Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

kmka1992

11 Posts

1672

December 1st, 2007 17:00

Control panel is gone ;a popup "Warning! Potential Spyware Operation", No admin rights.

Logfile of HijackThis v1.99.1
Scan saved at 2:28:30 PM, on 12/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\timoty.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Dad\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\msanton.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\timoty.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [froody] C:\WINDOWS\system32\timoty.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: setings.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: startup.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195831141830
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\skuns.dat
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
 

bamajim

10.4K Posts

December 3rd, 2007 15:00


kmka1992

You are running Hijackthis from a temp location. Hijackthis creates backups that we may need, which could get easily lost or deleted from a temp location, so.

Please download HJT Installer from Here to your desktop.
If not available use this alternate link: Here
  • Double click on the HJTInstall.exe.
    at the next window Select Install.
    It will be installed by default here: C:\Program Files\Trend Micro\HijackThis.
    A shortcut to the application will also be placed on your Desktop.
    The program will open automatically after installation.
    Select " Do a system scan and save logfile"
    It will open in Notepad. save it to your Desktop
    Before closing HJT, please click on the AnalyzeThis button. "Analyze This" is for use by TrendMicro, and DOES NOT mean "Analyze My Log". You will need to post your log on the Hijackthis Board.
    Close the web page that appears and then close the program.
    Open the Hijackthis log you saved to your desktop and copy and paste the results as a reply to this thread.
    Use the Hijackthis shortcut to run future scans.



















Microsoft MVP Windows-Security



"The world is what you make of it"





kmka1992

11 Posts

December 3rd, 2007 21:00

Sorry, Here's the new file.  Thanks in Advance.
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:54:16 PM, on 12/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\msanton.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\msanton.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\timoty.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [froody] C:\WINDOWS\system32\timoty.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-21-2828813130-818185961-2316869826-1008\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" (User 'M&D Non-admin')
O4 - HKUS\S-1-5-21-2828813130-818185961-2316869826-1008\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'M&D Non-admin')
O4 - HKUS\S-1-5-21-2828813130-818185961-2316869826-1008\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler (User 'M&D Non-admin')
O4 - HKUS\S-1-5-21-2828813130-818185961-2316869826-1008\..\Run: [froody] C:\WINDOWS\system32\timoty.exe (User 'M&D Non-admin')
O4 - HKUS\S-1-5-21-2828813130-818185961-2316869826-1008\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'M&D Non-admin')
O4 - HKUS\S-1-5-21-2828813130-818185961-2316869826-1008\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'M&D Non-admin')
O4 - HKUS\S-1-5-21-2828813130-818185961-2316869826-1008\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User 'M&D Non-admin')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-21-2828813130-818185961-2316869826-1008 Startup: setings.exe (User 'M&D Non-admin')
O4 - S-1-5-21-2828813130-818185961-2316869826-1008 User Startup: setings.exe (User 'M&D Non-admin')
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: setings.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: startup.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195831141830
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\skuns.dat
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
--
End of file - 12303 bytes

bamajim

10.4K Posts

December 4th, 2007 18:00


kmka1992

1. Go HERE and download FakeAlertFix

Save it to your Desktop. But do not run it yet.

2. Reboot into Safe Mode
This can be done by
  • Restart your PC, and after it starts, but before you see the Windows Splash screen
    Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
    Use your arrow keys and select Safe Mode and then Enter



3. Run FakeAlertFix
  • Double click the fakealertfix.Zip file to unzip it.
    Open the FakeAlertFix Folder
    Double Click FakeAlertFix.vbe to run the program
    Then Select O.K. at the prompt
    Allow the program to run
    When it is finished it wil produce a log C:\FakeAlertFix.txt
    Copy and paste the results of that log in your reply







4. Then reboot your PC into Normal Windows Mode->> Rerun Hijackthis and post a fresh Hiajckthis log.
As well as the C:\FakeAlertfix.txt log

