PC running slow Laptop spybot detects Trojan but cant remove

pip.1 · 10-04-2009, 12:51 PM

DDS (Ver_09-09-29.01) - NTFSx86
Run by julie and paul at 19:40:31.85 on 04/10/2009
Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2037.844 [GMT 1:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
c:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewerS\QuickDCF2.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\julie and paul\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [TOSCDSPD] TOSCDSPD.EXE
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [topi] c:\program files\toshiba\toshiba online product information\topi.exe -startup
mRun: [Desktop SMS] c:\program files\idm\desktop sms\DesktopSMS.exe /auto
mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun: [Toshiba Registration] c:\program files\toshiba\registration\ToshibaRegistration.exe
mRun: [jswtrayutil] "c:\program files\jumpstart\jswtrayutil.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Skytel] Skytel.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewers\QuickDCF2.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~3\GOEC62~1DLL,avgrsstx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\juliea~1\appdata\roaming\mozilla\firefox\profiles\q099s4hr.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-10 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-10 108552]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2008-5-2 20352]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-27 297752]
R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2007-12-25 40960]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-2-26 7168]
S2 vvdsvc;VJVodClientServices;c:\windows\system32\svchost.exe -k vvdsvc [2008-1-21 21504]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-3-23 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\jumpstart\jswpsapi.exe [2008-5-2 937984]
S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [2008-12-29 28704]

=============== Created Last 30 ================

2009-10-04 09:30 <DIR> --d----- c:\windows\system32\EventProviders
2009-10-02 18:53 195,440 -------- c:\windows\system32\MpSigStub.exe
2009-09-23 21:11 <DIR> --d----- c:\program files\Live-Player
2009-09-09 18:00 499,712 a------- c:\windows\system32\kerberos.dll
2009-09-09 18:00 175,104 a------- c:\windows\system32\wdigest.dll
2009-09-09 18:00 1,256,448 a------- c:\windows\system32\lsasrv.dll
2009-09-09 18:00 270,848 a------- c:\windows\system32\schannel.dll
2009-09-09 18:00 213,504 a------- c:\windows\system32\msv1_0.dll
2009-09-09 18:00 439,896 a------- c:\windows\system32\drivers\ksecdd.sys
2009-09-09 18:00 72,704 a------- c:\windows\system32\secur32.dll
2009-09-09 18:00 9,728 a------- c:\windows\system32\lsass.exe
2009-09-09 14:16 897,608 a------- c:\windows\system32\drivers\tcpip.sys
2009-09-09 14:16 104,960 a------- c:\windows\system32\netiohlp.dll
2009-09-09 14:16 27,136 a------- c:\windows\system32\NETSTAT.EXE
2009-09-09 14:16 19,968 a------- c:\windows\system32\ARP.EXE
2009-09-09 14:16 17,920 a------- c:\windows\system32\ROUTE.EXE
2009-09-09 14:16 11,264 a------- c:\windows\system32\MRINFO.EXE
2009-09-09 14:16 10,240 a------- c:\windows\system32\finger.exe
2009-09-09 14:16 9,728 a------- c:\windows\system32\TCPSVCS.EXE
2009-09-09 14:16 8,704 a------- c:\windows\system32\HOSTNAME.EXE
2009-09-09 14:16 17,920 a------- c:\windows\system32\netevent.dll
2009-09-09 14:15 2,501,921 a------- c:\windows\system32\wlan.tmf
2009-09-09 14:15 513,024 a------- c:\windows\system32\wlansvc.dll
2009-09-09 14:15 302,592 a------- c:\windows\system32\wlansec.dll
2009-09-09 14:15 293,376 a------- c:\windows\system32\wlanmsm.dll
2009-09-09 14:15 127,488 a------- c:\windows\system32\L2SecHC.dll
2009-09-09 14:15 2,868,224 a------- c:\windows\system32\mf.dll
2009-09-06 22:26 <DIR> --d----- c:\users\julie and paul\awc_PIP44WM

==================== Find3M ====================

2009-09-02 18:21 143,360 a------- c:\windows\inf\infstrng.dat
2009-09-02 18:21 86,016 a------- c:\windows\inf\infstor.dat
2009-09-02 18:21 51,200 a------- c:\windows\inf\infpub.dat
2009-08-28 13:39 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-08-28 13:39 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-08-28 13:38 2,153,984 a------- c:\windows\apppatch\AcGenral.dll
2009-08-28 13:38 541,696 a------- c:\windows\apppatch\AcLayers.dll
2009-08-28 13:38 459,776 a------- c:\windows\apppatch\AcSpecfc.dll
2009-08-28 11:15 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 09:55 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-27 09:55 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-07-24 13:33 484 a------- c:\users\juliea~1\appdata\roaming\wklnhst.dat
2009-07-21 22:52 915,456 a------- c:\windows\system32\wininet.dll
2009-07-21 22:47 109,056 a------- c:\windows\system32\iesysprep.dll
2009-07-21 22:47 71,680 a------- c:\windows\system32\iesetup.dll
2009-07-21 21:13 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-07-17 15:35 71,680 a------- c:\windows\system32\atl.dll
2009-07-14 14:00 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-07-14 13:59 4,096 a------- c:\windows\system32\dxmasf.dll
2009-07-14 13:58 7,680 a------- c:\windows\system32\spwmp.dll
2009-07-14 11:59 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-04-09 12:08 766,736 a------- c:\users\julie and paul\avg_avwt_stb_all_8_15.exe
2009-03-23 17:53 140,066,664 a------- c:\users\julie and paul\wlsetup-all.exe
2008-06-12 16:18 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-21 03:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2008-07-04 17:38 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2008-07-04 17:38 32,768 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2008-07-04 17:38 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat
2009-06-20 10:02 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-06-20 10:02 32,768 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-06-20 10:02 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat
2009-06-20 10:02 245,760 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 19:41:58.95 ===============

pip.1 · 10-07-2009, 10:47 AM

Bump!

pip.1 · 10-08-2009, 01:31 PM

Bump!

Ried · 10-10-2009, 07:49 AM

Hello pip.1,

Your title says Spybot is detecting a trojan. Could you provide more detail please? What is the name of the trojan and where is it finding it?

pip.1 · 10-10-2009, 02:46 PM

Hope this helps.
Spybot -win 32 agent Trojanfbx.
Also 12 pupsc dont know what they are .
Spybot cant remove them .

--- Search result list ---
Live-Player: [SBI $EE6E3A99] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Live-Player

Live-Player: [SBI $3EEA5E92] Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player

Live-Player: [SBI $3EEA5E92] Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player

Live-Player: [SBI $D0CE2ACA] Program directory (Directory, nothing done)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\

Live-Player: [SBI $CF0BC1B5] Link (File, nothing done)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Privacy Policy.url
Properties.size=64
Properties.md5=B879C3BAEB64DAC6E1FF20E64D9B48B6
Properties.filedate=1253736701
Properties.filedatetext=2009-09-23 21:11:41

Live-Player: [SBI $CF0BC1B5] Link (File, nothing done)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Terms and Conditions.url
Properties.size=62
Properties.md5=EB653E4A619A53A2AFE2F4E2694B0FA4
Properties.filedate=1253736701
Properties.filedatetext=2009-09-23 21:11:41

Live-Player: [SBI $CF0BC1B5] Link (File, nothing done)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Website.url
Properties.size=53
Properties.md5=D252DA6353F7ED1AD3B6BDB62B2C3FB3
Properties.filedate=1253736701
Properties.filedatetext=2009-09-23 21:11:41

Live-Player: [SBI $C082D99B] Link (File, nothing done)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Live-Player.lnk
Properties.size=639
Properties.md5=36261844D09EA9E37AE86352C2B5840E
Properties.filedate=1253736701
Properties.filedatetext=2009-09-23 21:11:41

Live-Player: [SBI $C082D99B] Link (File, nothing done)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Uninstall.lnk
Properties.size=615
Properties.md5=F691C31C7EFDD62F9FC36CA76DE6CD4E
Properties.filedate=1253736701
Properties.filedatetext=2009-09-23 21:11:41

Live-Player: [SBI $41D1D194] Program directory (Directory, nothing done)
C:\Program Files\Live-Player\

Live-Player: [SBI $3D1B7FA6] Program directory (Directory, nothing done)
C:\Program Files\Live-Player\data\

Live-Player: [SBI $66063D23] Program directory (Directory, nothing done)
C:\Program Files\Live-Player\skins\

Win32.Agent.fbx: [SBI $86BD92BA] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fnmtt

--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-09-27 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-09-07 advcheck.dll (1.6.4.18)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2008-10-22 Tools.dll (2.1.6.8)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-05-19 Includes\Adware.sbi (*)
2009-10-06 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-08-10 Includes\Dialer.sbi (*)
2009-10-06 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-05-26 Includes\Hijackers.sbi (*)
2009-10-06 Includes\HijackersC.sbi (*)
2009-09-29 Includes\Keyloggers.sbi (*)
2009-10-06 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-10-06 Includes\Malware.sbi (*)
2009-10-06 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-10-06 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-10-06 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-10-06 Includes\SpywareC.sbi (*)
2009-06-08 Includes\Tracks.uti
2009-10-06 Includes\Trojans.sbi (*)
2009-10-06 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

--- System information ---
Windows Vista (Build: 6001) Service Pack 1 (6.0.6001)

-
Start: 0
Type: 1
Error Control: 3

Ried · 10-10-2009, 07:52 PM

Thank you.
Click the round Windows Logo button in the lower left corner-> Control Panel-> Programs-> Uninstall or change a program

Start > Computer > uninstall or change a program

Uninstall the following:

Live-Player

Reboot your system.

==================================

Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:

Establish an internet connection & perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

pip.1 · 10-11-2009, 11:29 AM

KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, October 11, 2009
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, October 11, 2009 10:38:38
Records in database: 2952535
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
E:\
F:\

Scan statistics:
Objects scanned: 119219
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 03:19:40

File name / Threat / Threats count
C:\Users\julie and paul\Documents\LimeWire\Saved\3o3h dont trust me [new single].au Infected: Trojan-Downloader.WMA.GetCodec.af 1

Selected area has been scanned.

pip.1 · 10-11-2009, 11:35 AM

Teenagers and Limewire,im going to uninstall Limewire but will wait for your advice as to when.

Ried · 10-12-2009, 12:01 AM

You are correct about Limewire, more accurately the music file sharing that has gone on.

You can go ahead and uninstall LimeWire now. Delete this folder if it still exists after the uninstall:

C:\Users\julie and paul\Documents\LimeWire

==================================

Due to the infection detected in that music file download, I now feel it prudent to run ComboFix. Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal.

====================================================

Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

pip.1 · 10-12-2009, 12:17 PM

Thanks for the help
Ran Combofix first time Laptop got turned off by Daughter.So this is the second run.
Cannot uninstall Limewire not in uninstall programs aand uninstall doesnt works.,will try again.

