Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads

User Tag List

I know there gotta be something wrong--My log

This is a discussion on I know there gotta be something wrong--My log within the Resolved HJT Threads forums, part of the Tech Support Forum category. Not sure what is going on here but hopefully this helps... thank you guys for the help in advance, this


 
 
Thread Tools Search this Thread
Old 07-01-2006, 01:00 AM   #1
Guest
 
Join Date: Jul 2006
Posts: 7
OS:



Not sure what is going on here but hopefully this helps...
thank you guys for the help in advance, this is a very cool
site!!!

Logfile of HijackThis v1.99.1
Scan saved at 1:58:13 AM, on 7/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\isrvs\desktop.exe
C:\Program Files\WildTangent\Apps\GameChannel.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.musicalheresy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.wildtangent.com/ddc/hpdesktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RsyncHlpr Class - {16B238D5-80DE-47CE-8F17-B3ECE2C2248D} - blank (file missing)
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - blank (file missing)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: LinkTracker Class - {6A6E50DC-BFA8-4B40-AB1B-159E03E829FD} - blank (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [xhrmy] C:\WINDOWS\Xhrmy.exe
O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [sipuzm] c:\windows\system32\imhzgdi.exe
O4 - HKLM\..\Run: [RSync] C:\WINDOWS\System32\netsync.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [p2pnetwork] p2pnetwork.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [MsConfigs] C:\Program Files\MsConfigs\MsConfigs.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\system32\gah95on6.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [0FEg3Ej] wisanmgr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\RunServices: [p2pnetwork] p2pnetwork.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [HoxmROH5g] w32ll32.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\RunServices: [p2pnetwork] p2pnetwork.exe
O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
tomanywater is offline  
Sponsored Links
Advertisement
 
Old 07-02-2006, 03:59 PM   #2
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Hi tomanywater and welcome to TSF.

I see you have WildTangent on your system. I would point out that they used to collect info and details on users but they say they no longer do this. Whether or not you wish to keep this is up to you.


You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.


Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below.


If there is anything you don't understand, please ask BEFORE proceeding with the fixes.


Please ensure that you follow the instructions in the order I have them listed.



HijackThis in Temp Folder
You are running HijackThis from a temporary directory. It needs to be in a permanent folder. Please go into Windows Explorer, click on C:\ then click on File > New > Folder and call it HJT , or another name of your choice and move the HJT files to this folder. The program creates backup files that we may need to use later. If the program is in a Temporary folder, files may be deleted by you or automatically if your system is set to empty temp files.



Show Hidden Files
Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.



Downloads
Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!


Download Ewido Anti-Malware
This is a 30 day trial
  • Install Ewido Anti-Malware.
  • Double-click the icon on Desktop to launch Ewido
  • On the top of the main screen click Shield
  • Click the word active to change it to inactive
  • On the top of the main screen click Update.
  • Then click on Start Update. The update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
    • I also recommend changing the "Update interval" to something more reasonable like 12 hours.

If you are having problems with the updater, you can use this link to manually update Ewido.
When you have finished updating, EXIT Ewido.


Please download Brute Force Uninstaller to your desktop.
  • Right click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to,
  • Click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk (C:) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:BFU).

Do not do anything with these yet!



Reboot
Reboot your system in Safe Mode.
  • Restart the computer. The computer begins processing a set of instructions known as BIOS.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
  • Instead of Windows loading as normal, a menu should appear
  • Use the arrow key to highlight Safe Mode and press Enter.



Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

PeopleOnPage or POP!




HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

O2 - BHO: RsyncHlpr Class - {16B238D5-80DE-47CE-8F17-B3ECE2C2248D} - blank (file missing)
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - blank (file missing)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: LinkTracker Class - {6A6E50DC-BFA8-4B40-AB1B-159E03E829FD} - blank (file missing)
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [xhrmy] C:\WINDOWS\Xhrmy.exe
O4 - HKLM\..\Run: [sipuzm] c:\windows\system32\imhzgdi.exe
O4 - HKLM\..\Run: [RSync] C:\WINDOWS\System32\netsync.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\system32\gah95on6.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [0FEg3Ej] wisanmgr.exe
O4 - HKCU\..\Run: [HoxmROH5g] w32ll32.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll


Please remember to close all other windows, including browsers then click Fix checked.