Note: you may have to post the results in more than one reply



















Microsoft MVP Windows-Security



"The world is what you make of it"





kmka1992

11 Posts

December 4th, 2007 22:00

========================================
FakeAlertFix
Version 1.5.0
By bamajim @ CastleCops.com
========================================
C:\WINDOWS\system32\msanton.exe Found!
C:\WINDOWS\system32\msanton.exe Deleted!
========================================
Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\America Online 9.0\waol.exe
C:\WINDOWS\system32\sessmgr.exe
C:\WINDOWS\system32\usmt\migwiz.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\WINDOWS\noskrnl.exe
C:\WINDOWS\system32\mmc.exe

****** Files in System32\Drivers ******
c:\windows\system32\drivers\1028_dell_dim_de051.mrk
c:\windows\system32\drivers\abp480n5.sys
c:\windows\system32\drivers\acpi.sys
c:\windows\system32\drivers\acpiec.sys
c:\windows\system32\drivers\adpu160m.sys
c:\windows\system32\drivers\aec.sys
c:\windows\system32\drivers\afd.sys
c:\windows\system32\drivers\agp440.sys
c:\windows\system32\drivers\agpcpq.sys
c:\windows\system32\drivers\aha154x.sys
c:\windows\system32\drivers\aic78u2.sys
c:\windows\system32\drivers\aic78xx.sys
c:\windows\system32\drivers\aliide.sys
c:\windows\system32\drivers\alim1541.sys
c:\windows\system32\drivers\amdagp.sys
c:\windows\system32\drivers\amdk6.sys
c:\windows\system32\drivers\amdk7.sys
c:\windows\system32\drivers\amsint.sys
c:\windows\system32\drivers\arp1394.sys
c:\windows\system32\drivers\asc.sys
c:\windows\system32\drivers\asc3350p.sys
c:\windows\system32\drivers\asc3550.sys
c:\windows\system32\drivers\asctrm.sys
c:\windows\system32\drivers\asyncmac.sys
c:\windows\system32\drivers\atapi.sys
c:\windows\system32\drivers\atmarpc.sys
c:\windows\system32\drivers\atmepvc.sys
c:\windows\system32\drivers\atmlane.sys
c:\windows\system32\drivers\atmuni.sys
c:\windows\system32\drivers\audstub.sys
c:\windows\system32\drivers\awrtpd.sys
c:\windows\system32\drivers\awrtrd.sys
c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\bridge.sys
c:\windows\system32\drivers\cbidf2k.sys
c:\windows\system32\drivers\ccdecode.sys
c:\windows\system32\drivers\cd20xrnt.sys
c:\windows\system32\drivers\cdaudio.sys
c:\windows\system32\drivers\cdfs.sys
c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\drivers\cinemst2.sys
c:\windows\system32\drivers\classpnp.sys
c:\windows\system32\drivers\cmdide.sys
c:\windows\system32\drivers\cpqarray.sys
c:\windows\system32\drivers\cpqdap01.sys
c:\windows\system32\drivers\crusoe.sys
c:\windows\system32\drivers\dac2w2k.sys
c:\windows\system32\drivers\dac960nt.sys
c:\windows\system32\drivers\dccam.sys
c:\windows\system32\drivers\dcfpoint.sys
c:\windows\system32\drivers\dcfs2k.sys
c:\windows\system32\drivers\dclps.sys
c:\windows\system32\drivers\dcptp.sys
c:\windows\system32\drivers\del200f.cty
c:\windows\system32\drivers\disk.sys
c:\windows\system32\drivers\diskdump.sys
c:\windows\system32\drivers\dmboot.sys
c:\windows\system32\drivers\dmio.sys
c:\windows\system32\drivers\dmload.sys
c:\windows\system32\drivers\dmusic.sys
c:\windows\system32\drivers\dpti2o.sys
c:\windows\system32\drivers\drmk.sys
c:\windows\system32\drivers\drmkaud.sys
c:\windows\system32\drivers\drvmcdb.sys
c:\windows\system32\drivers\drvnddm.sys
c:\windows\system32\drivers\dsunidrv.sys
c:\windows\system32\drivers\dxapi.sys
c:\windows\system32\drivers\dxg.sys
c:\windows\system32\drivers\dxgthk.sys
c:\windows\system32\drivers\e100b325.sys
c:\windows\system32\drivers\eplpdx02.sys
c:\windows\system32\drivers\exportit.sys
c:\windows\system32\drivers\fastfat.sys
c:\windows\system32\drivers\fdc.sys
c:\windows\system32\drivers\fips.sys
c:\windows\system32\drivers\flpydisk.sys
