Im having problems with yahoomessenger when i login it automatically opens a chat window to an online user even if i didnt click on the icon. plus when i type a message to the person, i couldn't see the message i typed.
as for the other issue which is two instances of avp.exe i did a research and it was said that it is normal.
Deckard's System Scanner v20071014.68
Run by James Ventura on 2008-06-09 15:36:36
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
9: 2008-06-09 07:38:06 UTC - RP276 - Deckard's System Scanner Restore Point
8: 2008-06-09 02:55:39 UTC - RP275 - Installed Kaspersky Internet Security 7.0.
7: 2008-06-08 21:33:54 UTC - RP274 - System Checkpoint
6: 2008-06-07 16:42:32 UTC - RP273 - Installed QuickTime
5: 2008-06-05 22:23:44 UTC - RP272 - System Checkpoint
-- First Restore Point --
1: 2008-06-02 08:18:09 UTC - RP268 - Removed Kaspersky Anti-Virus 6.0.
Backed up registry hives.
Performed disk cleanup.
Total Physical Memory: 256 MiB (512 MiB recommended).
System Drive C: has 0.09 GiB (less than 15%) free.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-09 15:43:24
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\LEXBCES.EXE
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\WINDOWS\SYSTEM32\LEXPPS.EXE
C:\WINDOWS\SYSTEM32\atievxx.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Documents and Settings\James Ventura\Desktop\dss.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\SYSTEM32\taskmgr.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Cole2k Media Toolbar Helper - {5499BCB1-5641-4A4C-9F75-462D4D8D0DA0} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Cole2k Media Toolbar - {8AE33802-00D3-4F1B-B5C7-6FEE34E402CE} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - Global Startup: HotSync Manager.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\nwprovau.dll
O15 - ProtocolDefaults: Unknown 'about' protocol is in My Computer Zone (HKLM)
O15 - ProtocolDefaults: Unknown 'about:' protocol is in My Computer Zone (HKLM)
O15 - ProtocolDefaults: Unknown 'mhtml' protocol is in My Computer Zone (HKLM)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINDOWS\wc98pp.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\SYSTEM32\LEXBCES.EXE
--
End of file - 4701 bytes
-- File Associations -----------------------------------------------------------
.bat - batfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,-153
.com - comfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,2
.hlp - hlpfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,23
.ini - GetDiz.Document - DefaultIcon - unable to read value
.ini - GetDiz.Document - shell\open\command - "C:\Program Files\GetDiz\GetDiz.exe" "%1"
.js - JSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,5
.reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
.txt - GetDiz.Document - DefaultIcon - unable to read value
.txt - GetDiz.Document - shell\open\command - "C:\Program Files\GetDiz\GetDiz.exe" "%1"
.vbs - VBSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,4
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R3 ltmodem5 (Agere Modem Driver) - c:\windows\system32\drivers\ltmdmnt.sys <Not Verified; Agere Systems; Agere V.92 Data+Fax Modem Version 8.30>
S0 Cdr4vsd - c:\windows\system32\drivers\cdr4vsd.sys <Not Verified; Adaptec; Adaptec's CD-R Helper Drivers>
S3 NPPTNT2 - c:\windows\system32\npptnt2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
S3 usb2vcom (DKU-5 Connectivity Adapter Cable) - c:\windows\system32\drivers\usb2vcom.sys <Not Verified; USB World; USB Data Cable>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
All services whitelisted.
