C:\Documents and Settings\Em\Local Settings\Temp\HijackThis.exe
When you do so, either HJT will not create its log files and backup files; or if it does, you risk losing them when the TEMP's cache is cleared. It's important that you save these backup files, in case you have to "undo" [restore] some of the things you "FIX" incorrectly.
So you need to move HJT into a separate, non-temporary, non-Desktop, directory of its own. We recommend using the directory C:\HJT , so that it will then appear in your log, under running processes, as C:\HJT\HiJackThis.exe
Note: If you have previously download this file on another occasion, please download it again, to be absolutely sure you have the most current version.
* Save it to your Desktop * Close all running programs (including your Internet Browser) * Double-click VirtumundoBeGone.exe on the desktop * Follow the directions as indicated
please be advised that this program will generate a "BLUE SCREEN OF DEATH"... this is an expected/necessary part of the process, so don't be surprised when it happens.
just reboot if your system "jams"
*********************
After rebooting, it's now time to run FixVundo (which you had downloaded earlier).
Make sure all other programs, including your Internet Browser, are closed.
Double-click the FixVundo.exefile to start the removal tool.
Click Start to begin the process, and then allow this tool to run.
Important: Do not launch any new applications while the tool is running!
Reboot your computer.
Run the FixVundo removal tool again to ensure that the system is clean.
*********************
It's now time to report back to us:
VirtumundoBeGone generated a "log" file of its own, which it should have placed on your Desktop... please REPLY to this thread, and copy/paste the VirtumundoBeGone log back here, along with your latest HJT log.
[11/10/2005, 11:45:15] - Starting Process...
[11/10/2005, 11:45:15] - Looking for Browser Helper Object [MSEvents Object]
[11/10/2005, 11:45:15] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[11/10/2005, 11:45:15] - 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} -
[11/10/2005, 11:45:15] - WARNING: 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} - BHO Name is blank.
[11/10/2005, 11:45:15] - Checking for WinLogon Notify reference. (File: )
[11/10/2005, 11:45:15] - Couldn't find in Winlogon Notify. Ignoring {549B5CA7-4A86-11D7-A4DF-000874180BB3}.
[11/10/2005, 11:45:15] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[11/10/2005, 11:45:15] - 4: {79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A} - MSEvents Object
[11/10/2005, 11:45:15] - Found MSEvents Object!
[11/10/2005, 11:45:15] - File location: C:\WINDOWS\system32\nnnnk.dll
[11/10/2005, 11:45:15] - Attempting to kill C:\WINDOWS\system32\nnnnk.dll
[11/10/2005, 11:45:15] - Terminating Process: RUNDLL32.EXE
[11/10/2005, 11:45:16] - Terminating Process: IEXPLORE.EXE
[11/10/2005, 11:45:16] - Disabling Automatic Shell Restart
[11/10/2005, 11:45:16] - Terminating Process: EXPLORER.EXE
[11/10/2005, 11:45:17] - Suspending the NT Session Manager System Service
[11/10/2005, 11:45:17] - Terminating Windows NT Logon/Logoff Manager
[11/10/2005, 11:45:17] - Re-enabling Automatic Shell Restart
[11/10/2005, 11:45:17] - Renaming C:\WINDOWS\system32\nnnnk.dll -> C:\WINDOWS\system32\nnnnk.dll.vir
[11/10/2005, 11:45:18] - File successfully renamed!
[11/10/2005, 11:45:18] - Removing Registry references to {79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A}
[11/10/2005, 11:45:18] - Adding Internet Explorer Protection (Kill ActiveX) for {79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A}
[11/10/2005, 11:45:18] - Removing Winlogon Notify Entry: nnnnk
[11/10/2005, 11:45:18] - BHO list has been changed! Starting over...
[11/10/2005, 11:45:18] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[11/10/2005, 11:45:18] - 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} -
[11/10/2005, 11:45:18] - WARNING: 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} - BHO Name is blank.
[11/10/2005, 11:45:18] - Checking for WinLogon Notify reference. (File: )
[11/10/2005, 11:45:18] - Couldn't find in Winlogon Notify. Ignoring {549B5CA7-4A86-11D7-A4DF-000874180BB3}.
[11/10/2005, 11:45:18] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[11/10/2005, 11:45:18] - 4: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} -
[11/10/2005, 11:45:18] - WARNING: 4: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - BHO Name is blank.
[11/10/2005, 11:45:19] - Checking for WinLogon Notify reference. (File: )
[11/10/2005, 11:45:19] - Couldn't find in Winlogon Notify. Ignoring {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}.
[11/10/2005, 11:45:19] - Finished searching for [MSEvents Object]
[11/10/2005, 11:45:19] - Finishing up...
[11/10/2005, 11:45:19] - Enabling Automatic Reboot on STOP Error.
[11/10/2005, 11:45:19] - Attempting to Restart via STOP error (Blue Screen!)
-------------
Logfile of HijackThis v1.99.1
Scan saved at 12:11:48 AM, on 11/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Looks like VirtumondeBeGone successfully deactivated the bad WinFixer/Vundo file... have you noticed any difference, in terms of WinFixer popups, and overall system speed/performance?
Next, i'm gonna help you with some minor touch-ups [concerning non-existent files]:
Run HiJackThis. Place a check-mark in the box in front of each of the lines:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
Click on FIX CHECKED. Close HiJackThis. Reboot. And then generate/post another log.
At that point, I'm gonna try to ask someone else to step-in, to determine additional problems (if any) that you might have. Please be advised that we're very "understaffed" at the moment, so I can't make any guarantee as to when (or even if) the next helper will arrive.
Yes, I'm not getting the popups anymore. Thank you so much for helping me.
Logfile of HijackThis v1.99.1 Scan saved at 9:55:02 AM, on 11/11/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Make sure you have System Restore running (toggle it off and On today to get rid of any bad stuff it may have retained) and then you can just go back to an earlier time if you hit a bad site.
One way to make this more obvious is to check everything in your current HijackThis and Add to Ignore List then set up Hijackthis to run at boot and to show you if it finds anything new.
ky331
3 Apprentice
•
15.6K Posts
0
November 10th, 2005 14:00
First: You're running HJT from a TEMP directory:
C:\Documents and Settings\Em\Local Settings\Temp\HijackThis.exe
When you do so, either HJT will not create its log files and backup files; or if it does, you risk losing them when the TEMP's cache is cleared. It's important that you save these backup files, in case you have to "undo" [restore] some of the things you "FIX" incorrectly.
So you need to move HJT into a separate, non-temporary, non-Desktop, directory of its own. We recommend using the directory C:\HJT , so that it will then appear in your log, under running processes, as C:\HJT\HiJackThis.exe
***********
AFTER you move HJT, as i've just instructed:
Download [but do *NOT* yet run] FixVundo from
http://securityresponse.symantec.com/avcenter/FixVundo.exe
[we'll have you run it later]
Note: If you have previously download this file on another occasion, please download it again, to be absolutely sure you have the most current version.
********************
Next, download VirtumundoBeGone from:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
* Save it to your Desktop
* Close all running programs (including your Internet Browser)
* Double-click VirtumundoBeGone.exe on the desktop
* Follow the directions as indicated
please be advised that this program will generate a "BLUE SCREEN OF DEATH"... this is an expected/necessary part of the process, so don't be surprised when it happens.
just reboot if your system "jams"*********************
After rebooting, it's now time to run FixVundo (which you had downloaded earlier).
Make sure all other programs, including your Internet Browser, are closed.
Double-click the FixVundo.exe file to start the removal tool.
Click Start to begin the process, and then allow this tool to run.
Important: Do not launch any new applications while the tool is running!
Reboot your computer.
Run the FixVundo removal tool again to ensure that the system is clean.
*********************
It's now time to report back to us:
VirtumundoBeGone generated a "log" file of its own, which it should have placed on your Desktop... please REPLY to this thread, and copy/paste the VirtumundoBeGone log back here, along with your latest HJT log.
forre011
7 Posts
0
November 10th, 2005 15:00
ky331
3 Apprentice
•
15.6K Posts
0
November 10th, 2005 15:00
forre011
7 Posts
0
November 11th, 2005 04:00
[11/10/2005, 11:45:15] - Starting Process...
[11/10/2005, 11:45:15] - Looking for Browser Helper Object [MSEvents Object]
[11/10/2005, 11:45:15] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[11/10/2005, 11:45:15] - 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} -
[11/10/2005, 11:45:15] - WARNING: 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} - BHO Name is blank.
[11/10/2005, 11:45:15] - Checking for WinLogon Notify reference. (File: )
[11/10/2005, 11:45:15] - Couldn't find in Winlogon Notify. Ignoring {549B5CA7-4A86-11D7-A4DF-000874180BB3}.
[11/10/2005, 11:45:15] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[11/10/2005, 11:45:15] - 4: {79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A} - MSEvents Object
[11/10/2005, 11:45:15] - Found MSEvents Object!
[11/10/2005, 11:45:15] - File location: C:\WINDOWS\system32\nnnnk.dll
[11/10/2005, 11:45:15] - Attempting to kill C:\WINDOWS\system32\nnnnk.dll
[11/10/2005, 11:45:15] - Terminating Process: RUNDLL32.EXE
[11/10/2005, 11:45:16] - Terminating Process: IEXPLORE.EXE
[11/10/2005, 11:45:16] - Disabling Automatic Shell Restart
[11/10/2005, 11:45:16] - Terminating Process: EXPLORER.EXE
[11/10/2005, 11:45:17] - Suspending the NT Session Manager System Service
[11/10/2005, 11:45:17] - Terminating Windows NT Logon/Logoff Manager
[11/10/2005, 11:45:17] - Re-enabling Automatic Shell Restart
[11/10/2005, 11:45:17] - Renaming C:\WINDOWS\system32\nnnnk.dll -> C:\WINDOWS\system32\nnnnk.dll.vir
[11/10/2005, 11:45:18] - File successfully renamed!
[11/10/2005, 11:45:18] - Removing Registry references to {79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A}
[11/10/2005, 11:45:18] - Adding Internet Explorer Protection (Kill ActiveX) for {79A576C4-B7A9-47EC-B57C-2CE5CA6ECC6A}
[11/10/2005, 11:45:18] - Removing Winlogon Notify Entry: nnnnk
[11/10/2005, 11:45:18] - BHO list has been changed! Starting over...
[11/10/2005, 11:45:18] - 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[11/10/2005, 11:45:18] - 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} -
[11/10/2005, 11:45:18] - WARNING: 2: {549B5CA7-4A86-11D7-A4DF-000874180BB3} - BHO Name is blank.
[11/10/2005, 11:45:18] - Checking for WinLogon Notify reference. (File: )
[11/10/2005, 11:45:18] - Couldn't find in Winlogon Notify. Ignoring {549B5CA7-4A86-11D7-A4DF-000874180BB3}.
[11/10/2005, 11:45:18] - 3: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[11/10/2005, 11:45:18] - 4: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} -
[11/10/2005, 11:45:18] - WARNING: 4: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - BHO Name is blank.
[11/10/2005, 11:45:19] - Checking for WinLogon Notify reference. (File: )
[11/10/2005, 11:45:19] - Couldn't find in Winlogon Notify. Ignoring {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}.
[11/10/2005, 11:45:19] - Finished searching for [MSEvents Object]
[11/10/2005, 11:45:19] - Finishing up...
[11/10/2005, 11:45:19] - Enabling Automatic Reboot on STOP Error.
[11/10/2005, 11:45:19] - Attempting to Restart via STOP error (Blue Screen!)
Scan saved at 12:11:48 AM, on 11/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.27.146.52
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://download.windowsupdate.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
ky331
3 Apprentice
•
15.6K Posts
0
November 11th, 2005 13:00
Looks like VirtumondeBeGone successfully deactivated the bad WinFixer/Vundo file... have you noticed any difference, in terms of WinFixer popups, and overall system speed/performance?
Next, i'm gonna help you with some minor touch-ups [concerning non-existent files]:
Run HiJackThis. Place a check-mark in the box in front of each of the lines:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
Click on FIX CHECKED. Close HiJackThis. Reboot. And then generate/post another log.
At that point, I'm gonna try to ask someone else to step-in, to determine additional problems (if any) that you might have. Please be advised that we're very "understaffed" at the moment, so I can't make any guarantee as to when (or even if) the next helper will arrive.
Good luck.
forre011
7 Posts
0
November 11th, 2005 13:00
Yes, I'm not getting the popups anymore. Thank you so much for helping me.
Logfile of HijackThis v1.99.1
Scan saved at 9:55:02 AM, on 11/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.27.146.52
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://download.windowsupdate.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
RKinner
2 Intern
•
5.9K Posts
0
November 11th, 2005 16:00
Log is clean.
Ron
Make sure you have System Restore running (toggle it off and On today to get rid of any bad stuff it may have retained)
and then you can just go back to an earlier time if you hit a bad site.
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/systemrestore.mspx
One way to make this more obvious is to check everything in your current HijackThis and Add to Ignore List then set up Hijackthis to run at boot and to show you if it finds anything new.
To avoid going to a bad site you might want to install IE-SpyAd and SpywareBlaster and make the other changes recommended at:.
http://www.mvps.org/winhelp2002/restricted.htm
I used to recommend Spybot's Immunize system but have recently learned it is not as good as the one at:
http://www.mvps.org/winhelp2002/hosts.htm
Never hurts to do one of the free on line scans from Panda or Trend. They take a while but are pretty good.
www.pandasoftware.com/activescan/activescan.asp?
http://housecall.trendmicro.com/
In addition to Microsoft AntiSpy
http://www.microsoft.com/athome/security/downloads/default.mspx
I like to run Spybot S&D.
http://www.safer-networking.org/en/download/index.html
Also like to run AdAware once in a while.
http://www.lavasoftusa.com/software/adaware/