c:\windows\system32\drivers\fltmgr.sys
c:\windows\system32\drivers\fsvga.sys
c:\windows\system32\drivers\fs_rec.sys
c:\windows\system32\drivers\ftdisk.sys
c:\windows\system32\drivers\gearaspiwdm.sys
c:\windows\system32\drivers\gm.dls
c:\windows\system32\drivers\gmreadme.txt
c:\windows\system32\drivers\hidclass.sys
c:\windows\system32\drivers\hidparse.sys
c:\windows\system32\drivers\hidusb.sys
c:\windows\system32\drivers\hpn.sys
c:\windows\system32\drivers\hsfhwbs2.sys
c:\windows\system32\drivers\hsf_cnxt.sys
c:\windows\system32\drivers\hsf_dp.sys
c:\windows\system32\drivers\http.sys
c:\windows\system32\drivers\i2omgmt.sys
c:\windows\system32\drivers\i2omp.sys
c:\windows\system32\drivers\i8042prt.sys
c:\windows\system32\drivers\ialmnt5.sys
c:\windows\system32\drivers\imapi.sys
c:\windows\system32\drivers\ini910u.sys
c:\windows\system32\drivers\intelide.sys
c:\windows\system32\drivers\intelppm.sys
c:\windows\system32\drivers\ip6fw.sys
c:\windows\system32\drivers\ipfltdrv.sys
c:\windows\system32\drivers\ipinip.sys
c:\windows\system32\drivers\ipnat.sys
c:\windows\system32\drivers\ipsec.sys
c:\windows\system32\drivers\iqvw32.sys
c:\windows\system32\drivers\irenum.sys
c:\windows\system32\drivers\isapnp.sys
c:\windows\system32\drivers\kbdclass.sys
c:\windows\system32\drivers\kbdhid.sys
c:\windows\system32\drivers\kmixer.sys
c:\windows\system32\drivers\kodakccs.exe
c:\windows\system32\drivers\ks.sys
c:\windows\system32\drivers\ksecdd.sys
c:\windows\system32\drivers\mcd.sys
c:\windows\system32\drivers\mdmxsdk.sys
c:\windows\system32\drivers\mf.sys
c:\windows\system32\drivers\mfeavfk.sys
c:\windows\system32\drivers\mfebopk.sys
c:\windows\system32\drivers\mfehidk.sys
c:\windows\system32\drivers\mferkdk.sys
c:\windows\system32\drivers\mfesmfk.sys
c:\windows\system32\drivers\mnmdd.sys
c:\windows\system32\drivers\modem.sys
c:\windows\system32\drivers\modemcsa.sys
c:\windows\system32\drivers\mouclass.sys
c:\windows\system32\drivers\mountmgr.sys
c:\windows\system32\drivers\mpfp.sys
c:\windows\system32\drivers\mraid35x.sys
c:\windows\system32\drivers\mrxdav.sys
c:\windows\system32\drivers\mrxsmb.sys
c:\windows\system32\drivers\msfs.sys
c:\windows\system32\drivers\msgpc.sys
c:\windows\system32\drivers\mskssrv.sys
c:\windows\system32\drivers\mspclock.sys
c:\windows\system32\drivers\mspqm.sys
c:\windows\system32\drivers\mssmbios.sys
c:\windows\system32\drivers\mstee.sys
c:\windows\system32\drivers\mup.sys
c:\windows\system32\drivers\nabtsfec.sys
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\drivers\ndisip.sys
c:\windows\system32\drivers\ndistapi.sys
c:\windows\system32\drivers\ndisuio.sys
c:\windows\system32\drivers\ndiswan.sys
c:\windows\system32\drivers\ndproxy.sys
c:\windows\system32\drivers\netbios.sys
c:\windows\system32\drivers\netbt.sys
c:\windows\system32\drivers\nic1394.sys
c:\windows\system32\drivers\nikedrv.sys
c:\windows\system32\drivers\nmnt.sys
c:\windows\system32\drivers\npfs.sys
c:\windows\system32\drivers\nsdriver.sys
c:\windows\system32\drivers\ntfs.sys
c:\windows\system32\drivers\null.sys
c:\windows\system32\drivers\nv4_mini.sys
c:\windows\system32\drivers\nwlnkflt.sys
c:\windows\system32\drivers\nwlnkfwd.sys
c:\windows\system32\drivers\nwlnkipx.sys
c:\windows\system32\drivers\nwlnknb.sys
c:\windows\system32\drivers\nwlnkspx.sys
c:\windows\system32\drivers\oprghdlr.sys
c:\windows\system32\drivers\p3.sys
c:\windows\system32\drivers\parport.sys
c:\windows\system32\drivers\partmgr.sys
c:\windows\system32\drivers\parvdm.sys
c:\windows\system32\drivers\pci.sys
c:\windows\system32\drivers\pciide.sys
c:\windows\system32\drivers\pciidex.sys
c:\windows\system32\drivers\pcmcia.sys
c:\windows\system32\drivers\perc2.sys
c:\windows\system32\drivers\perc2hib.sys
c:\windows\system32\drivers\pixmcva.sys
c:\windows\system32\drivers\pixmcvc.sys
c:\windows\system32\drivers\pixmcvv.sys
c:\windows\system32\drivers\portcls.sys
c:\windows\system32\drivers\processr.sys
c:\windows\system32\drivers\psched.sys
c:\windows\system32\drivers\ptilink.sys
c:\windows\system32\drivers\pxhelp20.sys
c:\windows\system32\drivers\ql1080.sys
c:\windows\system32\drivers\ql10wnt.sys
c:\windows\system32\drivers\ql12160.sys
c:\windows\system32\drivers\ql1240.sys
c:\windows\system32\drivers\ql1280.sys
c:\windows\system32\drivers\rasacd.sys
c:\windows\system32\drivers\rasl2tp.sys
c:\windows\system32\drivers\raspppoe.sys
c:\windows\system32\drivers\raspptp.sys
c:\windows\system32\drivers\raspti.sys
c:\windows\system32\drivers\rawwan.sys
c:\windows\system32\drivers\rdbss.sys
c:\windows\system32\drivers\rdpcdd.sys
c:\windows\system32\drivers\rdpdr.sys
c:\windows\system32\drivers\rdpwd.sys
c:\windows\system32\drivers\redbook.sys
c:\windows\system32\drivers\rio8drv.sys
c:\windows\system32\drivers\riodrv.sys
c:\windows\system32\drivers\rmcast.sys
c:\windows\system32\drivers\rndismp.sys
c:\windows\system32\drivers\rootmdm.sys
c:\windows\system32\drivers\scsiport.sys
c:\windows\system32\drivers\sdbus.sys
c:\windows\system32\drivers\secdrv.sys
c:\windows\system32\drivers\senfilt.sys
c:\windows\system32\drivers\serenum.sys
c:\windows\system32\drivers\serial.sys
c:\windows\system32\drivers\sffdisk.sys
c:\windows\system32\drivers\sffp_sd.sys
c:\windows\system32\drivers\sfloppy.sys
c:\windows\system32\drivers\sisagp.sys
c:\windows\system32\drivers\slip.sys
c:\windows\system32\drivers\smclib.sys
c:\windows\system32\drivers\smwdm.sys
c:\windows\system32\drivers\sonydcam.sys
c:\windows\system32\drivers\sparrow.sys
c:\windows\system32\drivers\splitter.sys
c:\windows\system32\drivers\sr.sys
c:\windows\system32\drivers\srv.sys
c:\windows\system32\drivers\sscdbhk5.sys
c:\windows\system32\drivers\ssrtln.sys
c:\windows\system32\drivers\stream.sys
c:\windows\system32\drivers\streamip.sys
c:\windows\system32\drivers\swenum.sys
c:\windows\system32\drivers\swmidi.sys
c:\windows\system32\drivers\symc810.sys
c:\windows\system32\drivers\symc8xx.sys
c:\windows\system32\drivers\sym_hi.sys
c:\windows\system32\drivers\sym_u3.sys
c:\windows\system32\drivers\sysaudio.sys
c:\windows\system32\drivers\tape.sys
c:\windows\system32\drivers\tcpip.sys
c:\windows\system32\drivers\tcpip6.sys
c:\windows\system32\drivers\tdi.sys
c:\windows\system32\drivers\tdpipe.sys
c:\windows\system32\drivers\tdtcp.sys
c:\windows\system32\drivers\termdd.sys
c:\windows\system32\drivers\tosdvd.sys
c:\windows\system32\drivers\toside.sys
c:\windows\system32\drivers\tsbvcap.sys
c:\windows\system32\drivers\tunmp.sys
c:\windows\system32\drivers\udfs.sys
c:\windows\system32\drivers\ultra.sys
c:\windows\system32\drivers\update.sys
c:\windows\system32\drivers\usb8023.sys
c:\windows\system32\drivers\usbcamd.sys
c:\windows\system32\drivers\usbcamd2.sys
c:\windows\system32\drivers\usbccgp.sys
c:\windows\system32\drivers\usbd.sys
c:\windows\system32\drivers\usbehci.sys
c:\windows\system32\drivers\usbhub.sys
c:\windows\system32\drivers\usbintel.sys
c:\windows\system32\drivers\usbport.sys
c:\windows\system32\drivers\usbscan.sys
c:\windows\system32\drivers\usbstor.sys
c:\windows\system32\drivers\usbuhci.sys
c:\windows\system32\drivers\vdmindvd.sys
c:\windows\system32\drivers\vga.sys
c:\windows\system32\drivers\viaagp.sys
c:\windows\system32\drivers\viaide.sys
c:\windows\system32\drivers\videoprt.sys
c:\windows\system32\drivers\volsnap.sys
c:\windows\system32\drivers\wanarp.sys
c:\windows\system32\drivers\wdmaud.sys
c:\windows\system32\drivers\wmilib.sys
c:\windows\system32\drivers\wpdusb.sys
c:\windows\system32\drivers\ws2ifsl.sys
c:\windows\system32\drivers\wstcodec.sys

