report --------------------------------------------------------------- 2008-07-07 23:42:06 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-07-07 12:15:56 0 d-------- C:\Program Files\MUSICMATCH 2008-07-07 12:15:45 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-07 12:15:07 0 d-------- C:\Program Files\Symantec 2008-07-04 12:31:58 0 d-------- C:\Documents and Settings\Perry\Application Data\AVGTOOLBAR 2008-07-04 11:47:58 0 d-------- C:\Program Files\Messenger 2008-07-04 11 51 0 d-------- C:\Program Files\Movie Maker2008-07-04 11:02:04 0 d-------- C:\Program Files\Windows NT 2008-07-04 01:57:11 0 d-------- C:\Program Files\Paragon Software 2008-06-26 10:52:06 0 d-------- C:\Documents and Settings\Perry\Application Data\Mozilla 2008-06-16 10:28:02 0 d-------- C:\Program Files\Replay AV 8 2008-06-16 09:09:27 0 d-------- C:\Documents and Settings\Perry\Application Data\Apple Computer 2008-06-04 11:14:23 0 d-------- C:\Program Files\Sony Ericsson 2008-06-04 11:13:14 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony 2008-06-04 11:09:07 0 d-------- C:\Program Files\Sony 2008-06-04 11:08:01 0 d-------- C:\Program Files\QuickTime 2008-06-04 11:07:30 0 d-------- C:\Program Files\QuickTime Alternative 2008-06-04 11:05:02 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Setup 2008-06-04 11:04:34 0 d-------- C:\Program Files\Sony Setup 2008-06-04 10:58:20 0 d-------- C:\Program Files\Avanquest update 2008-06-04 10:14:45 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Ericsson 2008-06-04 10:10:25 0 d-------- C:\Program Files\Common Files 2008-05-26 08:53:09 0 d-------- C:\Program Files\Apple Software Update 2008-05-23 03:13:30 0 d-------- C:\Program Files\iTunes 2008-05-23 03:13:15 0 d-------- C:\Program Files\iPod 2008-05-23 03:12:03 0 d-------- C:\Program Files\Bonjour 2008-05-23 03:09:05 0 d-------- C:\Program Files\Common Files\Apple 2008-05-21 01:54:03 0 d-------- C:\Program Files\AVG -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 03/07/2008 23:27 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [03/07/2008 23:27 2055960] [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Matrox Powerdesk"="C:\WINDOWS\system32\PDesk\PDesk.exe" [21/09/2001 17:35] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [09/09/2005 01:18] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [14/08/2007 08:05] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 18:53] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25/03/2008 04:28] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/03/2008 01:55] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [03/07/2008 23:27] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 01:12] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [12/03/2007 13:49] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/04/2008 01:12] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/05/2007 08:42] "kdx"="C:\Program Files\Kontiki\KHost.exe" [27/11/2007 12:58] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [22/10/2007 09:58] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [20/02/2008 17:19] C:\Documents and Settings\Perry\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16/03/2005 21:16:50] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [30/12/2005 12:10:24] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [08/05/2007 08:42:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-07-12 08:51:30 ------------ |
|
|
|
|
07-12-2008, 08:43 AM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
HijackThis sometimes has difficulty on some machines if there is a large number of items in the domains section of the registry (Trusted Zone, Restricted Sites) such as is placed there by IE-Spyad/SpywareBlaster. That said, we can work around it, and have. Things look good from here. We have a couple more tasks to perform.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
--------------------------------------------------------------------------------------------- Please download ATF Cleaner by Atribune.
For Technical Support, double-click the e-mail address located at the bottom of each menu. --------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
**Note** To optimize scanning time and produce a more sensible report for review:
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Run DSS once again, and post it's log. How is the machine behaving?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
07-13-2008, 12:19 AM
|
#14 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
The computer seems pretty good - all the random web page stuff has gone. IE still takes an age to open, Firefox is better but still not good. Maybe something to do with my AVG antivirus, which also will not remember it's schedule!
Here is the Kaspersky scan (which took all night): ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, July 13, 2008 7:10:04 AM Operating System: Microsoft Windows XP Professional, Service Pack 3 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 12/07/2008 Kaspersky Anti-Virus database records: 945956 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ Scan Statistics: Total number of scanned objects: 136984 Number of viruses found: 5 Number of infected objects: 15 Number of suspicious objects: 4 Duration of the scan process: 07:21:36 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\20080710025547\backup\DOCUME~1\Perry\LOCALS~1\Temp\NeroDemo12550\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgui.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwd.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg8\Log\commonpriv.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Kontiki\error.log Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\cert8.db Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\content-prefs.sqlite Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\cookies.sqlite Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\downloads.sqlite Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\formhistory.sqlite Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\key3.db Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\parent.lock Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\permissions.sqlite Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\places.sqlite Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\places.sqlite-journal Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\places.sqlite-stmtjrnl Object is locked skipped C:\Documents and Settings\Perry\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\search.sqlite Object is locked skipped C:\Documents and Settings\Perry\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbc2e.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbdam Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbdao Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbeam Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbeao Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbm Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbu2d.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbvm.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\dbvmh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\fii.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\fiih.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\fim1i.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\fim1ih.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\hp Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\hpt2i.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\rpm.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\rpm1n.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\rpm1n1m.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\rpm1n1mh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\rpm1nh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\rpmh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-black-enchashm.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-black-enchashmh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-black-urlm.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-black-urlmh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-malware-domainm.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-malware-domainmh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-white-domainm.cf1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Google\Google Desktop Search\safeweb\goog-white-domainmh.ht1 Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Identities\{71708BDC-382A-419A-AC6C-4A61B57166CA}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Identities\{71708BDC-382A-419A-AC6C-4A61B57166CA}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Application Data\Mozilla\Firefox\Profiles\sbxresf5.default\urlclassifier3.sqlite Object is locked skipped C:\Documents and Settings\Perry\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Perry\Local Settings\History\History.IE5\MSHist012008071220080713\index.dat Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Temp\~DFE496.tmp Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Perry\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Perry\ntuser.dat Object is locked skipped C:\Documents and Settings\Perry\NTUSER.DAT.LOG Object is locked skipped C:\PerryFiles\Jokes\Late98.pst/Archive Folders/Jokes/11 Dec 1998 12:12 from Bob Pugh:FW: Real Men/realmen.exe Infected: not-virus:BadJoke.Win16.Stupid.a skipped C:\PerryFiles\Jokes\Late98.pst MailMSMaill: infected - 1 skipped C:\PerryFiles\LMUG Forum\May04.pst/Archive Folders/LMUG/23 Mar 2004 15:05 from Darcy Horrocks:[lmug-talk] interesting ne.eml Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\PerryFiles\LMUG Forum\May04.pst MailMSMaill: suspicious - 1 skipped C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{9BF12D58-36AD-4DF5-A6D8-D5D10094E82B}\RP1131\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_62c.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{9BF12D58-36AD-4DF5-A6D8-D5D10094E82B}\RP1131\change.log Object is locked skipped F:\PerryFiles\Jokes\Late98.pst/Archive Folders/Jokes/11 Dec 1998 12:12 from Bob Pugh:FW: Real Men/realmen.exe Infected: not-virus:BadJoke.Win16.Stupid.a skipped F:\PerryFiles\Jokes\Late98.pst MailMSMaill: infected - 1 skipped F:\PerryFiles\LMUG Forum\May04.pst/Archive Folders/LMUG/23 Mar 2004 15:05 from Darcy Horrocks:[lmug-talk] interesting ne.eml Suspicious: Exploit.HTML.Iframe.FileDownload skipped F:\PerryFiles\LMUG Forum\May04.pst MailMSMaill: suspicious - 1 skipped F:\Prog installers\kf141.zip/keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped F:\Prog installers\kf141.zip/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped F:\Prog installers\kf141.zip/keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped F:\Prog installers\kf141.zip/keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped F:\Prog installers\kf141.zip ZIP: infected - 4 skipped F:\Prog installers\Nero-7.8.5.0_eng_update.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped F:\Prog installers\Nero-7.8.5.0_eng_update.exe RAR: infected - 1 skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\System Volume Information\_restore{9BF12D58-36AD-4DF5-A6D8-D5D10094E82B}\RP1131\change.log Object is locked skipped G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped G:\System Volume Information\_restore{9BF12D58-36AD-4DF5-A6D8-D5D10094E82B}\RP1131\change.log Object is locked skipped Scan process completed. |
|
|
|
|
07-13-2008, 12:39 AM
|
#15 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 13
OS: WinXP
|
Re: Browser anarchy!
Here is the new DSS scan:
Deckard's System Scanner v20071014.68 Run by Perry on 2008-07-13 07:20:58 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Perry.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:22:55, on 13/07/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\PDesk\PDesk.exe C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Perry\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Perry.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} - http://www.seagate.com/support/disc/...n/npdscwiz.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase5036.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1154335810937 O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - http://www.seagate.com/support/disc/...npseatools.cab O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - http://driveragent.com/files/driveragent.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 10144 bytes -- Files created between 2008-06-13 and 2008-07-13 ----------------------------- 2008-07-12 20:27:12 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-07-12 20:27:09 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-07-12 20:27:06 0 d-------- C:\WINDOWS\LastGood 2008-07-12 20:12:23 0 d-------- C:\Program Files\Common Files\Java 2008-07-11 10:52:12 0 d-------- C:\Documents and Settings\Perry\Application Data\Malwarebytes 2008-07-11 10:52:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-11 10:52:08 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-10 02:56:30 0 d-------- C:\Program Files\Trend Micro 2008-07-10 02:15:08 68096 --a------ C:\WINDOWS\zip.exe 2008-07-10 02:15:08 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-10 02:15:08 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-10 02:15:08 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-10 02:15:08 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-10 02:15:08 98816 --a------ C:\WINDOWS\sed.exe 2008-07-10 02:15:08 80412 --a------ C:\WINDOWS\grep.exe 2008-07-10 02:15:08 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-09 01:10:30 0 d-------- C:\Program Files\Windows Live Safety Center 2008-07-07 23:57:00 0 d-------- C:\ie-spyad_zo 2008-07-07 23:22:51 0 d-------- C:\Program Files\SpywareBlaster 2008-07-07 12:29:03 0 d-------- C:\Program Files\Panda Security 2008-07-04 11 53 0 d-------- C:\WINDOWS\system32\scripting2008-07-04 11 53 0 d-------- C:\WINDOWS\l2schemas2008-07-04 11 52 0 d-------- C:\WINDOWS\system32\en2008-07-04 11 51 0 d-------- C:\WINDOWS\system32\bits2008-07-04 11:02:30 0 d-------- C:\WINDOWS\ServicePackFiles 2008-07-04 10:28:27 0 d-------- C:\Program Files\Microsoft Silverlight 2008-06-23 23:55:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-06-23 23:55:30 0 d-------- C:\Documents and Settings\Perry\Application Data\Azureus 2008-06-23 23:54:23 0 d-------- C:\Program Files\Vuze 2008-06-16 10:52:42 0 d-------- C:\WINDOWS\Replay Media Catcher 2008-06-16 10:52:15 0 d-------- C:\Program Files\Replay Media Catcher -- Find3M Report --------------------------------------------------------------- 2008-07-12 20:13:26 0 d-------- C:\Program Files\Java 2008-07-12 20:12:23 0 d-------- C:\Program Files\Common Files 2008-07-12 19:14:17 95 --a------ C:\WINDOWS\system32\productregistry 2008-07-07 23:42:06 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-07-07 12:15:56 0 d-------- C:\Program Files\MUSICMATCH 2008-07-07 12:15:45 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-07 12:15:07 0 d-------- C:\Program Files\Symantec 2008-07-04 12:31:58 0 d-------- C:\Documents and Settings\Perry\Application Data\AVGTOOLBAR 2008-07-04 11:47:58 0 d-------- C:\Program Files\Messenger 2008-07-04 11 51 0 d-------- C:\Program Files\Movie Maker2008-07-04 11:02:04 0 d-------- C:\Program Files\Windows NT 2008-07-04 01:57:11 0 d-------- C:\Program Files\Paragon Software 2008-06-26 10:52:06 0 d-------- C:\Documents and Settings\Perry\Application Data\Mozilla 2008-06-16 10:28:02 0 d-------- C:\Program Files\Replay AV 8 2008-06-16 09:09:27 0 d-------- C:\Documents and Settings\Perry\Application Data\Apple Computer 2008-06-04 11:14:23 0 d-------- C:\Program Files\Sony Ericsson 2008-06-04 11:13:14 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony 2008-06-04 11:09:07 0 d-------- C:\Program Files\Sony 2008-06-04 11:08:01 0 d-------- C:\Program Files\QuickTime 2008-06-04 11:07:30 0 d-------- C:\Program Files\QuickTime Alternative 2008-06-04 11:05:02 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Setup 2008-06-04 11:04:34 0 d-------- C:\Program Files\Sony Setup 2008-06-04 10:58:20 0 d-------- C:\Program Files\Avanquest update 2008-06-04 10:14:45 0 d-------- C:\Documents and Settings\Perry\Application Data\Sony Ericsson 2008-05-26 08:53:09 0 d-------- C:\Program Files\Apple Software Update 2008-05-23 03:13:30 0 d-------- C:\Program Files\iTunes 2008-05-23 03:13:15 0 d-------- C:\Program Files\iPod 2008-05-23 03:12:03 0 d-------- C:\Program Files\Bonjour 2008-05-23 03:09:05 0 d-------- C:\Program Files\Common Files\Apple 2008-05-21 01:54:03 0 d-------- C:\Program Files\AVG -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 03/07/2008 23:27 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [03/07/2008 23:27 2055960] [-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Matrox Powerdesk"="C:\WINDOWS\system32\PDesk\PDesk.exe" [21/09/2001 17:35] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [09/09/2005 01:18] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [14/08/2007 08:05] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 18:53] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/03/2008 01:55] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [03/07/2008 23:27] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [19/10/2007 20:16] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [10/06/2008 04:27] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 01:12] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [12/03/2007 13:49] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [14/04/2008 01:12] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [08/05/2007 08:42] "kdx"="C:\Program Files\Kontiki\KHost.exe" [27/11/2007 12:58] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [22/10/2007 09:58] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [20/02/2008 17:19] C:\Documents and Settings\Perry\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16/03/2005 21:16:50] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [30/12/2005 12:10:24] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [08/05/2007 08:42:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-07-13 07:26:03 ------------ |
|
|
|
|
07-13-2008, 09:07 AM
|
#16 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
Some older mails have been identified as threats.
C:\PerryFiles\Jokes\Late98.pst /Archive Folders/Jokes/11 Dec 1998 12:12 from Bob Pugh:FW: Real Men C:\PerryFiles\LMUG Forum\May04.pst /Archive Folders/LMUG/23 Mar 2004 15:05 from Darcy Horrocks:[lmug-talk] interesting ne.eml F:\PerryFiles\Jokes\Late98.pst /Archive Folders/Jokes/11 Dec 1998 12:12 from Bob Pugh:FW: Real Men F:\PerryFiles\LMUG Forum\May04.pst /Archive Folders/LMUG/23 Mar 2004 15:05 from Darcy Horrocks:[lmug-talk] interesting ne.eml AVG's LinkScanner has been known to cause issues with some machines' internet experience. I think it's possible to disable that portion of AVG8. More info here: http://www.grisoft.com/ww.faq.num-1094 It's also possible to install AVG8 without LinkScanner Some scanners call the Ask Toolbar adware. I'll leave the decision on whether to keep it or not to you. Other than that............. Your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 07-13-2008 at 09:11 AM. |
|
|
|
|
07-13-2008, 09:56 PM
|
#18 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,611
OS: 2000 Pro; XP Pro; XP Home
|
Re: Browser anarchy!
You're quite welcome, Perry.
Surf Safely, and Think Prevention! Since this issue is resolved, this topic will be archived.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