File Deletions
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\WINDOWS\isrvs
C:\WINDOWS\Xhrmy.exe
c:\windows\system32\imhzgdi.exe
C:\WINDOWS\System32\netsync.exe
C:\WINDOWS\system32\gah95on6.exe
C:\WINDOWS\farmmext.exe
C:\Program Files\AutoUpdate
C:\WINDOWS\ALCMTR.EXE
wisanmgr.exe
w32ll32.exe
C:\PROGRA~1\ezula



Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
  • Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.

Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.



Run Ewido
Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.
  • When the scan is complete click Recommended Action and change it to Quarantine
  • Then click Apply all actions
Once finished, click the Save report button, then click Save Report As and save it to your desktop.

NOTE: Ewido scan may require an hour.



Run the Brute Force Uninstaller
Then, please go to Start > My Computer and navigate to the C:\BFU folder.
  • Start the Brute Force Uninstaller by doubleclicking BFU.exe
  • Behind the scriptline to execute field click the folder icon and select alcanshorty.bfu
  • Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.)
  • Wait for the complete script execution box to pop up and press OK.
  • Press exit to terminate the BFU program.
Reboot into normal Windows.



Online Scan

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner.

1. Click Check Now and a "pop up" window will appear. *Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on See report then click Save report

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan




Logs required
Ewido Log
Panda Log
HijackThis Log


Please also let me know how your system is performing now and if you have any specific problems.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.

PC Safety & Security::PC running a bit slow?::Photographers Corner

Glaswegian is offline  
Old 07-02-2006, 09:27 PM   #3
Guest
 
Join Date: Jul 2006
Posts: 7
OS:


Activescan

Incident Status Location

Spyware:spyware/apropos Not disinfected c:\windows\system32\auto_update_uninstall.log
Adware:adware/ezula Not disinfected c:\windows\system32\ezstub.exe
Spyware:spyware/linkreplacer Not disinfected c:\windows\system32\lmdv.bin
Adware:adware/midaddle Not disinfected c:\windows\system32\PreUninstall.exe
Adware:adware/isearch Not disinfected c:\windows\delprot.ini
Adware:adware/ist.istbar Not disinfected c:\program files\common files\Totem Shared
Adware:adware/beginto Not disinfected c:\windows\system32\cache32_rtneg3
Adware:adware/ncase Not disinfected c:\program files\INSTAFIN
Adware:adware/ilookup Not disinfected c:\windows\iLookup
Spyware:spyware/safesurf Not disinfected Windows Registry
Adware:adware/aurora Not disinfected Windows Registry
Spyware:spyware/betterinet Not disinfected Windows Registry
Adware:adware/sahagent Not disinfected Windows Registry
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\My Keywords.lnk
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\My Preferences.lnk
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\TopText Button Show - Hide.lnk
Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe
Hacktool:HackTool/Cain Not disinfected C:\Program Files\Cain\Abel.exe
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\distribution.dll.017
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Distribution.dll.043
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Music.dll.021
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.040
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.070
Adware:Adware/eZula Not disinfected C:\Program Files\eZula\eabh.dll
Adware:Adware/eZula Not disinfected C:\Program Files\eZula\seng.dll
Adware:Adware/eZula Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113679858.ssb[C:\Program Files\eZula\mmod.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113701469.ssb[C:\Program Files\CxtPls\ace.dll]
Adware:Adware/PortalScan Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\Xhrmy.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\wisanmgr.exe]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\gah95on6.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\w32ll32.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703857.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\CxtPls\ProxyStub.dll]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\CxtPls\WinGenerics.dll]
Adware:Adware/eZula Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\eZula\CHCON.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\70tovmto.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IPInsight Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\inf\farmmext.inf]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\2b3fsk0h.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\bln02nqv.exe]
Adware:Adware/nCase Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\InstaFinder_inst.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/eZula Not disinfected C:\WINDOWS\iLookup\ezStub22.exe
Spyware:Spyware/LinkReplacer Not disinfected C:\WINDOWS\system32\uninst.exe

Ewido



---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 8:05:39 PM 7/2/2006

+ Scan result:



C:\Program Files\INSTAFIN -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\ErrorLog.txt -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\NewCfg -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\instafintb0300.cfg -> Adware.404Search : No action taken.
C:\Program Files\CxtPls -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_10-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_11-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_12-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_13-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_14-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_15-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_16-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\w32ll32.exe -> Adware.Apropos : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\Program Files\CxtPls\WinGenerics.dll -> Adware.Apropos : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr.1 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr\CLSID -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr\CurVer -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Netsync -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RsyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RSyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run\CPDEF2 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run\IDCS52 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Sys -> Adware.Begin2Search : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj.1 -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj\CLSID -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj\CurVer -> Adware.BetterInternet : No action taken.
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon -> Adware.BetterInternet : No action taken.
HKU\S-1-5-21-3224208724-1330512345-1814389393-500\Software\aurora -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113679858.ssb/C:\Program Files\eZula\mmod.exe -> Adware.EZula : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\Program Files\eZula\CHCON.dll -> Adware.EZula : No action taken.
C:\Program Files\eZula -> Adware.eZula : No action taken.
C:\Program Files\eZula\INSTALL.LOG -> Adware.eZula : No action taken.
C:\Program Files\eZula\Images -> Adware.eZula : No action taken.
C:\Program Files\eZula\UNWISE.EXE -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.dst -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.kwd -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.pu -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.rst -> Adware.eZula : No action taken.
C:\Program Files\eZula\eabh.dll -> Adware.eZula : No action taken.
C:\Program Files\eZula\seng.dll -> Adware.eZula : No action taken.
C:\Program Files\eZula\upgrade.vrn -> Adware.eZula : No action taken.
C:\Program Files\eZula\version.vrn -> Adware.eZula : No action taken.
C:\WINDOWS\iLookup -> Adware.eZula : No action taken.
C:\WINDOWS\iLookup\ezStub22.exe -> Adware.eZula : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\InstaFinder_inst.exe -> Adware.InstaFinder : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703857.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter.1 -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter\CLSID -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker.1 -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker\CLSID -> Adware.LinkMaker : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\gah95on6.exe -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\70tovmto.exe -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\2b3fsk0h.dll -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\bln02nqv.exe -> Adware.Sahat : No action taken.
C:\WINDOWS\system32\70tovmto.ini -> Adware.Sahat : No action taken.
C:\WINDOWS\system32\PreUninstall.exe -> Adware.Suggestor : No action taken.
HKU\S-1-5-21-3224208724-1330512345-1814389393-500\Software\Bolger -> Adware.VX2 : No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\wisanmgr.exe -> Downloader.Apropo.aa : No action taken.
C:\Program Files\Cain\Abel.exe -> Not-A-Virus.PSWTool.Win32.Cain.e : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\Xhrmy.exe -> Trojan.SecondThought.aa : No action taken.


::Report end



HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 10:26:26 PM, on 7/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\WildTangent\Apps\GameChannel.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.musicalheresy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.wildtangent.com/ddc/hpdesktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\RunServices: [p2pnetwork] p2pnetwork.exe
O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe


and im all for taking wildtangent off as well brother

thanks for the reply
tomanywater is offline  
Sponsored Links
Advertisement
 
Old 07-03-2006, 01:59 PM   #4
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Hi again

We’ll need to run Ewido and Panda again – Ewido should have fixed most of those files. Please follow the setup instructions carefully.


Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below.


If there is anything you don't understand, please ask BEFORE proceeding with the fixes.



Downloads
Please download AproposFix from here:
https://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.



Prepare Ewido
  • Double-click the icon on Desktop to launch Ewido
  • On the top of the main screen click Shield
  • Click the word active to change it to inactive
  • On the top of the main screen click Update.
  • Then click on Start Update. The update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine". <- - VERY IMPORTANT!!
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
    • I also recommend changing the "Update interval" to something more reasonable like 12 hours.

If you are having problems with the updater, you can use this link to manually update Ewido.
When you have finished updating, EXIT Ewido.




Reboot
Reboot your system in Safe Mode.
  • Restart the computer. The computer begins processing a set of instructions known as BIOS.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
  • Instead of Windows loading as normal, a menu should appear
  • Use the arrow key to highlight Safe Mode and press Enter.



Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

WildTangent or anything related to WT



HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.wildtangent.com/ddc/hpdesktop
O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe


Please remember to close all other windows, including browsers then click Fix checked.



File Deletions
Delete the following Folder indicated in BLUE if it still exists.

C:\Program Files\WildTangent



Run Ewido
Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.
  • When the scan is complete do the following: f you have any infections you will prompted, then select "Apply all actions"
Once finished, click the Save report button, then click Save Report As and save it to your desktop (make sure to remember where you saved that file, this is important).

NOTE: Ewido scan may require an hour.



Run Apropos Fix
Please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.



Reboot
Reboot your system in Normal Mode.



Online Scan

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner.

1. Click Check Now and a "pop up" window will appear. *Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on See report then click Save report

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan




Logs required
Ewido Log
the log.txt file in the aproposfix folder.
Panda Log
HijackThis Log


Please also let me know how your system is performing now and if you have any specific problems.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.

PC Safety & Security::PC running a bit slow?::Photographers Corner

Glaswegian is offline  
Old 07-04-2006, 01:11 AM   #5
Guest
 
Join Date: Jul 2006
Posts: 7
OS:


Logfile of HijackThis v1.99.1
Scan saved at 2:08:52 AM, on 7/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.musicalheresy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\RunServices: [p2pnetwork] p2pnetwork.exe
O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe


---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:22:43 AM 7/4/2006

+ Scan result:



C:\Program Files\INSTAFIN -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\ErrorLog.txt -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\NewCfg -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\instafintb0300.cfg -> Adware.404Search : No action taken.
C:\Program Files\CxtPls -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_10-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_11-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_12-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_13-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_14-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_15-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_16-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\w32ll32.exe -> Adware.Apropos : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\Program Files\CxtPls\WinGenerics.dll -> Adware.Apropos : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr.1 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr\CLSID -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr\CurVer -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Netsync -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RsyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RSyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run\CPDEF2 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run\IDCS52 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Sys -> Adware.Begin2Search : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj.1 -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj\CLSID -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj\CurVer -> Adware.BetterInternet : No action taken.
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon -> Adware.BetterInternet : No action taken.
HKU\S-1-5-21-3224208724-1330512345-1814389393-500\Software\aurora -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113679858.ssb/C:\Program Files\eZula\mmod.exe -> Adware.EZula : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\Program Files\eZula\CHCON.dll -> Adware.EZula : No action taken.
C:\Program Files\eZula -> Adware.eZula : No action taken.
C:\Program Files\eZula\INSTALL.LOG -> Adware.eZula : No action taken.
C:\Program Files\eZula\Images -> Adware.eZula : No action taken.
C:\Program Files\eZula\UNWISE.EXE -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.dst -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.kwd -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.pu -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.rst -> Adware.eZula : No action taken.
C:\Program Files\eZula\eabh.dll -> Adware.eZula : No action taken.
C:\Program Files\eZula\seng.dll -> Adware.eZula : No action taken.
C:\Program Files\eZula\upgrade.vrn -> Adware.eZula : No action taken.
C:\Program Files\eZula\version.vrn -> Adware.eZula : No action taken.
C:\WINDOWS\iLookup -> Adware.eZula : No action taken.
C:\WINDOWS\iLookup\ezStub22.exe -> Adware.eZula : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\InstaFinder_inst.exe -> Adware.InstaFinder : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703857.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter.1 -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter\CLSID -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker.1 -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker\CLSID -> Adware.LinkMaker : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\gah95on6.exe -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\70tovmto.exe -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\2b3fsk0h.dll -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\bln02nqv.exe -> Adware.Sahat : No action taken.
C:\WINDOWS\system32\70tovmto.ini -> Adware.Sahat : No action taken.
C:\WINDOWS\system32\PreUninstall.exe -> Adware.Suggestor : No action taken.
HKU\S-1-5-21-3224208724-1330512345-1814389393-500\Software\Bolger -> Adware.VX2 : No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\wisanmgr.exe -> Downloader.Apropo.aa : No action taken.
C:\Program Files\Cain\Abel.exe -> Not-A-Virus.PSWTool.Win32.Cain.e : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\Xhrmy.exe -> Trojan.SecondThought.aa : No action taken.