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {6BDD1FC5-810F-11D0-BEC7-08002BE2092F}
Description: SMC IrCC - Fast Infrared Port
Device ID: ACPI\SMCF010\5&2920B891&0
Manufacturer: SMC
Name: SMC IrCC - Fast Infrared Port
PNP Device ID: ACPI\SMCF010\5&2920B891&0
Service: SMCIRDA
-- Scheduled Tasks -------------------------------------------------------------
2008-06-09 15:03:00 258 --a------ C:\WINDOWS\Tasks\Uninstall Expiration Reminder.job
2008-06-03 17:44:59 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
-- Files created between 2008-05-09 and 2008-06-09 -----------------------------
2008-06-09 15:20:29 0 dr-h----- C:\Documents and Settings\James Ventura\Recent
2008-06-09 10:04:23 0 dr-h----- C:\Documents and Settings\Henry\Recent
2008-06-07 09:12:25 0 d--h----- C:\ckis
2008-06-04 15:02:13 96966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-06-04 15:02:12 88774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-06-04 14:52:05 3318816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-04 14:52:02 38688 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-04 14:52:01 0 d-------- C:\Program Files\Kaspersky Lab
2008-06-04 14:52:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-04 14:30:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-04 14:15:59 0 d-------- C:\kav
2008-06-03 13:59:32 0 d-------- C:\Program Files\CCleaner
2008-06-03 12:57:31 0 d-------- C:\Documents and Settings\James Ventura\Application Data\AVGTOOLBAR
2008-06-02 18:10:30 0 d-------- C:\Documents and Settings\Henry\Application Data\AVGTOOLBAR
2008-05-28 00:20:44 0 d-------- C:\Program Files\Microsoft.NET
2008-05-28 00:17:39 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-05-28 00:05:56 0 d-------- C:\WINDOWS\SHELLNEW
2008-05-22 12:12:01 0 d-------- C:\WINDOWS\OldPrefetch
2008-05-20 21:23:41 0 d-------- C:\Documents and Settings\Henry\Application Data\Macromedia
-- Find3M Report ---------------------------------------------------------------
2008-06-09 00:17:39 240711 --a------ C:\logfile
2008-06-08 00:48:05 0 d-------- C:\Program Files\QuickTime
2008-06-08 00:28:06 0 d-------- C:\Program Files\Yahoo!
2008-06-07 06:02:53 0 d-------- C:\Program Files\ePrompter
2008-06-04 08:33:12 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-31 23:00:24 60888 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-05-31 22:29:45 0 d-------- C:\Program Files\GetDiz
2008-05-22 18:08:43 0 d-------- C:\Documents and Settings\James Ventura\Application Data\Dev-Cpp
2008-05-20 21:46:55 0 dr------- C:\Program Files\Common Files
2008-05-19 23:01:03 0 d-------- C:\Program Files\MSECACHE
2008-05-14 09:11:30 0 d-------- C:\Program Files\Common Files\Adobe
2008-05-07 13:53:28 0 d-------- C:\Documents and Settings\James Ventura\Application Data\Outertech
2008-04-21 23:53:37 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-21 23:53:34 0 d-------- C:\Program Files\EPSON
2008-04-21 23:52:07 0 d-------- C:\Program Files\VS Revo Group
2008-04-14 16:13:19 0 d-------- C:\Program Files\Rainlendar2
2008-04-13 20:44:37 0 d-------- C:\Documents and Settings\James Ventura\Application Data\dvdcss
2008-04-07 19:19:53 2560 --a------ C:\WINDOWS\system32\bitcometres.dll <Not Verified; BitComet; BitComet BCTP Helper>
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [02/08/2008 06:36 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0 (0x0)
"NoRecentDocsMenu"=0 (0x0)
"NoFavoritesMenu"=0 (0x0)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsNetHood"=0 (0x0)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoInstrumentation"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0 (0x0)
"NoRecentDocsMenu"=0 (0x0)
"NoFavoritesMenu"=0 (0x0)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsHistory]"=0 (0x0)
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsNetHood"=0 (0x0)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoUserNameInStartMenu"=0 (0x0)
"NoInstrumentation"=0 (0x0)
"NoStartMenuPinnedList"=0 (0x0)
"NoSharedDocuments"=0 (0x0)
"MaxRecentDocs"=1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia Tray Application]
C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"EPSON Stylus C45 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.EXE /P23 "EPSON Stylus C45 Series" /O6 "USB001" /M "Stylus C45"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d129f36-d7cd-11dc-8c48-00d0599d0363}]
AutoRun\command- password_viewer.exe %1
Explore\command- password_viewer.exe %1
Open\command- password_viewer.exe %1
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47277d5b-47bb-11dc-8f48-00d0599d0363}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90a6914c-674a-11dc-8ffd-00d0599d0363}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL exiplorer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f90cbc66-d624-11dc-8c43-00d0599d0363}]
0pen\command- F:\krag.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL krag.exe
-- End of Deckard's System Scanner: finished at 2008-06-09 15:48:53 ------------