kmka1992

11 Posts

December 4th, 2007 22:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:15 PM, on 12/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\startup.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\msanton.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\timoty.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [froody] C:\WINDOWS\system32\timoty.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: setings.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: startup.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195831141830
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
--
End of file - 10926 bytes

bamajim

10.4K Posts

December 4th, 2007 23:00


kmka1992

1. Please download the Killbox.
  • 1)Save it to the desktop
    2) Rt Click->>Extract all->.Extract it to your Desktop
    3) Double Click Killbox.exe to run it
    4)Select " Delete on Reboot", and then select "All files".
    5) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

    • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\startup.exe


    6) Return to Killbox, go to the File menu, and choose " Paste from Clipboard".
    7) Click the red-and-white " Delete File" button.  Click " Yes" at the Delete on Reboot prompt.








2. Rerun Hijackthis (scan only) and place checks beside the following entries
  • F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\msanton.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\timoty.exe
    O4 - HKCU\..\Run: [froody] C:\WINDOWS\system32\timoty.exe
    O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Startup: setings.exe
    O4 - Global Startup: startup.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

Close all other open windows except Hijackthis and Select " Fix checked"

Close Hijackthis ->> Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log





















Microsoft MVP Windows-Security



"The world is what you make of it"





kmka1992

11 Posts

December 5th, 2007 23:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:15:49 PM, on 12/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\msanton.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\msanton.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\timoty.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [froody] C:\WINDOWS\system32\timoty.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: setings.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: startup.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195831141830
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
--
End of file - 10699 bytes

bamajim

10.4K Posts

December 6th, 2007 00:00

kmka1992

Please download Combofix and save to your desktop:
  • Note: It is important that it is saved directly to your desktop
    Close any open browsers.
    Double click on combofix.exe and follow the prompts.
    When it's finished it will produce a log.
    Post the contents of the C:\ComboFix.txt into your next reply.
    Note: Do not mouseclick combofix's window whilst it's running.
    That may cause the program to freeze/hang.