ComboFix 09-10-11.03 - julie and paul 12/10/2009 18:33.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2037.926 [GMT 1:00]
Running from: c:\users\julie and paul\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\julie and paul\AppData\Local\Temp\ppcrlui_4456_2
c:\users\JULIEA~1\AppData\Local\Temp\ppcrlui_4456_2

.
((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 )))))))))))))))))))))))))))))))
.

2009-10-12 17:45 . 2009-10-12 17:45 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-12 17:45 . 2009-10-12 17:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-08 21:59 . 2009-10-08 19:51 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-10-08 19:51 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-10-08 19:50 . 2009-10-08 19:50 -------- dc-h--w- c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}
2009-10-08 19:49 . 2009-10-08 19:51 -------- d-----w- c:\programdata\Lavasoft
2009-10-08 19:49 . 2009-10-08 19:49 -------- d-----w- c:\program files\Lavasoft
2009-10-04 08:30 . 2009-10-04 08:30 -------- d-----w- c:\windows\system32\EventProviders
2009-10-02 17:53 . 2009-10-01 09:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-23 20:11 . 2009-09-26 08:08 97 ----a-w- c:\users\julie and paul\AppData\Local\fnmtt.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-12 00:13 . 2008-09-29 23:21 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-04 18:14 . 2008-12-16 12:33 -------- d-----w- c:\program files\Common Files\Apple
2009-10-04 12:10 . 2008-05-13 15:43 -------- d-----w- c:\users\julie and paul\AppData\Roaming\LimeWire
2009-10-03 13:13 . 2008-09-29 23:21 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-14 18:19 . 2009-05-02 18:19 -------- d-----w- c:\users\julie and paul\AppData\Roaming\FUJIFILM
2009-09-10 16:39 . 2008-07-27 19:05 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-10 07:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-10 07:20 . 2008-02-26 16:44 -------- d-----w- c:\programdata\Microsoft Help
2009-09-02 17:21 . 2009-09-02 17:21 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-09-02 17:21 . 2009-09-02 17:18 -------- d-----w- c:\programdata\Apple Computer
2009-09-02 17:19 . 2009-09-02 17:18 -------- d-----w- c:\program files\QuickTime
2009-08-29 15:43 . 2009-08-29 15:43 -------- d-----w- c:\program files\sina
2009-08-28 12:39 . 2009-09-03 09:36 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-03 09:36 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 08:55 . 2009-05-10 10:07 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-27 08:55 . 2009-05-10 10:07 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-27 08:55 . 2009-05-10 10:07 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-14 17:07 . 2009-09-09 13:16 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 13:16 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 13:16 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 13:16 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 13:16 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 13:16 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 13:16 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 13:16 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 13:16 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 13:16 10240 ----a-w- c:\windows\system32\finger.exe
2009-07-24 12:33 . 2008-05-02 21:19 484 ----a-w- c:\users\julie and paul\AppData\Roaming\wklnhst.dat
2009-07-21 21:52 . 2009-07-29 15:30 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 15:30 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 15:30 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 15:30 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 14:35 . 2009-08-24 16:58 71680 ----a-w- c:\windows\system32\atl.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-12_16.56.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-10-12 17:27 58598 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-10-12 17:27 78156 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-02 20:53 . 2009-10-12 17:27 11148 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1898029673-3949625260-1174708737-1000_UserData.bin
+ 2008-05-02 21:35 . 2009-10-12 17:30 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-02 21:35 . 2009-10-12 16:39 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-02 21:35 . 2009-10-12 16:39 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-02 21:35 . 2009-10-12 17:30 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-02 21:35 . 2009-10-12 16:39 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-05-02 21:35 . 2009-10-12 17:30 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-12 17:24 . 2009-10-12 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-10-12 14:20 . 2009-10-12 14:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-10-12 14:20 . 2009-10-12 14:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-10-12 17:24 . 2009-10-12 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-06-19 15:54 . 2009-10-12 17:27 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-06-19 15:54 . 2009-10-12 14:21 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-06-08 15:09 . 2009-10-12 17:23 1652344 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2009-06-08 15:09 . 2009-10-12 00:18 1652344 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 10:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-20 136600]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-05 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-05 129560]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"Desktop SMS"="c:\program files\IDM\Desktop SMS\DesktopSMS.exe" [2007-06-18 1507328]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-10-25 413696]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 571024]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-14 185896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-06 2023704]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"NDSTray.exe"="NDSTray.exe" [BU]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-29 4911104]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-11-20 1826816]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2009-5-2 303104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{8D000837-4B57-427E-85A1-EFA536B49223}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9302A047-5702-4B8A-812A-6B72CDCC0D97}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B5C21128-2542-4624-BE9C-D52CF57A99F1}"= UDP:c:\users\julie and paul\Desktop\LimeWire\LimeWire.exe:LimeWire
"{384D8EA8-AC70-4750-95DA-BB797544C09D}"= TCP:c:\users\julie and paul\Desktop\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{A16ECB6A-C860-4D93-9619-4BB1259CD9BE}c:\\users\\julie and paul\\desktop\\limewire\\limewire.exe"= UDP:c:\users\julie and paul\desktop\limewire\limewire.exe:limewire.exe
"UDP Query User{F15DEEF5-2856-4686-A97D-92F9696B109C}c:\\users\\julie and paul\\desktop\\limewire\\limewire.exe"= TCP:c:\users\julie and paul\desktop\limewire\limewire.exe:limewire.exe
"TCP Query User{012B90F0-31D5-4057-93BC-2390291EC9ED}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{B712D4C5-658D-4A74-9208-13B89494B74D}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{7856C4EE-CA26-4696-8A63-F6AAA1CD35B7}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{4FCB0A5B-B8D8-4CE1-8347-22FB00E7235F}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{4CE09ACD-8EAA-4B84-9E3A-27E163AFF34C}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{B3FF92B0-CEA1-40B8-B62D-3AE70B16A488}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9F62F2C9-9687-4D39-B75D-7E509152D9CF}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{C2964DD1-6CA9-420B-AEB7-004D4A3A5A99}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C45C1FFA-BB9A-4CD4-8E75-9EAAC0D6B4FF}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{84487188-AC63-4AF3-90E5-B45B60DCD04C}"= UDP:c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil
"{24691D6D-DF7F-4526-A473-55C32928412D}"= TCP:c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil
"{B5B25B5F-0C7A-4572-AA27-92B8A3FF8CF0}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{B7BC40FF-EB5A-492F-939B-DC32057F6F0F}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{4A61E380-2A4A-4480-9F4B-4F4D4672340C}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"TCP Query User{67756042-A4DF-4F90-AAFB-4EDD503AF306}c:\\windows\\system32\\nagasoft\\ffvjplayer.exe"= UDP:c:\windows\system32\nagasoft\ffvjplayer.exe:FFVJPlayer Module
"UDP Query User{7AA6F731-79CE-4058-9F3F-33857C2D9B69}c:\\windows\\system32\\nagasoft\\ffvjplayer.exe"= TCP:c:\windows\system32\nagasoft\ffvjplayer.exe:FFVJPlayer Module

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [08/10/2009 20:51 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [10/05/2009 11:07 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [10/05/2009 11:07 108552]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [02/05/2008 21:59 20352]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/08/2009 09:54 297752]
R2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [25/12/2007 14:07 40960]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [03/07/2009 15:49 1028432]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [03/12/2007 17:03 126976]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [26/02/2008 12:06 7168]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [23/03/2009 18:04 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08 533360]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\Jumpstart\jswpsapi.exe [02/05/2008 21:59 937984]
S3 usb2vcom;USB Data Cable;c:\windows\System32\drivers\usb2vcom.sys [29/12/2008 14:35 28704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
vvdsvc REG_MULTI_SZ vvdsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-10-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 19:51]

2009-10-11 c:\windows\Tasks\User_Feed_Synchronization-{7256BC4D-33B4-4CAC-99D9-E32E6BA70918}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\julie and paul\AppData\Roaming\Mozilla\Firefox\Profiles\q099s4hr.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-12 18:46
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-10-12 18:50
ComboFix-quarantined-files.txt 2009-10-12 17:50
ComboFix2.txt 2009-10-12 17:01

Pre-Run: 1,728,602,112 bytes free
Post-Run: 1,622,728,704 bytes free

237 --- E O F --- 2009-10-12 14:27

pip.1 · 10-12-2009, 05:15 PM

Its still here,cant delete it well i cant find it.
C:\Users\julie and paul\Documents\LimeWire

Ried · 10-12-2009, 07:36 PM

Hi pip.1,

Please follow the instructions here to ensure hidden files and folders are viewable.

On your keyboard, press the Windows Logo key and the letter E to open Windows Explorer. Navigate to, and delete the following folders (right click and select 'delete'):

c:\users\julie and paul\AppData\Roaming\LimeWire
C:\Users\julie and paul\Documents\LimeWire

Let me know if you were successful.

pip.1 · 10-13-2009, 01:11 PM

Thanks
i found the first one and deleted but couldnt find the Douments/Limewire,its possible i deleted that yesterdaywhen i deleted Limewire,uninstall wouldnt work so i went in and deleted the files individualy.Should i run spybot to check?

pip.1 · 10-13-2009, 01:14 PM

Should i delete the appdata file which did contain the Limewire folder?

pip.1 · 10-13-2009, 02:16 PM

Ran spybot, and theres still a problem

--- Search result list ---
Win32.Agent.fbx: [SBI $86BD92BA] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fnmtt

--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-09-27 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-09-07 advcheck.dll (1.6.4.18)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2008-10-22 Tools.dll (2.1.6.8)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-05-19 Includes\Adware.sbi (*)
2009-10-06 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-08-10 Includes\Dialer.sbi (*)
2009-10-06 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-05-26 Includes\Hijackers.sbi (*)
2009-10-06 Includes\HijackersC.sbi (*)
2009-09-29 Includes\Keyloggers.sbi (*)
2009-10-06 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-10-06 Includes\Malware.sbi (*)
2009-10-06 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-10-06 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-10-06 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-10-06 Includes\SpywareC.sbi (*)
2009-06-08 Includes\Tracks.uti
2009-10-06 Includes\Trojans.sbi (*)
2009-10-06 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

--- System information ---
Windows Vista (Build: 6001) Service Pack 1 (6.0.6001)

--- Startup entries list ---
Located: HK_LM:Run, 00TCrdMain
command: %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
file: C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
size: 712704
MD5: E9E5692F51D6032A1105C7BE27FC0BAE

Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
size: 40048
MD5: 66D4456C920E21BD2188F8CC33680DF5

Located: HK_LM:Run, AVG8_TRAY
command: C:\PROGRA~1\AVG\AVG8\avgtray.exe
file: C:\PROGRA~1\AVG\AVG8\avgtray.exe
size: 2023704
MD5: B87AE4DF2BCF791F3BBFF77AEDD2B88E

Located: HK_LM:Run, Camera Assistant Software
command: "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
file: C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
size: 413696
MD5: 137962BA4B4B60A0E5F12D6C9DFA4C2F

Located: HK_LM:Run, Desktop SMS
command: C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
file: C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
size: 1507328
MD5: 5F5764E4046019031C7445541D728721

Located: HK_LM:Run, GrooveMonitor
command: "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
file: C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
size: 31072
MD5: 644795F6985C740F5E36E9336B837D0B

Located: HK_LM:Run, HotKeysCmds
command: C:\Windows\system32\hkcmd.exe
file: C:\Windows\system32\hkcmd.exe
size: 154136
MD5: A13F4ABCD303F04A805155F6049D1CB2

Located: HK_LM:Run, HSON
command: %ProgramFiles%\TOSHIBA\TBS\HSON.exe
file: C:\Program Files\TOSHIBA\TBS\HSON.exe
size: 54608
MD5: 5F0D3BD87EA98332B5B1D5B86C40FBF9

Located: HK_LM:Run, IgfxTray
command: C:\Windows\system32\igfxtray.exe
file: C:\Windows\system32\igfxtray.exe
size: 141848
MD5: 1FE2E92576ED4BC83FFA4FDB2831C3B2

Located: HK_LM:Run, NDSTray.exe
command: NDSTray.exe
file: NDSTray.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_LM:Run, Persistence
command: C:\Windows\system32\igfxpers.exe
file: C:\Windows\system32\igfxpers.exe
size: 129560
MD5: 4F535C9ECC352167B2F5B26D38A247BD

Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
file: C:\Program Files\QuickTime\QTTask.exe
size: 413696
MD5: FABAD2BFD44661D8CC627E5485BFAFAF

Located: HK_LM:Run, RtHDVCpl
command: RtHDVCpl.exe
file: C:\Windows\RtHDVCpl.exe
size: 4911104
MD5: 99C1D6B7C36C891EC099AA8D120185C4

Located: HK_LM:Run, Skytel
command: Skytel.exe
file: C:\Windows\Skytel.exe
size: 1826816
MD5: C8612E58FB7FCFA5EEA4E39F7B8CBC17

Located: HK_LM:Run, SmoothView
command: %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
file: C:\Program Files\Toshiba\SmoothView\SmoothView.exe
size: 509816
MD5: B50D6E98F87616444B7E3F8D190A5F09

Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre6\bin\jusched.exe"
file: C:\Program Files\Java\jre6\bin\jusched.exe
size: 136600
MD5: B98FFA8288EFAABC436C30D198608345

Located: HK_LM:Run, SynTPEnh
command: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
file: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
size: 1029416
MD5: 98888488D0E6DB0256E5E661BCD35EB6

Located: HK_LM:Run, TkBellExe
command: "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
file: C:\Program Files\Common Files\Real\Update_OB\realsched.exe
size: 185896
MD5: 89D583FC41D48328128A974C25AFAEB7

Located: HK_LM:Run, topi
command: C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
file: C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe
size: 581632
MD5: E1FAAF7915BC07352CCF1DFF37058414

Located: HK_LM:Run, Toshiba Registration
command: C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
file: C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
size: 571024
MD5: F057B753CDA136B58C04FC9F540FF24E

Located: HK_LM:Run, TPwrMain
command: %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
file: C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE
size: 431456
MD5: B0674AE101707D21F9E30484D6465704

Located: HK_LM:Run, Windows Defender
command: %ProgramFiles%\Windows Defender\MSASCui.exe -hide
file: C:\Program Files\Windows Defender\MSASCui.exe
size: 1008184
MD5: 0D392EDE3B97E0B3131B2F63EF1DB94E

Located: HK_CU:Run, Picasa Media Detector
where: .DEFAULT...
command: C:\Program Files\Picasa2\PicasaMediaDetector.exe
file: C:\Program Files\Picasa2\PicasaMediaDetector.exe
size: 443968
MD5: 03463803AE9386EB095FFFD8DD26B85B

Located: HK_CU:Run, AdobeUpdater
where: S-1-5-21-1898029673-3949625260-1174708737-1000...
command: C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
file: C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
size: 2321600
MD5: CEBB4703FE0A875947E5F0A3A95FE577

Located: HK_CU:Run, ehTray.exe
where: S-1-5-21-1898029673-3949625260-1174708737-1000...
command: C:\Windows\ehome\ehTray.exe
file: C:\Windows\ehome\ehTray.exe
size: 125952
MD5: BF08674925F151BD4537B89A493E3E0C

Located: HK_CU:Run, Sidebar
where: S-1-5-21-1898029673-3949625260-1174708737-1000...
command: C:\Program Files\Windows Sidebar\sidebar.exe
file: C:\Program Files\Windows Sidebar\sidebar.exe
size: 1233920
MD5: FD278E51A7D6F52D22FCE6C67E037AD6

Located: HK_CU:Run, SpybotSD TeaTimer
where: S-1-5-21-1898029673-3949625260-1174708737-1000...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2260480
MD5: 390679F7A217A5E73D756276C40AE887

Located: HK_CU:Run, WMPNSCFG
where: S-1-5-21-1898029673-3949625260-1174708737-1000...
command: C:\Program Files\Windows Media Player\WMPNSCFG.exe
file: C:\Program Files\Windows Media Player\WMPNSCFG.exe
size: 202240
MD5: 35937EAD711207544E219C2A19A78A7D

Located: HK_CU:Run, Picasa Media Detector
where: S-1-5-18...
command: C:\Program Files\Picasa2\PicasaMediaDetector.exe
file: C:\Program Files\Picasa2\PicasaMediaDetector.exe
size: 443968
MD5: 03463803AE9386EB095FFFD8DD26B85B

Located: Startup (common), Exif Launcher S.lnk
where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Program Files\FinePixViewerS\QuickDCF2.exe
file: C:\Program Files\FinePixViewerS\QuickDCF2.exe
size: 303104
MD5: EE7B9D446C9C49228008CB39204C5CAA

Located: WinLogon, igfxcui
command: igfxdev.dll
file: igfxdev.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

--- Browser helper object list ---
{3049C3E9-B461-4BC5-8870-4C09146192CA} (RealPlayer Download and Record Plugin for Internet Explorer)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: RealPlayer Download and Record Plugin for Internet Explorer
Path: C:\Program Files\Real\RealPlayer\
Long name: rpbrowserrecordplugin.dll
Short name: RPBROW~1.DLL
Date (created): 14/06/2008 12:35:00
Date (last access): 14/06/2008 12:35:00
Date (last write): 14/06/2008 12:35:00
Filesize: 308856
Attributes: archive
MD5: 33440A3EF90AF7ED74EE55CA634A9CFA
CRC32: B00E58A9
Version: 1.0.1.57

{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (WormRadar.com IESiteBlocker.NavFilter)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: WormRadar.com IESiteBlocker.NavFilter
CLSID name: AVG Safe Search
Path: C:\Program Files\AVG\AVG8\
Long name: avgssie.dll
Short name:
Date (created): 27/08/2009 09:55:00
Date (last access): 27/08/2009 09:55:00
Date (last write): 27/08/2009 09:55:00
Filesize: 1111320
Attributes: archive
MD5: 726F21F6723ECEBA37DCF325E1A5FFEC
CRC32: 170FF9EA
Version: 8.5.0.405

{5C255C8A-E604-49b4-9D64-90988571CECB} ()
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name:

{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} (Search Helper)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: Search Helper
CLSID name: Search Helper
Path: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\
Long name: SEPsearchhelperie.dll
Short name: SEPSEA~1.DLL
Date (created): 19/05/2009 11:36:18
Date (last access): 29/05/2009 08:19:54
Date (last write): 19/05/2009 11:36:18
Filesize: 137600
Attributes: archive
MD5: F655CDD5506FBB4C40C08C9C6A66F7C8
CRC32: 579241EB
Version: 1.3.59.0

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} (Groove GFS Browser Helper)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Groove GFS Browser Helper
Path: C:\Program Files\Microsoft Office\Office12\
Long name: GrooveShellExtensions.dll
Short name: GRA8E1~1.DLL
Date (created): 12/02/2009 15:19:32
Date (last access): 19/06/2009 16:11:58
Date (last write): 12/02/2009 15:19:32
Filesize: 2217848
Attributes: archive
MD5: A6B5A41C0ED007AB6C43CAD899E533D8
CRC32: BA078F79
Version: 12.0.6421.1000

{9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Windows Live Sign-in Helper
Path: C:\Program Files\Common Files\Microsoft Shared\Windows Live\
Long name: WindowsLiveLogin.dll
Short name: WINDOW~1.DLL
Date (created): 22/01/2009 16:41:30
Date (last access): 23/03/2009 17:58:18
Date (last write): 22/01/2009 16:41:30
Filesize: 408448
Attributes: archive
MD5: B7899C3E21B299D7A3C0DA96CAE340BD
CRC32: 288935F8
Version: 5.0.818.5

{A3BC75A2-1F87-4686-AA43-5347D756017C} (AVG Security Toolbar BHO)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: AVG Security Toolbar BHO
Path: C:\Program Files\AVG\AVG8\Toolbar\
Long name: IEToolbar.dll
Short name: IETOOL~1.DLL
Date (created): 12/06/2009 10:30:34
Date (last access): 08/10/2009 17:47:40
Date (last write): 02/09/2009 11:58:12
Filesize: 1107200
Attributes: archive
MD5: 9850F9BEF3A1B5A2A2FFD6D8F60D016A
CRC32: 559464B8
Version: 2.609.2.3

{DBC80044-A445-435b-BC74-9C25C1C588A9} (Java(tm) Plug-In 2 SSV Helper)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Java(tm) Plug-In 2 SSV Helper
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2ssv.dll
Short name:
Date (created): 20/12/2008 10:39:18
Date (last access): 20/12/2008 10:39:18
Date (last write): 20/12/2008 10:39:18
Filesize: 34816
Attributes: archive
MD5: 5D57FD3DF32DC69CEC3D1D54B4C43162
CRC32: D7C13FB2
Version: 6.0.110.3

{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (Windows Live Toolbar Helper)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Windows Live Toolbar Helper
Path: C:\Program Files\Windows Live\Toolbar\
Long name: wltcore.dll
Short name:
Date (created): 06/02/2009 19:17:46
Date (last access): 23/03/2009 18:04:20
Date (last write): 06/02/2009 19:17:46
Filesize: 1068904
Attributes: archive
MD5: 28455424E3C8B81661C5A40E18066BB1
CRC32: E5BA354B
Version: 14.0.8064.206

--- ActiveX list ---
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_11
Installer:
Codebase: http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2iexp.dll
Short name:
Date (created): 20/12/2008 10:39:18
Date (last access): 20/12/2008 10:39:18
Date (last write): 20/12/2008 10:39:18
Filesize: 94208
Attributes: archive
MD5: 3DA696FCE470365F830726A5DB33733F
CRC32: F0FC81C2
Version: 6.0.110.3

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_11
Installer:
Codebase: http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
description:
classification: Legitimate
known filename: npjpi150_06.dll
info link:
info source: Safer Networking Ltd.
Path: C:\Program Files\Java\jre6\bin\
Long name: npjpi160_11.dll
Short name: NPJPI1~1.DLL
Date (created): 20/12/2008 10:39:20
Date (last access): 20/12/2008 10:39:20
Date (last write): 20/12/2008 10:39:20
Filesize: 132504
Attributes: archive
MD5: D400116F6776ACB6EDB6B1F5EEB9F92D
CRC32: CECB5751
Version: 6.0.110.3

--- Process list ---
PID: 1740 (1096) C:\Windows\system32\Dwm.exe
size: 81920
MD5: 59903071D7ACE6A02093C47E9E38AF97
PID: 1772 (1724) C:\Windows\Explorer.EXE
size: 2927104
MD5: 4F554999D7D5F05DAAEBBA7B5BA1089D
PID: 1912 (1116) C:\Windows\system32\taskeng.exe
size: 169472
MD5: 5F109032CE46B7184ED9E50F9FE8489E
PID: 1508 (1772) C:\Program Files\Windows Defender\MSASCui.exe
size: 1008184
MD5: 0D392EDE3B97E0B3131B2F63EF1DB94E
PID: 1488 (1772) C:\Program Files\Java\jre6\bin\jusched.exe
size: 136600
MD5: B98FFA8288EFAABC436C30D198608345
PID: 1696 (1772) C:\Windows\System32\igfxtray.exe
size: 141848
MD5: 1FE2E92576ED4BC83FFA4FDB2831C3B2
PID: 1588 (1772) C:\Windows\System32\hkcmd.exe
size: 154136
MD5: A13F4ABCD303F04A805155F6049D1CB2
PID: 1700 (1772) C:\Windows\System32\igfxpers.exe
size: 129560
MD5: 4F535C9ECC352167B2F5B26D38A247BD
PID: 1760 (1772) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
size: 1029416
MD5: 98888488D0E6DB0256E5E661BCD35EB6
PID: 924 (1772) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
size: 1056768
MD5: DBC3E8226BE6FE67FAE94025C80FE907
PID: 1992 (1772) C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
size: 1507328
MD5: 5F5764E4046019031C7445541D728721
PID: 1332 (1772) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
size: 413696
MD5: 137962BA4B4B60A0E5F12D6C9DFA4C2F
PID: 1968 (1772) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
size: 431456
MD5: B0674AE101707D21F9E30484D6465704
PID: 1148 (1772) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
size: 509816
MD5: B50D6E98F87616444B7E3F8D190A5F09
PID: 1068 (1772) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
size: 712704
MD5: E9E5692F51D6032A1105C7BE27FC0BAE
PID: 1140 (1772) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
size: 31072
MD5: 644795F6985C740F5E36E9336B837D0B
PID: 300 (1772) C:\Windows\RtHDVCpl.exe
size: 4911104
MD5: 99C1D6B7C36C891EC099AA8D120185C4
PID: 2072 (1772) C:\Program Files\AVG\AVG8\avgtray.exe
size: 2023704
MD5: B87AE4DF2BCF791F3BBFF77AEDD2B88E
PID: 2124 (1772) C:\Windows\ehome\ehtray.exe
size: 125952
MD5: BF08674925F151BD4537B89A493E3E0C
PID: 2208 (1772) C:\Program Files\Windows Sidebar\sidebar.exe
size: 1233920
MD5: FD278E51A7D6F52D22FCE6C67E037AD6
PID: 2256 ( 840) C:\Windows\ehome\ehmsas.exe
size: 37376
MD5: 0F4195B9B348DE5CF9B822F81704B20E
PID: 2264 (1772) C:\Program Files\Windows Media Player\wmpnscfg.exe
size: 202240
MD5: 35937EAD711207544E219C2A19A78A7D
PID: 2300 (1772) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2260480
MD5: 390679F7A217A5E73D756276C40AE887
PID: 2312 (1772) C:\Program Files\FinePixViewerS\QuickDCF2.exe
size: 303104
MD5: EE7B9D446C9C49228008CB39204C5CAA
PID: 2528 (1332) C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
size: 4624384
MD5: DD84FD291B2C324B8E6D6EF6B8643A69
PID: 4092 ( 840) C:\Windows\system32\igfxsrvc.exe
size: 252440
MD5: DF14865FD7961D9D4FA5A2A3C2F33560
PID: 1400 (1772) C:\Program Files\Mozilla Firefox\firefox.exe
size: 307704
MD5: 50E09E2DD72BE894F440506D846D8384
PID: 1352 ( 924) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
size: 405504
MD5: F064D3DA9BCEC02D9782D39446603DCA
PID: 2656 ( 840) C:\Program Files\Windows Mail\WinMail.exe
size: 397312
MD5: 7E6EA9CB72B5DE84A5D700BED877E5F9
PID: 2832 ( 840) C:\Windows\System32\mobsync.exe
size: 95744
MD5: 9B89B3BB79EA1ACF041F40A7B6FC5827
PID: 5592 (1648) C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
size: 520024
MD5: 27C529793ACDFCC3E510346CC36A7C4D
PID: 4348 (2300) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 5365592
MD5: 0477C2F9171599CA5BC3307FDFBA8D89
PID: 0 ( 0) [System Process]
PID: 4 ( 0) System
PID: 468 ( 4) smss.exe
size: 64000
PID: 544 ( 532) csrss.exe
size: 6144
PID: 588 ( 532) wininit.exe
size: 96768
PID: 600 ( 580) csrss.exe
size: 6144
PID: 632 ( 588) services.exe
size: 279040
PID: 644 ( 588) lsass.exe
size: 9728
PID: 652 ( 588) lsm.exe
size: 229888
PID: 724 ( 580) winlogon.exe
size: 314880
PID: 840 ( 632) svchost.exe
size: 21504
PID: 884 ( 632) PresentationFontCache.exe
PID: 928 ( 632) svchost.exe
size: 21504
PID: 968 ( 632) svchost.exe
size: 21504
PID: 1060 ( 632) svchost.exe
size: 21504
PID: 1096 ( 632) svchost.exe
size: 21504
PID: 1116 ( 632) svchost.exe
size: 21504
PID: 1240 (1060) audiodg.exe
size: 88064
PID: 1264 ( 632) svchost.exe
size: 21504
PID: 1280 ( 632) SLsvc.exe
size: 2623488
PID: 1304 ( 632) svchost.exe
size: 21504
PID: 1472 ( 632) svchost.exe
size: 21504
PID: 1648 ( 632) AAWService.exe
PID: 1884 ( 632) spoolsv.exe
size: 125952
PID: 1952 ( 632) svchost.exe
size: 21504
PID: 2464 ( 632) AppleMobileDeviceService.exe
PID: 2488 ( 632) avgwdsvc.exe
PID: 2500 ( 632) mDNSResponder.exe
PID: 2512 ( 632) CFSvcs.exe
PID: 2668 ( 632) svchost.exe
size: 21504
PID: 2744 ( 632) SeaPort.exe
PID: 2792 ( 632) svchost.exe
size: 21504
PID: 2900 ( 632) TNaviSrv.exe
PID: 2980 ( 632) TODDSrv.exe
size: 129632
PID: 3008 (2488) avgrsx.exe
PID: 3072 ( 632) TosCoSrv.exe
PID: 3116 ( 632) TosIPCSrv.exe
PID: 3136 ( 632) ULCDRSvr.exe
PID: 3280 ( 632) svchost.exe
size: 21504
PID: 3308 ( 632) SearchIndexer.exe
size: 439808
PID: 3476 ( 632) XAudio.exe
PID: 3816 ( 840) unsecapp.exe
PID: 3944 ( 632) wmpnetwk.exe
PID: 3952 ( 840) WmiPrvSE.exe
PID: 1656 (1116) taskeng.exe
size: 169472
PID: 3968 (1760) SynTPHelper.exe
PID: 4772 (2488) avgnsx.exe
PID: 5724 (3308) SearchProtocolHost.exe
size: 184832
PID: 1980 (3308) SearchFilterHost.exe
size: 87552

--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 13/10/2009 21:12:36

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\Windows\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://go.microsoft.com/fwlink/?LinkId=69157
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
http://www.google.com/keyword/%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
C:\Windows\System32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://go.microsoft.com/fwlink/?LinkId=54896
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://go.microsoft.com/fwlink/?LinkId=69157
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://go.microsoft.com/fwlink/?LinkId=69157
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://go.microsoft.com/fwlink/?LinkId=54896
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

--- Winsock Layered Service Provider list ---
Namespace Provider 1: E-mail Naming Shim Provider
GUID: {964ACBA2-B2BC-40EB-8C6A-A6DB40161CAE}
Filename:

Namespace Provider 2: PNRP Cloud Namespace Provider
GUID: {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D}
Filename:

Namespace Provider 3: PNRP Name Namespace Provider
GUID: {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D}
Filename:

-
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Synaptics TouchPad Driver
Image path: system32\DRIVERS\SynTP.sys
Image size: 196400
Image MD5: 55F6E55CC2430CA8713387106FA79817
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): SysMain
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\sysmain.dll,-1000
Description: @%SystemRoot%\system32\sysmain.dll,-1001
Object name: LocalSystem
Image path: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 0
Depends On services: rpcss,fileinfo

Service (registry key): TabletInputService
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\TabSvc.dll,-100
Description: @%SystemRoot%\system32\TabSvc.dll,-101
Object name: LocalSystem
Image path: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: PlugPlay,RpcSs

Service (registry key): TapiSrv
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\tapisrv.dll,-10100
Description: @%SystemRoot%\system32\tapisrv.dll,-10101
Object name: NT AUTHORITY\NetworkService
Image path: %SystemRoot%\System32\svchost.exe -k NetworkService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: PlugPlay,RpcSs

Service (registry key): TBS
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\tbssvc.dll,-100
Description: @%SystemRoot%\system32\tbssvc.dll,-101
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\System32\svchost.exe -k LocalService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1

Service (registry key): Tcpip
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\tcpipcfg.dll,-50003
Description: @%SystemRoot%\system32\tcpipcfg.dll,-50003
Image path: System32\drivers\tcpip.sys
Image size: 897608
Image MD5: 8A7AD2A214233F684242F289ED83EBC3
Control Set: CurrentControlSet
Start: 1
Type: 1
Error Control: 1

Service (registry key): Tcpip6
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft IPv6 Protocol Driver
Description: Microsoft IPv6 Protocol Driver
Image path: system32\DRIVERS\tcpip.sys
Image size: 897608
Image MD5: 8A7AD2A214233F684242F289ED83EBC3
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1
Depends On services: Tcpip

Service (registry key): tcpipreg
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TCP/IP Registry Compatibility
Description: Provides compatibility for legacy applications which interact with TCP/IP through the registry. If this service is stopped, certain applications may have impaired functionality.
Image path: System32\drivers\tcpipreg.sys
Image size: 30208
Image MD5: D4A2E4A4B011F3A883AF77315A5AE76B
Control Set: CurrentControlSet
Start: 2
Type: 1
Error Control: 1
Depends On services: tcpip

Service (registry key): tdcmdpst
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TOSHIBA Writing Engine Filter Driver
Image path: system32\DRIVERS\tdcmdpst.sys
Image size: 16128
Image MD5: 1825BCEB47BF41C5A9F0E44DE82FC27A
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 0

Service (registry key): TDPIPE
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TDPIPE
Image path: system32\drivers\tdpipe.sys
Image size: 17920
Image MD5: 5DCF5E267BE67A1AE926F2DF77FBCC56
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): TDTCP
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TDTCP
Image path: system32\drivers\tdtcp.sys
Image size: 29184
Image MD5: 389C63E32B3CEFED425B61ED92D3F021
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): tdx
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\tcpipcfg.dll,-50004
Description: @%SystemRoot%\system32\tcpipcfg.dll,-50004
Image path: system32\DRIVERS\tdx.sys
Image size: 71680
Image MD5: D09276B1FAB033CE1D40DCBDF303D10F
Control Set: CurrentControlSet
Start: 1
Type: 1
Error Control: 1
Depends On services: Tcpip

Service (registry key): TermDD
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Terminal Device Driver
Image path: system32\DRIVERS\termdd.sys
Image size: 54328
Image MD5: A048056F5E1A96A9BF3071B91741A5AA
Control Set: CurrentControlSet
Start: 1
Type: 1
Error Control: 1

Service (registry key): TermService
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\System32\termsrv.dll,-268
Description: @%SystemRoot%\System32\termsrv.dll,-267
Object name: NT Authority\NetworkService
Image path: %SystemRoot%\System32\svchost.exe -k NetworkService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: RPCSS,TermDD

Service (registry key): Themes
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\System32\shsvcs.dll,-8192
Description: @%SystemRoot%\System32\shsvcs.dll,-8193
Object name: LocalSystem
Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1

Service (registry key): THREADORDER
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\mmcss.dll,-102
Description: @%systemroot%\system32\mmcss.dll,-103
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\system32\svchost.exe -k LocalService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1

Service (registry key): TNaviSrv
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TOSHIBA Navi Support Service
Object name: LocalSystem
Image path: C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
Image size: 83312
Image MD5: E47F35A87FF0DA38DEF37A0EB0C2D2DF
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1

Service (registry key): TODDSrv
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TOSHIBA Optical Disc Drive Service
Object name: LocalSystem
Image path: C:\Windows\system32\TODDSrv.exe
Image size: 129632
Image MD5: C5AC715B65B01788ABC22D10749DDDD8
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1

Service (registry key): TosCoSrv
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TOSHIBA Power Saver
Description: @%ProgramFiles%\Toshiba\Power Saver\TPwrFunc.dll,-202
Object name: LocalSystem
Image path: "c:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe"
Image size: 431456
Image MD5: DA6903958CBDC091FFCBBCA70CCFF34C
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1
Depends On services: RPCSS

Service (registry key): TOSHIBA SMART Log Service
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TOSHIBA SMART Log Service
Object name: LocalSystem
Image path: "c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe"
Image size: 126976
Image MD5: 22690DFFC7F2A18279A7A0489AA02BAC
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1

Service (registry key): tos_sps32
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TOSHIBA tos_sps32 Service
Image path: system32\DRIVERS\tos_sps32.sys
Image size: 285184
Image MD5: 1EA5F27C29405BF49799FECA77186DA9
Control Set: CurrentControlSet
Start: 0
Type: 1
Error Control: 1

Service (registry key): TrkWks
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\trkwks.dll,-1
Description: @%SystemRoot%\system32\trkwks.dll,-2
Object name: LocalSystem
Image path: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: RpcSs

Service (registry key): TrustedInstaller
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\servicing\TrustedInstaller.exe,-100
Description: @%SystemRoot%\servicing\TrustedInstaller.exe,-101
Object name: localSystem
Image path: %SystemRoot%\servicing\TrustedInstaller.exe
Image size: 39424
Image MD5: 16613A1BAD034D4ECF957AF18B7C2FF5
Control Set: CurrentControlSet
Start: 3
Type: 16
Error Control: 1

Service (registry key): TSDDD
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): tssecsrv
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Terminal Services Security Filter Driver
Description: Terminal Services Security Filter Driver
Image path: System32\DRIVERS\tssecsrv.sys
Image size: 23552
Image MD5: DCF0F056A2E4F52287264F5AB29CF206
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 0

Service (registry key): tunmp
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft Tun Miniport Adapter Driver
Image path: system32\DRIVERS\tunmp.sys
Image size: 15360
Image MD5: CAECC0120AC49E3D2F758B9169872D38
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): tunnel
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft IPv6 Tunnel Miniport Adapter Driver
Image path: system32\DRIVERS\tunnel.sys
Image size: 23040
Image MD5: 119B8184E106BAEDC83FCE5DDF3950DA
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): TVALZ
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver
Image path: system32\DRIVERS\TVALZ_O.SYS
Image size: 23640
Image MD5: 792A8B80F8188ABA4B2BE271583F3E46
Control Set: CurrentControlSet
Start: 0
Type: 1
Error Control: 1

Service (registry key): uagp35
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft AGPv3.5 Filter
Image path: \SystemRoot\system32\drivers\uagp35.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): udfs
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: udfs
Description: Reads/Writes UDF 1.02,1.5,2.0x,2.5 disc formats, usually found on C/DVD discs. (Core) (All pieces)
Image path: system32\DRIVERS\udfs.sys
Image size: 226816
Image MD5: 8B5088058FA1D1CD897A2113CCFF6C58
Control Set: CurrentControlSet
Start: 4
Type: 2
Error Control: 1

Service (registry key): UGatherer
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): UGTHRSVC
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): UI0Detect
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\ui0detect.exe,-101
Description: @%SystemRoot%\system32\ui0detect.exe,-102
Object name: LocalSystem
Image path: %SystemRoot%\system32\UI0Detect.exe
Image size: 35840
Image MD5: ECEF404F62863755951E09C802C94AD5
Control Set: CurrentControlSet
Start: 3
Type: 272
Error Control: 1

Service (registry key): UleadBurningHelper
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Ulead Burning Helper
Object name: LocalSystem
Image path: C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Image size: 49152
Image MD5: 332D341D92B933600D41953B08360DFB
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1

Service (registry key): uliagpkx
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Uli AGP Bus Filter
Image path: \SystemRoot\system32\drivers\uliagpkx.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): uliahci
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: \SystemRoot\system32\drivers\uliahci.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): UlSata
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: \SystemRoot\system32\drivers\ulsata.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): ulsata2
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: \SystemRoot\system32\drivers\ulsata2.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): umbus
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: UMBus Enumerator Driver
Image path: system32\DRIVERS\umbus.sys
Image size: 34816
Image MD5: 32CFF9F809AE9AED85464492BF3E32D2
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): upnphost
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\upnphost.dll,-213
Description: @%systemroot%\system32\upnphost.dll,-214
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\system32\svchost.exe -k LocalService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: SSDPSRV,HTTP

Service (registry key): usb
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): usb2vcom
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: USB Data Cable
Image path: system32\DRIVERS\usb2vcom.sys
Image size: 28704
Image MD5: 4AF8FB8EE49239FC53DE832F006052CE
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): usbaudio
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: USB Audio Driver (WDM)
Image path: system32\drivers\usbaudio.sys
Image size: 73088
Image MD5: 292A25BB75A568AE2C67169BA2C6365A
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): usbccgp
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft USB Generic Parent Driver
Image path: system32\DRIVERS\usbccgp.sys
Image size: 73216
Image MD5: CAF811AE4C147FFCD5B51750C7F09142
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): usbcir
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: eHome Infrared Receiver (USBCIR)
Image path: \SystemRoot\system32\drivers\usbcir.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): usbehci
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft USB 2.0 Enhanced Host Controller Miniport Driver
Image path: system32\DRIVERS\usbehci.sys
Image size: 39424
Image MD5: CEBE90821810E76320155BEBA722FCF9
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): usbhub
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: USB2 Enabled Hub
Image path: system32\DRIVERS\usbhub.sys
Image size: 194560
Image MD5: CC6B28E4CE39951357963119CE47B143
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): usbohci
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft USB Open Host Controller Miniport Driver
Image path: \SystemRoot\system32\drivers\usbohci.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): usbprint
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft USB PRINTER Class
Image path: system32\DRIVERS\usbprint.sys
Image size: 18944
Image MD5: E75C4B5269091D15A2E7DC0B6D35F2F5
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): USBSTOR
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: USB Mass Storage Driver
Image path: system32\DRIVERS\USBSTOR.SYS
Image size: 55296
Image MD5: 87BA6B83C5D19B69160968D07D6E2982
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): usbuhci
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft USB Universal Host Controller Miniport Driver
Image path: system32\DRIVERS\usbuhci.sys
Image size: 23552
Image MD5: 814D653EFC4D48BE3B04A307ECEFF56F
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): usbvideo
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Chicony USB 2.0 Camera
Image path: System32\Drivers\usbvideo.sys
Image size: 134016
Image MD5: E67998E8F14CB0627A769F6530BCB352
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): UVCFTR
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: System32\Drivers\UVCFTR_S.SYS
Image size: 18432
Image MD5: 8C5094A8AB24DE7496C7C19942F2DF04
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): UxSms
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\dwm.exe,-2000
Description: @%SystemRoot%\system32\dwm.exe,-2001
Object name: localSystem
Image path: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1

Service (registry key): VComm
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Virtual Serial port driver
Image path: system32\DRIVERS\VComm.sys
Image size: 34448
Image MD5: 51750B0539986186C6931FC40D171521
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 0

Service (registry key): VcommMgr
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Bluetooth VComm Manager Service
Image path: System32\Drivers\VcommMgr.sys
Image size: 44304
Image MD5: 6D9C891C0A761AFED1F3609C2E56F2B9
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): vds
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\vds.exe,-100
Description: @%SystemRoot%\system32\vds.exe,-112
Object name: LocalSystem
Image path: %SystemRoot%\System32\vds.exe
Image size: 382976
Image MD5: B13BC395B9D6116628F5AF47E0802AC4
Control Set: CurrentControlSet
Start: 3
Type: 16
Error Control: 1
Depends On services: RpcSs,PlugPlay

Service (registry key): vga
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: system32\DRIVERS\vgapnp.sys
Image size: 26112
Image MD5: 87B06E1F30B749A114F74622D013F8D4
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 0

Service (registry key): VgaSave
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: \SystemRoot\System32\drivers\vga.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 1
Type: 1
Error Control: 0

Service (registry key): viaagp
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: VIA AGP Bus Filter
Image path: \SystemRoot\system32\drivers\viaagp.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): ViaC7
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: VIA C7 Processor Driver
Image path: \SystemRoot\system32\drivers\viac7.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): viaide
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: \SystemRoot\system32\drivers\viaide.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 3

Service (registry key): volmgr
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Volume Manager Driver
Image path: system32\drivers\volmgr.sys
Image size: 52792
Image MD5: 69503668AC66C77C6CD7AF86FBDF8C43
Control Set: CurrentControlSet
Start: 0
Type: 1
Error Control: 3

Service (registry key): volmgrx
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Dynamic Volume Manager
Description: Extension of the volume manager driver that manages software RAID volumes (spanned, striped, mirrored, RAID-5) on dynamic disks
Image path: System32\drivers\volmgrx.sys
Image size: 294456
Image MD5: 98F5FFE6316BD74E9E2C97206C190196
Control Set: CurrentControlSet
Start: 0
Type: 1
Error Control: 3

Service (registry key): volsnap
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Storage volumes
Image path: system32\drivers\volsnap.sys
Image size: 227896
Image MD5: D8B4A53DD2769F226B3EB374374987C9
Control Set: CurrentControlSet
Start: 0
Type: 1
Error Control: 3

Service (registry key): vsmraid
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: \SystemRoot\system32\drivers\vsmraid.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): VSS
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\vssvc.exe,-102
Description: @%systemroot%\system32\vssvc.exe,-101
Object name: LocalSystem
Image path: %systemroot%\system32\vssvc.exe
Image size: 1054720
Image MD5: D5FB73D19C46ADE183F968E13F186B23
Control Set: CurrentControlSet
Start: 3
Type: 16
Error Control: 1
Depends On services: RPCSS

Service (registry key): vvdsvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: VJVodClientServices
Object name: LocalSystem
Image path: %SystemRoot%\System32\svchost.exe -k vvdsvc
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1

Service (registry key): W32Time
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\w32time.dll,-200
Description: @%SystemRoot%\system32\w32time.dll,-201
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\system32\svchost.exe -k LocalService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1

Service (registry key): W3SVC
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): WacomPen
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Wacom Serial Pen HID Driver
Image path: \SystemRoot\system32\drivers\wacompen.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): Wanarp
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Remote Access IP ARP Driver
Description: Remote Access IP ARP Driver
Image path: system32\DRIVERS\wanarp.sys
Image size: 62464
Image MD5: 55201897378CCA7AF8B5EFD874374A26
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): Wanarpv6
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Remote Access IPv6 ARP Driver
Description: Remote Access IPv6 ARP Driver
Image path: system32\DRIVERS\wanarp.sys
Image size: 62464
Image MD5: 55201897378CCA7AF8B5EFD874374A26
Control Set: CurrentControlSet
Start: 1
Type: 1
Error Control: 1

Service (registry key): wcncsvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\wcncsvc.dll,-3
Description: @%SystemRoot%\system32\wcncsvc.dll,-4
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\System32\svchost.exe -k LocalService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: rpcss

Service (registry key): WcsPlugInService
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\WcsPlugInService.dll,-200
Description: @%SystemRoot%\system32\WcsPlugInService.dll,-201
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\system32\svchost.exe -k wcssvc
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: RpcSs

Service (registry key): Wd
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft Watchdog Timer Driver
Image path: \SystemRoot\system32\drivers\wd.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): Wdf01000
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Kernel Mode Driver Frameworks service
Image path: system32\drivers\Wdf01000.sys
Image size: 503864
Image MD5: B6F0A7AD6D4BD325FBCD8BAC96CD8D96
Control Set: CurrentControlSet
Start: 0
Type: 1
Error Control: 1

Service (registry key): WdiServiceHost
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\wdi.dll,-502
Description: @%systemroot%\system32\wdi.dll,-503
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\System32\svchost.exe -k wdisvc
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1

Service (registry key): WdiSystemHost
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\wdi.dll,-500
Description: @%systemroot%\system32\wdi.dll,-501
Object name: LocalSystem
Image path: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1

Service (registry key): WebClient
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\webclnt.dll,-100
Description: @%systemroot%\system32\webclnt.dll,-101
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\system32\svchost.exe -k LocalService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: MRxDAV

Service (registry key): Wecsvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\wecsvc.dll,-200
Description: @%SystemRoot%\system32\wecsvc.dll,-201
Object name: NT AUTHORITY\NetworkService
Image path: %SystemRoot%\system32\svchost.exe -k NetworkService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: HTTP,Eventlog,mpssvc

Service (registry key): wercplsupport
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\System32\wercplsupport.dll,-101
Description: @%SystemRoot%\System32\wercplsupport.dll,-100
Object name: localSystem
Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1

Service (registry key): WerSvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\System32\wersvc.dll,-100
Description: @%SystemRoot%\System32\wersvc.dll,-101
Object name: localSystem
Image path: %SystemRoot%\System32\svchost.exe -k WerSvcGroup
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 0

Service (registry key): winachsf
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: system32\DRIVERS\HSX_CNXT.sys
Image size: 661504
Image MD5: 0ACD399F5DB3DF1B58903CF4949AB5A8
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 0

Service (registry key): WinDefend
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103
Description: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-3068
Object name: LocalSystem
Image path: %SystemRoot%\System32\svchost.exe -k secsvcs
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: RpcSs

Service (registry key): Windows Workflow Foundation 3.0.0.0
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): WinHttpAutoProxySvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\winhttp.dll,-100
Description: @%SystemRoot%\system32\winhttp.dll,-101
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\system32\svchost.exe -k LocalService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: Dhcp

Service (registry key): Winmgmt
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%Systemroot%\system32\wbem\wmisvc.dll,-205
Description: @%Systemroot%\system32\wbem\wmisvc.dll,-204
Object name: localSystem
Image path: %systemroot%\system32\svchost.exe -k netsvcs
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 0
Depends On services: RPCSS

Service (registry key): WinRM
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%Systemroot%\system32\wsmsvc.dll,-101
Description: @%Systemroot%\system32\wsmsvc.dll,-102
Object name: NT AUTHORITY\NetworkService
Image path: %SystemRoot%\System32\svchost.exe -k NetworkService
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: RPCSS,HTTP

Service (registry key): Winsock
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 3
Type: 4
Error Control: 1

Service (registry key): WinSock2
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): Wlansvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\System32\wlansvc.dll,-257
Description: @%SystemRoot%\System32\wlansvc.dll,-258
Object name: LocalSystem
Image path: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: nativewifip,RpcSs,Ndisuio,Eaphost

Service (registry key): WmiAcpi
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Microsoft Windows Management Interface for ACPI
Image path: \SystemRoot\system32\drivers\wmiacpi.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): WmiApRpl
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): wmiApSrv
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110
Description: @%Systemroot%\system32\wbem\wmiapsrv.exe,-111
Object name: localSystem
Image path: %systemroot%\system32\wbem\WmiApSrv.exe
Image size: 137728
Image MD5: ABA4CF9F856D9A3A25F4DDD7690A6E9D
Control Set: CurrentControlSet
Start: 3
Type: 16
Error Control: 1

Service (registry key): WMPNetworkSvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101
Description: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-102
Object name: NT AUTHORITY\NetworkService
Image path: "%ProgramFiles%\Windows Media Player\wmpnetwk.exe"
Image size: 896512
Image MD5: 3978704576A121A9204F8CC49A301A9B
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1
Depends On services: UPnPHost,http

Service (registry key): WPCSvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\wpcsvc.dll,-100
Description: @%SystemRoot%\system32\wpcsvc.dll,-101
Object name: NT Authority\LocalService
Image path: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 3
Type: 32
Error Control: 1
Depends On services: RpcSs

Service (registry key): WPDBusEnum
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\wpdbusenum.dll,-100
Description: @%SystemRoot%\system32\wpdbusenum.dll,-101
Object name: LocalSystem
Image path: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: RpcSs

Service (registry key): WpdUsb
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: WpdUsb
Image path: system32\DRIVERS\wpdusb.sys
Image size: 39936
Image MD5: 0CEC23084B51B8288099EB710224E955
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): ws2ifsl
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: Winsock IFS driver
Description: Winsock IFS driver
Image path: \SystemRoot\system32\drivers\ws2ifsl.sys
Image size: 0
Image MD5: D41D8CD98F00B204E9800998ECF8427E
Control Set: CurrentControlSet
Start: 4
Type: 1
Error Control: 1

Service (registry key): wscsvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\System32\wscsvc.dll,-200
Description: @%SystemRoot%\System32\wscsvc.dll,-201
Object name: NT AUTHORITY\LocalService
Image path: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: RpcSs,winmgmt

Service (registry key): WSearch
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\SearchIndexer.exe,-103
Description: @%systemroot%\system32\SearchIndexer.exe,-104
Object name: LocalSystem
Image path: %systemroot%\system32\SearchIndexer.exe /Embedding
Image size: 439808
Image MD5: 7778BDFA3F6F6FBA0E75B9594098F737
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1
Depends On services: RPCSS

Service (registry key): WSearchIdxPi
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): wuauserv
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%systemroot%\system32\wuaueng.dll,-105
Description: @%systemroot%\system32\wuaueng.dll,-106
Object name: LocalSystem
Image path: %systemroot%\system32\svchost.exe -k netsvcs
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: rpcss

Service (registry key): WUDFRd
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: system32\DRIVERS\WUDFRd.sys
Image size: 83328
Image MD5: AC13CB789D93412106B0FB6C7EB2BCB6
Control Set: CurrentControlSet
Start: 3
Type: 1
Error Control: 1

Service (registry key): wudfsvc
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: @%SystemRoot%\system32\wudfsvc.dll,-1000
Description: @%SystemRoot%\system32\wudfsvc.dll,-1001
Object name: LocalSystem
Image path: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
Image size: 21504
Image MD5: 3794B461C45882E06856F282EEF025AF
Control Set: CurrentControlSet
Start: 2
Type: 32
Error Control: 1
Depends On services: PlugPlay

Service (registry key): XAudio
Registry path: \SYSTEM\CurrentControlSet\Services\
Image path: system32\DRIVERS\xaudio.sys
Image size: 8704
Image MD5: DAB33CFA9DD24251AAA389FF36B64D4B
Control Set: CurrentControlSet
Start: 2
Type: 1
Error Control: 0

Service (registry key): XAudioService
Registry path: \SYSTEM\CurrentControlSet\Services\
Display name: XAudioService
Description: User-mode gate for Modem Speakerphone
Object name: LocalSystem
Image path: %SystemRoot%\system32\DRIVERS\xaudio.exe
Image size: 386560
Image MD5: CD5F291A1161F15896D1A4D63DAFF5DF
Control Set: CurrentControlSet
Start: 2
Type: 16
Error Control: 1

Service (registry key): xmlprov
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): {335D2167-0C10-48FA-A954-9A55A696236C}
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): {84ABDA67-2D72-4C5D-A541-50EB0404317E}
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Service (registry key): {8D3EA1D3-5763-454F-8E26-15419D161390}
Registry path: \SYSTEM\CurrentControlSet\Services\
Control Set: CurrentControlSet
Start: 0
Type: 0
Error Control: 0

Ried · 10-13-2009, 04:00 PM

Quote:

Should i delete the appdata file which did contain the Limewire folder?