::Report end




Incident Status Location

Spyware:spyware/apropos Not disinfected c:\windows\system32\auto_update_uninstall.log
Adware:adware/ezula Not disinfected c:\windows\system32\ezstub.exe
Spyware:spyware/linkreplacer Not disinfected c:\windows\system32\lmdv.bin
Adware:adware/midaddle Not disinfected c:\windows\system32\PreUninstall.exe
Adware:adware/isearch Not disinfected c:\windows\delprot.ini
Adware:adware/ist.istbar Not disinfected c:\program files\common files\Totem Shared
Adware:adware/beginto Not disinfected c:\windows\system32\cache32_rtneg3
Adware:adware/ncase Not disinfected c:\program files\INSTAFIN
Adware:adware/ilookup Not disinfected c:\windows\iLookup
Spyware:spyware/safesurf Not disinfected Windows Registry
Adware:adware/aurora Not disinfected Windows Registry
Spyware:spyware/betterinet Not disinfected Windows Registry
Adware:adware/sahagent Not disinfected Windows Registry
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\My Keywords.lnk
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\My Preferences.lnk
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\TopText Button Show - Hide.lnk
Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe
Hacktool:HackTool/Cain Not disinfected C:\Program Files\Cain\Abel.exe
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\distribution.dll.017
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Distribution.dll.043
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Music.dll.021
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.040
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.070
Adware:Adware/eZula Not disinfected C:\Program Files\eZula\eabh.dll
Adware:Adware/eZula Not disinfected C:\Program Files\eZula\seng.dll
Adware:Adware/eZula Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113679858.ssb[C:\Program Files\eZula\mmod.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113701469.ssb[C:\Program Files\CxtPls\ace.dll]
Adware:Adware/PortalScan Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\Xhrmy.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\wisanmgr.exe]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\gah95on6.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\w32ll32.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703857.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\CxtPls\ProxyStub.dll]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\CxtPls\WinGenerics.dll]
Adware:Adware/eZula Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\eZula\CHCON.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\70tovmto.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IPInsight Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\inf\farmmext.inf]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\2b3fsk0h.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\bln02nqv.exe]
Adware:Adware/nCase Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\InstaFinder_inst.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/eZula Not disinfected C:\WINDOWS\iLookup\ezStub22.exe
Spyware:Spyware/LinkReplacer Not disinfected C:\WINDOWS\system32\uninst.exe
tomanywater is offline  
Old 07-04-2006, 02:13 PM   #6
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Hi

I need the apropos log as well please.

Can I ask - did you set Ewido to Quarantine all items? It seems to keep ignoring them, which is why the Panda log is quite long. Try running Ewido and Panda again, carefully following my instructions, and see what the log looks like. You may need to go back and change the settings for Ewido.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.

PC Safety & Security::PC running a bit slow?::Photographers Corner

Glaswegian is offline  
Old 07-08-2006, 12:58 AM   #7
Guest
 
Join Date: Jul 2006
Posts: 7
OS:


sry for wait , i will double check and run all utilities again and post in couple hours , thanks for the help man
tomanywater is offline  
Old 07-08-2006, 03:32 AM   #8
Guest
 
Join Date: Jul 2006
Posts: 7
OS:


Logfile of HijackThis v1.99.1
Scan saved at 4:24:26 AM, on 7/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.musicalheresy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\RunServices: [p2pnetwork] p2pnetwork.exe
O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe


---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 3:50:24 AM 7/8/2006

+ Scan result:



C:\Program Files\INSTAFIN -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\ErrorLog.txt -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\NewCfg -> Adware.404Search : No action taken.
C:\Program Files\INSTAFIN\Cache\instafintb0300.cfg -> Adware.404Search : No action taken.
C:\Program Files\CxtPls -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_10-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_11-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_12-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_13-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_14-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_15-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\CxtPls\AI_16-04-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\w32ll32.exe -> Adware.Apropos : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\Program Files\CxtPls\WinGenerics.dll -> Adware.Apropos : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr.1 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr\CLSID -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Classes\Var3.RsyncHlpr\CurVer -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Netsync -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RsyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RSyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run\CPDEF2 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Run\IDCS52 -> Adware.Begin2Search : No action taken.
HKLM\SOFTWARE\RSyncMon\Sys -> Adware.Begin2Search : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\ceres.dll -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj.1 -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj\CLSID -> Adware.BetterInternet : No action taken.
HKLM\SOFTWARE\Classes\BolgerDll.BolgerDllObj\CurVer -> Adware.BetterInternet : No action taken.
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon -> Adware.BetterInternet : No action taken.
HKU\S-1-5-21-3224208724-1330512345-1814389393-500\Software\aurora -> Adware.BetterInternet : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113679858.ssb/C:\Program Files\eZula\mmod.exe -> Adware.EZula : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\Program Files\eZula\CHCON.dll -> Adware.EZula : No action taken.
C:\Program Files\eZula -> Adware.eZula : No action taken.
C:\Program Files\eZula\INSTALL.LOG -> Adware.eZula : No action taken.
C:\Program Files\eZula\Images -> Adware.eZula : No action taken.
C:\Program Files\eZula\UNWISE.EXE -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.dst -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.kwd -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.pu -> Adware.eZula : No action taken.
C:\Program Files\eZula\basis.rst -> Adware.eZula : No action taken.
C:\Program Files\eZula\eabh.dll -> Adware.eZula : No action taken.
C:\Program Files\eZula\seng.dll -> Adware.eZula : No action taken.
C:\Program Files\eZula\upgrade.vrn -> Adware.eZula : No action taken.
C:\Program Files\eZula\version.vrn -> Adware.eZula : No action taken.
C:\WINDOWS\iLookup -> Adware.eZula : No action taken.
C:\WINDOWS\iLookup\ezStub22.exe -> Adware.eZula : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\msdbhk.dll -> Adware.IESearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\InstaFinder_inst.exe -> Adware.InstaFinder : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703857.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\desktop.exe -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\isearch.xpi/chrome/isearch.jar/content/isearch/isearch.js -> Adware.ISearch : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\mfiltis.dll -> Adware.ISearch : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter.1 -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkMakerFilter\CLSID -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker.1 -> Adware.LinkMaker : No action taken.
HKLM\SOFTWARE\Classes\LinkMaker.LinkTracker\CLSID -> Adware.LinkMaker : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb/C:\WINDOWS\isrvs\ffisearch.exe -> Adware.MDH : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\gah95on6.exe -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\70tovmto.exe -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\2b3fsk0h.dll -> Adware.Sahat : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb/C:\WINDOWS\system32\bln02nqv.exe -> Adware.Sahat : No action taken.
C:\WINDOWS\system32\70tovmto.ini -> Adware.Sahat : No action taken.
C:\WINDOWS\system32\PreUninstall.exe -> Adware.Suggestor : No action taken.
HKU\S-1-5-21-3224208724-1330512345-1814389393-500\Software\Bolger -> Adware.VX2 : No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\system32\wisanmgr.exe -> Downloader.Apropo.aa : No action taken.
C:\Program Files\Cain\Abel.exe -> Not-A-Virus.PSWTool.Win32.Cain.e : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt -> TrackingCookie.Qksrv : No action taken.
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb/C:\WINDOWS\Xhrmy.exe -> Trojan.SecondThought.aa : No action taken.