Microsoft MVP Windows-Security



"The world is what you make of it"





kmka1992

11 Posts

December 6th, 2007 01:00

ComboFix 07-12-05.2 - Dad 2007-12-05 22:07:02.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.546 [GMT -5:00]
Running from: C:\Documents and Settings\Dad\Desktop\ComboFix.exe
 * Created a new restore point
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\smbols~1
C:\Program Files\smbols~1\s?mbols\
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\f02WtR
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_POOF
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2

(((((((((((((((((((((((((   Files Created from 2007-11-06 to 2007-12-06  )))))))))))))))))))))))))))))))
.
2007-12-04 19:18 . 2007-11-22 08:22 6,144 --a------ C:\WINDOWS\system32\msanton.exe
2007-12-02 22:08 .     C:\Documents and Settings\M2007-12-02  22:08              D Non-admin\Application Data\Move Networks
2007-12-02 15:08 .     C:\Documents and Settings\M2007-12-02  15:08              D Non-admin\Application Data\SUPERAntiSpyware.com
2007-11-29 17:06 .     C:\Documents and Settings\M2007-11-29  17:06              D Non-admin\Application Data\Corel
2007-11-28 07:46 .     C:\Documents and Settings\M2007-11-28  07:46              D Non-admin\Application Data\Adobe
2007-11-28 07:45 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-28 07:45 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-27 11:34 .     C:\Documents and Settings\M2007-11-27  11:34              D Non-admin\Application Data\Macromedia
2007-11-27 11:34 .     C:\Documents and Settings\M2007-11-27  11:34              D Non-admin\Application Data\Google
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Templates
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Start Menu
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\SendTo
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Recent
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\PrintHood
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\NetHood
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\My Documents
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Local Settings
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Favorites
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Desktop
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Cookies
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Application Data\Sun
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Application Data\SiteAdvisor
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Application Data\Microsoft
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Application Data\InstallShield
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Application Data\Identities
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Application Data\GTek
2007-11-27 11:33 .     C:\Documents and Settings\M2007-11-27  11:33              D Non-admin\Application Data
2007-11-27 11:33 .  1,310,720  C:\Documents and Settings\M2007-11-27  11:33         1,310,720 D Non-admin\NTUSER.DAT
2007-11-27 11:01 . 2007-11-27 11:01   d-------- C:\WINDOWS\system32\NtmsData
2007-11-27 09:45 . 2007-11-27 09:46   d-------- C:\WINDOWS\ERUNT
2007-11-27 09:26 . 2007-11-27 09:26 3,368 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-23 11:07 . 2007-12-02 15:08   d-------- C:\Program Files\SUPERAntiSpyware
2007-11-23 11:07 . 2007-11-23 11:07   d-------- C:\Documents and Settings\Dad\Application Data\SUPERAntiSpyware.com
2007-11-23 11:07 . 2007-11-23 11:07   d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-23 10:28 . 2007-11-23 10:28   d-------- C:\Documents and Settings\Dad\Application Data\McAfee
2007-11-23 09:53 . 2007-11-23 09:53   d-------- C:\Program Files\Lavasoft
2007-11-23 09:53 . 2007-11-23 09:53   d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-23 09:52 . 2007-11-23 11:06   d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-23 09:47 . 2007-11-22 08:22 6,144 --a------ C:\WINDOWS\system32\timoty.exe
2007-11-23 09:20 . 2007-12-05 22:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-23 09:20 . 2007-11-23 09:20 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-23 09:13 . 2007-11-23 09:13   d-------- C:\Documents and Settings\Kids account\Application Data\SiteAdvisor
2007-11-23 09:02 . 2007-11-23 09:03   d-------- C:\Program Files\QuickTime
2007-11-14 23:43 . 2007-11-14 23:43 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2007-11-14 23:43 . 2007-11-14 23:43 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts
2007-11-13 22:13 . 2007-11-13 22:13 244 --a------ C:\WINDOWS\system32\MRT.INI
2007-11-13 21:52 . 2007-10-25 22:36 8,454,656 --a------ C:\WINDOWS\system32\SET4B.tmp
2007-11-13 21:52 . 2007-10-29 05:26 115,712 --a------ C:\WINDOWS\system32\SET4C.tmp
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-05 20:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-12-03 23:53 --------- d-----w C:\Program Files\Trend Micro
2007-12-03 03:08 --------- d-----w C:\Documents and Settings\M&D Non-admin\Application Data\Move Networks
2007-12-02 20:08 --------- d-----w C:\Documents and Settings\M&D Non-admin\Application Data\SUPERAntiSpyware.com
2007-11-29 22:06 --------- d-----w C:\Documents and Settings\M&D Non-admin\Application Data\Corel
2007-11-28 12:51 --------- d-----w C:\Documents and Settings\M&D Non-admin\Application Data\SiteAdvisor
2007-11-27 16:33 --------- d-----w C:\Documents and Settings\M&D Non-admin\Application Data\InstallShield
2007-11-27 16:33 --------- d-----w C:\Documents and Settings\M&D Non-admin\Application Data\GTek
2007-11-23 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2007-11-23 14:02 --------- d-----w C:\Program Files\Apple Software Update
2007-11-22 15:38 --------- d-----w C:\Documents and Settings\Dad\Application Data\SiteAdvisor
2007-11-22 01:17 --------- d-----w C:\Program Files\McAfee
2007-11-17 03:52 --------- d-----w C:\Program Files\Common Files\aolback
2007-11-17 03:47 --------- d-----w C:\Program Files\Windows Defender
2007-11-17 03:47 --------- d-----w C:\Program Files\Wal-Mart Music Downloads Store
2007-11-17 03:47 --------- d-----w C:\Program Files\USA Bass
2007-11-17 03:47 --------- d-----w C:\Program Files\sz8058
2007-11-17 03:47 --------- d-----w C:\Program Files\PartyGaming
2007-11-17 03:46 --------- d-----w C:\Program Files\NetWaiting
2007-11-17 03:46 --------- d-----w C:\Program Files\Modem Helper
2007-11-17 03:46 --------- d-----w C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-11-17 03:46 --------- d-----w C:\Program Files\Microsoft Plus! Digital Media Edition
2007-11-17 03:46 --------- d-----w C:\Program Files\Kuma Games
2007-11-17 03:46 --------- d-----w C:\Program Files\John Deere American Farmer
2007-11-17 03:46 --------- d-----w C:\Program Files\iTunes
2007-11-17 03:46 --------- d-----w C:\Program Files\Impossible Golf
2007-11-17 03:46 --------- d-----w C:\Program Files\Hunting Unlimited
2007-11-17 03:46 --------- d-----w C:\Program Files\Google
2007-11-17 03:46 --------- d-----w C:\Program Files\GCC32
2007-11-17 03:46 --------- d-----w C:\Program Files\Fighter Ace 3.5
2007-11-17 03:46 --------- d-----w C:\Program Files\Digital Line Detect
2007-11-17 03:46 --------- d-----w C:\Program Files\DellSupport
2007-11-17 03:33 --------- d-----w C:\Program Files\sz8036
2007-11-10 17:02 --------- d-----w C:\Program Files\Common Files\McAfee
2006-07-11 22:00 56 --sh--r C:\WINDOWS\system32\97E3C39B87.sys
2007-08-20 14:31 1,598,458 --sh--w C:\WINDOWS\system32\ijkkj.bak1
2006-07-11 22:00 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-23 00:49 6,513 --sh--w C:\WINDOWS\system32\oqtss.bak1
2007-08-21 13:19 6,513 --sh--w C:\WINDOWS\system32\pqtwa.bak1
2007-08-23 14:38 1,589,852 --sh--w C:\WINDOWS\system32\qtvwa.bak1
2007-08-24 23:28 1,604,684 --sh--w C:\WINDOWS\system32\qtvwa.bak2
2007-08-22 02:48 1,589,471 --sh--w C:\WINDOWS\system32\ttstv.bak1
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 21:57]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
"froody"="C:\WINDOWS\system32\timoty.exe" [2007-11-22 08:22]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 20:42]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 04:40]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 02:02]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-01-16 12:24]
"Ink Monitor"="C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe" [2001-10-16 13:10]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-03-30 10:42]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 19:15]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"version"="C:\WINDOWS\system32\timoty.exe" [2007-11-22 08:22]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38]
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
setings.exe [2007-11-22 08:22:43]
C:\Documents and Settings\Kids account\Start Menu\Programs\Startup\
setings.exe [2007-11-22 08:22:43]
C:\Documents and Settings\M&D Non-admin\Start Menu\Programs\Startup\
setings.exe [2007-11-22 08:22:43]
C:\Documents and Settings\Dad\Start Menu\Programs\Startup\
setings.exe [2007-11-22 08:22:43]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-12-11 09:02:08]
EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2006-01-30 18:35:51]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2005-07-22 02:47:22]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 13:12:08]
startup.exe [2007-11-22 08:22:43]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 1 (0x1)
"DisableTaskMgr"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 1 (0x1)
"DisableTaskMgr"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoControlPanel"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoControlPanel"= 1 (0x1)
"NoWindowsUpdate"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
S3 PIXMCV;JVC Communication PIX-MCV Driver;C:\WINDOWS\system32\Drivers\pixmcvc.sys
S3 PIXMCVA;JVC PIX-MCV Audio Capture;C:\WINDOWS\system32\Drivers\pixmcva.sys
S3 PIXMCVV;JVC PIX-MCV Video Capture;C:\WINDOWS\system32\Drivers\pixmcvv.sys
.
Contents of the 'Scheduled Tasks' folder
"2007-11-23 14:02:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-17 05:40:26 C:\WINDOWS\Tasks\McDefragTask.job"
- C:\Program Files\McAfee\MQC\QcConsol.exe'
"2007-08-23 01:34:33 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2007-12-06 03:20:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-19 13:02:33 C:\WINDOWS\Tasks\quickclean.job"
- C:\Program Files\McAfee\MQC\QcConsol.exe
.
**************************************************************************
catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 22:18:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-12-05 22:21:01 - machine was rebooted
.
 --- E O F ---

bamajim

10.4K Posts

December 6th, 2007 13:00


kmka1992

I need you to help us out with some research

Please go HERE

Put Your Name, and Dell HJT forum

and In the file to submit box, click Browse.Using Windows Explorer
  • (Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)
Locate the files (Put one in each submission box)
  • C:\WINDOWS\system32\msanton.exe
    C:\WINDOWS\system32\timoty.exe

In the comments tell them that I asked you to upload the files
Then Select Send Files.

Once I receive the files, then we will get your PC cleaned up























Microsoft MVP Windows-Security



"The world is what you make of it"





bamajim

10.4K Posts

December 7th, 2007 19:00

kmka1992

Let's ee if we can get some relief.

1. Go HERE and download FakeAlertFix

Save it to your Desktop. But do not run it yet.

2. Reboot into Safe Mode
This can be done by
  • Restart your PC, and after it starts, but before you see the Windows Splash screen
    Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
    Use your arrow keys and select Safe Mode and then Enter



3. Run FakeAlertFix (close all IExplorere windows before you run it)
  • Double click the fakealertfix.Zip file to unzip it.
    Open the FakeAlertFix Folder
    Double Click FakeAlertFix.vbe to run the program
    Then Select O.K. at the prompt
    Allow the program to run (it will appear that nothing is happening for about 45 seconds)
    When it is finished it wil produce a log C:\FakeAlertFix.txt
    Copy and paste the results of that log in your reply







4. Then reboot your PC into Normal Windows Mode->> Rerun Hijackthis and post a fresh Hijackthis log.
As well as the C:\FakeAlertfix.txt log

Note: you may have to post the results in more than one reply

























Microsoft MVP Windows-Security



"The world is what you make of it"






Message Edited by bamajim on 12-07-2007 03:33 PM

kmka1992

11 Posts

December 7th, 2007 19:00

The two files were uploaded.   I'm losing more and more access to my computer.  I had to boot in safe mode to  search my c drive!  I've lost privliges to the task manager!!   Thanks for your help in advances!!   This is driving my Nutz!!!

kmka1992

11 Posts

December 8th, 2007 18:00

I'm posting from a differrent computer.   It seems that I lost access rights to log on to my computer.  Any way I can reset permissons to get back in?

bamajim

10.4K Posts

December 10th, 2007 12:00

kmka1992
 
Are you unable to log in in either Normal or Safe Mode?
 
And if so which one?
 
And if not, what happens when you try to?
 



Microsoft MVP Windows-Security



"The world is what you make of it"



kmka1992

11 Posts

December 11th, 2007 13:00

I get access denied in both safe and regular modes.  Is there a way I can boot with out permissions?   Can I re install the Win XP with out cleaning my c:| Drive??

Was this post helpful?

View All

No Events found!

Top