If Limewire is the only folder in that AppData folder, then yes, you would be safe to delete the AppData folder. Do not delete it if it contains other folders.

==================================

The entry Spybot is reporting is a harmless remnant of the LivePlayer uninstall. Open notepad and copy/paste the entire text in the quote box below: (don't forget to copy and paste REGEDIT4)

Quote:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fnmtt]

Save the file as "delete.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Right click on the delete.reg file and Run as Administrator. Click Yes to merge/add it to the registry. You may delete the file afterwards.

--------------------------------------------------------------------

How is the system behaving for you now?

pip.1 · 10-13-2009, 04:35 PM

Thanks
Have done that ,added no problem.
Do i need to do anything else?
Everything seems fine.

Ried · 10-13-2009, 09:20 PM

All that needs done now is to tidy up. Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links:

The following procedure will implement some cleanup procedures. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK:

ComboFix /u

--------------------------------------------------------------------

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

Green to go
Yellow for caution
Red to stop

WOT has an addon available for both Firefox and IE.

SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page.

- Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

- Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released.

- Most importantly, Think Prevention

-----------------------------------------------------

**Kindly respond one more time and let me know if we may consider this thread resolved.

pip.1 · 10-14-2009, 04:53 PM

Ried
THANKYOU
Thread close.

Ried · 10-14-2009, 08:41 PM

You're welcome, pip.1. Take care.

10-07-2009, 10:47 AM	#2 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Bump!

10-08-2009, 01:31 PM	#3 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Bump!

10-10-2009, 07:49 AM	#4 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,853 OS: WinXP and Vista	Re: PC running slow Laptop spybot detects Trojan but cant remove Hello pip.1, Your title says Spybot is detecting a trojan. Could you provide more detail please? What is the name of the trojan and where is it finding it? __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

10-10-2009, 02:46 PM	#5 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Hope this helps. Spybot -win 32 agent Trojanfbx. Also 12 pupsc dont know what they are . Spybot cant remove them . --- Search result list --- Live-Player: [SBI $EE6E3A99] Settings (Registry key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Live-Player Live-Player: [SBI $3EEA5E92] Uninstall settings (Registry key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player Live-Player: [SBI $3EEA5E92] Uninstall settings (Registry key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player Live-Player: [SBI $D0CE2ACA] Program directory (Directory, nothing done) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\ Live-Player: [SBI $CF0BC1B5] Link (File, nothing done) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Privacy Policy.url Properties.size=64 Properties.md5=B879C3BAEB64DAC6E1FF20E64D9B48B6 Properties.filedate=1253736701 Properties.filedatetext=2009-09-23 21:11:41 Live-Player: [SBI $CF0BC1B5] Link (File, nothing done) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Terms and Conditions.url Properties.size=62 Properties.md5=EB653E4A619A53A2AFE2F4E2694B0FA4 Properties.filedate=1253736701 Properties.filedatetext=2009-09-23 21:11:41 Live-Player: [SBI $CF0BC1B5] Link (File, nothing done) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Website.url Properties.size=53 Properties.md5=D252DA6353F7ED1AD3B6BDB62B2C3FB3 Properties.filedate=1253736701 Properties.filedatetext=2009-09-23 21:11:41 Live-Player: [SBI $C082D99B] Link (File, nothing done) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Live-Player.lnk Properties.size=639 Properties.md5=36261844D09EA9E37AE86352C2B5840E Properties.filedate=1253736701 Properties.filedatetext=2009-09-23 21:11:41 Live-Player: [SBI $C082D99B] Link (File, nothing done) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player\Uninstall.lnk Properties.size=615 Properties.md5=F691C31C7EFDD62F9FC36CA76DE6CD4E Properties.filedate=1253736701 Properties.filedatetext=2009-09-23 21:11:41 Live-Player: [SBI $41D1D194] Program directory (Directory, nothing done) C:\Program Files\Live-Player\ Live-Player: [SBI $3D1B7FA6] Program directory (Directory, nothing done) C:\Program Files\Live-Player\data\ Live-Player: [SBI $66063D23] Program directory (Directory, nothing done) C:\Program Files\Live-Player\skins\ Win32.Agent.fbx: [SBI $86BD92BA] Settings (Registry key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fnmtt --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) --- 2009-01-26 blindman.exe (1.0.0.8) 2009-01-26 SDFiles.exe (1.6.1.7) 2009-01-26 SDMain.exe (1.0.0.6) 2009-01-26 SDShred.exe (1.0.2.5) 2009-01-26 SDUpdate.exe (1.6.0.12) 2009-01-26 SDWinSec.exe (1.0.0.12) 2009-01-26 SpybotSD.exe (1.6.2.46) 2009-03-05 TeaTimer.exe (1.6.6.32) 2009-09-27 unins000.exe (51.49.0.0) 2009-01-26 Update.exe (1.6.0.7) 2009-09-07 advcheck.dll (1.6.4.18) 2007-04-02 aports.dll (2.1.0.0) 2008-06-14 DelZip179.dll (1.79.11.1) 2009-01-26 SDHelper.dll (1.6.2.14) 2008-06-19 sqlite3.dll 2008-10-22 Tools.dll (2.1.6.8) 2009-01-16 UninsSrv.dll (1.0.0.0) 2009-05-19 Includes\Adware.sbi () 2009-10-06 Includes\AdwareC.sbi () 2009-01-22 Includes\Cookies.sbi () 2009-08-10 Includes\Dialer.sbi () 2009-10-06 Includes\DialerC.sbi () 2009-01-22 Includes\HeavyDuty.sbi () 2009-05-26 Includes\Hijackers.sbi () 2009-10-06 Includes\HijackersC.sbi () 2009-09-29 Includes\Keyloggers.sbi () 2009-10-06 Includes\KeyloggersC.sbi () 2004-11-29 Includes\LSP.sbi () 2009-10-06 Includes\Malware.sbi () 2009-10-06 Includes\MalwareC.sbi () 2009-03-25 Includes\PUPS.sbi () 2009-10-06 Includes\PUPSC.sbi () 2009-01-22 Includes\Revision.sbi () 2009-01-13 Includes\Security.sbi () 2009-10-06 Includes\SecurityC.sbi () 2008-06-03 Includes\Spybots.sbi () 2008-06-03 Includes\SpybotsC.sbi () 2009-04-07 Includes\Spyware.sbi () 2009-10-06 Includes\SpywareC.sbi () 2009-06-08 Includes\Tracks.uti 2009-10-06 Includes\Trojans.sbi () 2009-10-06 Includes\TrojansC.sbi () 2008-03-04 Plugins\Chai.dll 2008-03-05 Plugins\Fennel.dll 2008-02-26 Plugins\Mate.dll 2007-12-24 Plugins\TCPIPAddress.dll --- System information --- Windows Vista (Build: 6001) Service Pack 1 (6.0.6001) - Start: 0 Type: 1 Error Control: 3

10-10-2009, 07:52 PM	#6 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,853 OS: WinXP and Vista	Re: PC running slow Laptop spybot detects Trojan but cant remove Thank you. Click the round Windows Logo button in the lower left corner-> Control Panel-> Programs-> Uninstall or change a program Start > Computer > uninstall or change a program Uninstall the following: Live-Player Reboot your system. ================================== Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Establish an internet connection & perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner Note To optimize scanning time and produce a more sensible report for review: Close any open programs Turn off the real time scanner of any existing antivirus program while performing the online scan. Click Accept, when prompted to download and install the program files and database of malware definitions. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save Report As... button. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

10-11-2009, 11:29 AM	#7 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove KASPERSKY ONLINE SCANNER 7.0: scan report Sunday, October 11, 2009 Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Sunday, October 11, 2009 10:38:38 Records in database: 2952535 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ E:\ F:\ Scan statistics: Objects scanned: 119219 Threats found: 1 Infected objects found: 1 Suspicious objects found: 0 Scan duration: 03:19:40 File name / Threat / Threats count C:\Users\julie and paul\Documents\LimeWire\Saved\3o3h dont trust me [new single].au Infected: Trojan-Downloader.WMA.GetCodec.af 1 Selected area has been scanned.

10-11-2009, 11:35 AM	#8 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Teenagers and Limewire,im going to uninstall Limewire but will wait for your advice as to when.

10-12-2009, 12:01 AM	#9 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,853 OS: WinXP and Vista	Re: PC running slow Laptop spybot detects Trojan but cant remove You are correct about Limewire, more accurately the music file sharing that has gone on. You can go ahead and uninstall LimeWire now. Delete this folder if it still exists after the uninstall: C:\Users\julie and paul\Documents\LimeWire ================================== Due to the infection detected in that music file download, I now feel it prudent to run ComboFix. Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT- Save ComboFix.exe to your Desktop ==================================================== Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. ==================================================== Double click on ComboFix.exe & follow the prompts. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

10-12-2009, 12:17 PM	#10 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Thanks for the help Ran Combofix first time Laptop got turned off by Daughter.So this is the second run. Cannot uninstall Limewire not in uninstall programs aand uninstall doesnt works.,will try again. ComboFix 09-10-11.03 - julie and paul 12/10/2009 18:33.2.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2037.926 [GMT 1:00] Running from: c:\users\julie and paul\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\julie and paul\AppData\Local\Temp\ppcrlui_4456_2 c:\users\JULIEA~1\AppData\Local\Temp\ppcrlui_4456_2 . ((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 ))))))))))))))))))))))))))))))) . 2009-10-12 17:45 . 2009-10-12 17:45 -------- d-----w- c:\users\Public\AppData\Local\temp 2009-10-12 17:45 . 2009-10-12 17:45 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-10-08 21:59 . 2009-10-08 19:51 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-10-08 19:51 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-10-08 19:50 . 2009-10-08 19:50 -------- dc-h--w- c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864} 2009-10-08 19:49 . 2009-10-08 19:51 -------- d-----w- c:\programdata\Lavasoft 2009-10-08 19:49 . 2009-10-08 19:49 -------- d-----w- c:\program files\Lavasoft 2009-10-04 08:30 . 2009-10-04 08:30 -------- d-----w- c:\windows\system32\EventProviders 2009-10-02 17:53 . 2009-10-01 09:29 195440 ------w- c:\windows\system32\MpSigStub.exe 2009-09-23 20:11 . 2009-09-26 08:08 97 ----a-w- c:\users\julie and paul\AppData\Local\fnmtt.bat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-12 00:13 . 2008-09-29 23:21 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2009-10-04 18:14 . 2008-12-16 12:33 -------- d-----w- c:\program files\Common Files\Apple 2009-10-04 12:10 . 2008-05-13 15:43 -------- d-----w- c:\users\julie and paul\AppData\Roaming\LimeWire 2009-10-03 13:13 . 2008-09-29 23:21 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-09-14 18:19 . 2009-05-02 18:19 -------- d-----w- c:\users\julie and paul\AppData\Roaming\FUJIFILM 2009-09-10 16:39 . 2008-07-27 19:05 -------- d-----w- c:\program files\Microsoft Silverlight 2009-09-10 07:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-09-10 07:20 . 2008-02-26 16:44 -------- d-----w- c:\programdata\Microsoft Help 2009-09-02 17:21 . 2009-09-02 17:21 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-09-02 17:21 . 2009-09-02 17:18 -------- d-----w- c:\programdata\Apple Computer 2009-09-02 17:19 . 2009-09-02 17:18 -------- d-----w- c:\program files\QuickTime 2009-08-29 15:43 . 2009-08-29 15:43 -------- d-----w- c:\program files\sina 2009-08-28 12:39 . 2009-09-03 09:36 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-08-28 10:15 . 2009-09-03 09:36 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-27 08:55 . 2009-05-10 10:07 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-08-27 08:55 . 2009-05-10 10:07 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-08-27 08:55 . 2009-05-10 10:07 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-08-14 17:07 . 2009-09-09 13:16 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-08-14 16:29 . 2009-09-09 13:16 104960 ----a-w- c:\windows\system32\netiohlp.dll 2009-08-14 16:29 . 2009-09-09 13:16 17920 ----a-w- c:\windows\system32\netevent.dll 2009-08-14 14:16 . 2009-09-09 13:16 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-08-14 14:16 . 2009-09-09 13:16 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-08-14 14:16 . 2009-09-09 13:16 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-08-14 14:16 . 2009-09-09 13:16 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-08-14 14:16 . 2009-09-09 13:16 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-08-14 14:16 . 2009-09-09 13:16 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-08-14 14:16 . 2009-09-09 13:16 10240 ----a-w- c:\windows\system32\finger.exe 2009-07-24 12:33 . 2008-05-02 21:19 484 ----a-w- c:\users\julie and paul\AppData\Roaming\wklnhst.dat 2009-07-21 21:52 . 2009-07-29 15:30 915456 ----a-w- c:\windows\system32\wininet.dll 2009-07-21 21:47 . 2009-07-29 15:30 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-07-21 21:47 . 2009-07-29 15:30 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-07-21 20:13 . 2009-07-29 15:30 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-07-17 14:35 . 2009-08-24 16:58 71680 ----a-w- c:\windows\system32\atl.dll . ((((((((((((((((((((((((((((( SnapShot@2009-10-12_16.56.08 ))))))))))))))))))))))))))))))))))))))))) . + 2008-01-21 01:58 . 2009-10-12 17:27 58598 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2006-11-02 13:05 . 2009-10-12 17:27 78156 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-05-02 20:53 . 2009-10-12 17:27 11148 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1898029673-3949625260-1174708737-1000_UserData.bin + 2008-05-02 21:35 . 2009-10-12 17:30 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-05-02 21:35 . 2009-10-12 16:39 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-05-02 21:35 . 2009-10-12 16:39 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-05-02 21:35 . 2009-10-12 17:30 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-05-02 21:35 . 2009-10-12 16:39 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-05-02 21:35 . 2009-10-12 17:30 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-10-12 17:24 . 2009-10-12 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-10-12 14:20 . 2009-10-12 14:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-10-12 14:20 . 2009-10-12 14:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-10-12 17:24 . 2009-10-12 17:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-06-19 15:54 . 2009-10-12 17:27 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat - 2009-06-19 15:54 . 2009-10-12 14:21 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-06-08 15:09 . 2009-10-12 17:23 1652344 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2009-06-08 15:09 . 2009-10-12 00:18 1652344 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-09-02 10:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-20 136600] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-05 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-05 154136] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-05 129560] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632] "Desktop SMS"="c:\program files\IDM\Desktop SMS\DesktopSMS.exe" [2007-06-18 1507328] "Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-10-25 413696] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456] "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 571024] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-14 185896] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-06 2023704] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "NDSTray.exe"="NDSTray.exe" [BU] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-29 4911104] "Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-11-20 1826816] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2009-5-2 303104] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{8D000837-4B57-427E-85A1-EFA536B49223}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{9302A047-5702-4B8A-812A-6B72CDCC0D97}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{B5C21128-2542-4624-BE9C-D52CF57A99F1}"= UDP:c:\users\julie and paul\Desktop\LimeWire\LimeWire.exe:LimeWire "{384D8EA8-AC70-4750-95DA-BB797544C09D}"= TCP:c:\users\julie and paul\Desktop\LimeWire\LimeWire.exe:LimeWire "TCP Query User{A16ECB6A-C860-4D93-9619-4BB1259CD9BE}c:\\users\\julie and paul\\desktop\\limewire\\limewire.exe"= UDP:c:\users\julie and paul\desktop\limewire\limewire.exe:limewire.exe "UDP Query User{F15DEEF5-2856-4686-A97D-92F9696B109C}c:\\users\\julie and paul\\desktop\\limewire\\limewire.exe"= TCP:c:\users\julie and paul\desktop\limewire\limewire.exe:limewire.exe "TCP Query User{012B90F0-31D5-4057-93BC-2390291EC9ED}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{B712D4C5-658D-4A74-9208-13B89494B74D}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{7856C4EE-CA26-4696-8A63-F6AAA1CD35B7}"= TCP:6004\|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{4FCB0A5B-B8D8-4CE1-8347-22FB00E7235F}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{4CE09ACD-8EAA-4B84-9E3A-27E163AFF34C}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{B3FF92B0-CEA1-40B8-B62D-3AE70B16A488}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{9F62F2C9-9687-4D39-B75D-7E509152D9CF}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C2964DD1-6CA9-420B-AEB7-004D4A3A5A99}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{C45C1FFA-BB9A-4CD4-8E75-9EAAC0D6B4FF}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{84487188-AC63-4AF3-90E5-B45B60DCD04C}"= UDP:c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "{24691D6D-DF7F-4526-A473-55C32928412D}"= TCP:c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "{B5B25B5F-0C7A-4572-AA27-92B8A3FF8CF0}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{B7BC40FF-EB5A-492F-939B-DC32057F6F0F}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{4A61E380-2A4A-4480-9F4B-4F4D4672340C}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe "TCP Query User{67756042-A4DF-4F90-AAFB-4EDD503AF306}c:\\windows\\system32\\nagasoft\\ffvjplayer.exe"= UDP:c:\windows\system32\nagasoft\ffvjplayer.exe:FFVJPlayer Module "UDP Query User{7AA6F731-79CE-4058-9F3F-33857C2D9B69}c:\\windows\\system32\\nagasoft\\ffvjplayer.exe"= TCP:c:\windows\system32\nagasoft\ffvjplayer.exe:FFVJPlayer Module R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [08/10/2009 20:51 64160] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [10/05/2009 11:07 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [10/05/2009 11:07 108552] R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [02/05/2008 21:59 20352] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/08/2009 09:54 297752] R2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [25/12/2007 14:07 40960] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [03/07/2009 15:49 1028432] R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [03/12/2007 17:03 126976] R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [26/02/2008 12:06 7168] S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [23/03/2009 18:04 55280] S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08 533360] S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\Jumpstart\jswpsapi.exe [02/05/2008 21:59 937984] S3 usb2vcom;USB Data Cable;c:\windows\System32\drivers\usb2vcom.sys [29/12/2008 14:35 28704] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] vvdsvc REG_MULTI_SZ vvdsvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-10-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 19:51] 2009-10-11 c:\windows\Tasks\User_Feed_Synchronization-{7256BC4D-33B4-4CAC-99D9-E32E6BA70918}.job - c:\windows\system32\msfeedssync.exe [2009-07-29 20:13] . . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = .local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\users\julie and paul\AppData\Roaming\Mozilla\Firefox\Profiles\q099s4hr.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo! Search FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-12 18:46 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2009-10-12 18:50 ComboFix-quarantined-files.txt 2009-10-12 17:50 ComboFix2.txt 2009-10-12 17:01 Pre-Run: 1,728,602,112 bytes free Post-Run: 1,622,728,704 bytes free 237 --- E O F --- 2009-10-12 14:27

10-12-2009, 05:15 PM	#11 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Its still here,cant delete it well i cant find it. C:\Users\julie and paul\Documents\LimeWire

10-12-2009, 07:36 PM	#12 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,853 OS: WinXP and Vista	Re: PC running slow Laptop spybot detects Trojan but cant remove Hi pip.1, Please follow the instructions here to ensure hidden files and folders are viewable. On your keyboard, press the Windows Logo key and the letter E to open Windows Explorer. Navigate to, and delete the following folders (right click and select 'delete'): c:\users\julie and paul\AppData\Roaming\LimeWire C:\Users\julie and paul\Documents\LimeWire Let me know if you were successful. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

10-13-2009, 01:11 PM	#13 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Thanks i found the first one and deleted but couldnt find the Douments/Limewire,its possible i deleted that yesterdaywhen i deleted Limewire,uninstall wouldnt work so i went in and deleted the files individualy.Should i run spybot to check?

10-13-2009, 01:14 PM	#14 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Should i delete the appdata file which did contain the Limewire folder?

10-13-2009, 04:35 PM	#17 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Thanks Have done that ,added no problem. Do i need to do anything else? Everything seems fine.

10-13-2009, 09:20 PM	#18 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,853 OS: WinXP and Vista	Re: PC running slow Laptop spybot detects Trojan but cant remove All that needs done now is to tidy up. Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links: The following procedure will implement some cleanup procedures. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u -------------------------------------------------------------------- To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites: Green to go Yellow for caution Red to stop WOT has an addon available for both Firefox and IE. SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page. - Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer - Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. How did I get infected in the first place? PC Safety and Security--What Do I Need? - Most importantly, Think Prevention ----------------------------------------------------- **Kindly respond one more time and let me know if we may consider this thread resolved. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

10-14-2009, 04:53 PM	#19 (permalink)
pip.1 Registered User Join Date: Jul 2007 Posts: 80 OS: xp	Re: PC running slow Laptop spybot detects Trojan but cant remove Ried THANKYOU Thread close.

10-14-2009, 08:41 PM	#20 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,853 OS: WinXP and Vista	Re: PC running slow Laptop spybot detects Trojan but cant remove You're welcome, pip.1. Take care. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."