::Report end





Incident Status Location

Spyware:spyware/apropos Not disinfected c:\windows\system32\auto_update_uninstall.log
Adware:adware/ezula Not disinfected c:\windows\system32\ezstub.exe
Spyware:spyware/linkreplacer Not disinfected c:\windows\system32\lmdv.bin
Adware:adware/midaddle Not disinfected c:\windows\system32\PreUninstall.exe
Adware:adware/isearch Not disinfected c:\windows\delprot.ini
Adware:adware/ist.istbar Not disinfected c:\program files\common files\Totem Shared
Adware:adware/beginto Not disinfected c:\windows\system32\cache32_rtneg3
Adware:adware/ncase Not disinfected c:\program files\INSTAFIN
Adware:adware/ilookup Not disinfected c:\windows\iLookup
Spyware:spyware/safesurf Not disinfected Windows Registry
Adware:adware/aurora Not disinfected Windows Registry
Spyware:spyware/betterinet Not disinfected Windows Registry
Adware:adware/sahagent Not disinfected Windows Registry
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\My Keywords.lnk
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\My Preferences.lnk
Adware:Adware/eZula Not disinfected C:\Documents and Settings\Administrator\Start Menu\Programs\TopText iLookup\TopText Button Show - Hide.lnk
Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe
Hacktool:HackTool/Cain Not disinfected C:\Program Files\Cain\Abel.exe
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\distribution.dll.017
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Distribution.dll.043
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Music.dll.021
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.040
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\Windows.dll.070
Adware:Adware/eZula Not disinfected C:\Program Files\eZula\eabh.dll
Adware:Adware/eZula Not disinfected C:\Program Files\eZula\seng.dll
Adware:Adware/eZula Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113679858.ssb[C:\Program Files\eZula\mmod.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113701469.ssb[C:\Program Files\CxtPls\ace.dll]
Adware:Adware/PortalScan Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\Xhrmy.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\wisanmgr.exe]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\gah95on6.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703690.ssb[C:\WINDOWS\system32\w32ll32.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1113703857.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\CxtPls\ProxyStub.dll]
Spyware:Spyware/Apropos Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\CxtPls\WinGenerics.dll]
Adware:Adware/eZula Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\Program Files\eZula\CHCON.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\70tovmto.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IPInsight Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\inf\farmmext.inf]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\2b3fsk0h.dll]
Adware:Adware/SAHAgent Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\bln02nqv.exe]
Adware:Adware/nCase Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115089046.ssb[C:\WINDOWS\system32\InstaFinder_inst.exe]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115090277.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\desktop.exe]
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\ceres.dll]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\delprot.ini]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\desktop.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\ffisearch.exe]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\isearch.xpi]
Adware:Adware/ISearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\isearch.xpi][chrome/isearch.jar][content/isearch/isearch.js]
Adware:Adware/IESearchBar Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\mfiltis.dll]
Adware:Adware/FIsearch Not disinfected C:\Program Files\InterMute\SpySubtract\Backup\Clean Session - 1115248576.ssb[C:\WINDOWS\isrvs\msdbhk.dll]
Adware:Adware/eZula Not disinfected C:\WINDOWS\iLookup\ezStub22.exe
Spyware:Spyware/LinkReplacer Not disinfected C:\WINDOWS\system32\uninst.exe

Log of AproposFix v1.1

************

Running from directory:
C:\aprop\aproposfix

************



Registry entries found:


************

No service found!

Removing hidden folder:
No folder found!

Deleting files:


Backing up files:
Done!

Removing registry entries:

REGEDIT4


Done!

Finished!





ok I triple checked everything this time, it is definately set on Quarantine
made sure everything was up to date and done according to instruction
i hope this time was better then prior

thanks again!
tomanywater is offline  
Old 07-08-2006, 08:52 AM   #9
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Hi again

No worries – must be something to do with the new version of Ewido.


Disable EwidoGuard
Please disable Ewido Anti-Malware's Guard, as it may hinder the removal of some entries. You can re-enable it after you're clean.
  • Double-click the icon on Desktop to launch Ewido
  • On the top of the main screen click Shield
  • Click the word active to change it to inactive
  • Exit Ewido


Registry Fix
Click on the zip file attached to this post to open and extract the file tomany.reg to your desktop. Double click on the file tomany.reg to run it. Answer yes to any prompts and allow it to merge into the Registry.


Downloads
Please download the ISTBar removal tool from Symantec into it's own folder. Do not run it yet.




Reboot
Reboot your system in Safe Mode.
  • Restart the computer. The computer begins processing a set of instructions known as BIOS.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
  • Instead of Windows loading as normal, a menu should appear
  • Use the arrow key to highlight Safe Mode and press Enter.




Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

ContextPlus
TopText






HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

O4 - HKCU\..\RunServices: [p2pnetwork] p2pnetwork.exe

Please remember to close all other windows, including browsers then click Fix checked.




File Deletions
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.


C:\Program Files\INSTAFIN
C:\Program Files\CxtPls
C:\Program Files\eZula
C:\WINDOWS\iLookup
c:\windows\system32\auto_update_uninstall.log
c:\windows\system32\lmdv.bin
c:\windows\system32\PreUninstall.exe
c:\windows\delprot.ini
c:\windows\system32\cache32_rtneg3
C:\Program Files\InterMute\SpySubtract\Backup <- - Delete only the contents of this folder - NOT the folder itself
p2pnetwork.exe <- - Go to Start > Search to find this file




Run the ISTBar removal Tool.




Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
  • Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.

Click OK, Press the CleanUp! button to start the program and reboot to Normal Mode when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.



Online Scan
Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
  • Extended
Scan Options:
  • Scan Archives
  • Scan Mail Bases
Click OK

Now under select a target to scan: Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Take note of the name(s) and location(s) of any file(s) it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan


Please post back with the Kaspersky Log and a fresh HijackThis Log. Please also let me know how your system is performing now and if you have any specific problems.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.

PC Safety & Security::PC running a bit slow?::Photographers Corner

Glaswegian is offline  
Old 07-08-2006, 10:03 PM   #10
Guest
 
Join Date: Jul 2006
Posts: 7
OS:


Logfile of HijackThis v1.99.1
Scan saved at 10:59:10 PM, on 7/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.musicalheresy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe



-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Saturday, July 08, 2006 10:58:20 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 9/07/2006
Kaspersky Anti-Virus database records: 205896
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
G:\
H:\
I:\
J:\

Scan Statistics:
Total number of scanned objects: 90754
Number of viruses found: 12
Number of infected objects: 18
Number of suspicious objects: 0
Duration of the scan process: 00:42:45

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\ca_setup.exe/WISE0023.BIN Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\ca_setup.exe/WISE0025.BIN Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\ca_setup.exe WiseSFX: infected - 2 skipped
C:\Program Files\Cain\Abel.dll Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Program Files\Cain\Abel.exe Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP109\A0010001.dll Infected: Trojan-Downloader.Win32.Ieser.a skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP109\A0010002.exe Infected: not-a-virus:AdWare.Win32.ISearch.d skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP109\A0010003.dll Infected: not-a-virus:AdWare.Win32.ISearch.d skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP109\A0010037.exe Infected: Trojan.Win32.Delprot.a skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP109\A0010038.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP112\A0011697.exe Infected: not-a-virus:AdWare.Win32.Suggestor.g skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP112\A0011699.exe Infected: not-a-virus:AdWare.Win32.EZula.z skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP112\A0011700.dll Infected: not-a-virus:AdWare.Win32.EZula.x skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP112\A0011701.dll Infected: not-a-virus:AdWare.Win32.EZula.ab skipped
C:\System Volume Information\_restore{705F393B-7BA4-487A-8373-6B62B26D1958}\RP98\A0007827.exe Infected: Trojan-Downloader.Win32.Agent.er skipped
C:\WINDOWS\system32\70tovmto.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped
C:\WINDOWS\system32\ezstub.exe Infected: not-a-virus:AdWare.Win32.EZula.ap skipped
C:\WINDOWS\system32\gah95on6.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped

Scan process completed.




it is definately running alot better for sure !!!!
really cant think of any specifics at this point

although iam still running quite a few processes
it seems , is there some other junk that you see in
the log that you dont recomend having??

thanks bro!
tomanywater is offline  
Old 07-09-2006, 08:31 AM   #11
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Hi again


Delete these files

C:\WINDOWS\system32\ 70tovmto.ini
C:\WINDOWS\system32\ ezstub.exe
C:\WINDOWS\system32\ gah95on6.ini



Have a look here for some performance tips. Things like QuickTime, iTunes and iPod services don’t need to start everytime you boot up.


Your log is now clean. Any more problems? If not we’ll just tidy up and I’ll let you go, along with my recommendations for staying safe and secure.


Reset Hidden/System Files
To reset your hidden and system files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.


System Restore
To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.



IMPORTANT!!!
Please ensure that Windows is patched against the WMF exploit. This is a dangerous vulnerability that opens the door to multiple infections. Visit Window's Update to get the KB912919 patch if you have not already done so.



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree
SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen.


MVPS Hosts File
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera


Firewalls
A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Sygate Personal Firewall
ZoneAlarm
Tiny Personal Firewall


Anti Virus Software
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are two very good free Antivirus products which are available:
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection
Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

How Did I Get Infected In The First Place?
The Anti-Spyware Tutorial.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.

PC Safety & Security::PC running a bit slow?::Photographers Corner

Glaswegian is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 01:14 PM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts