‎HijackThis Log | DELL Technologies

Start a Conversation

UNSOLVED

spring_time

updated

20 years ago

spring_time

10 Posts

850

December 19th, 2006 11:00

HijackThis Log

Hi, I was wondering if someone would be kind enough to take a look at my log file posted below. My computer has been running slow for a while now and a friend told me that I may have adware/spware and that I should run HijackThis.

Thanks in advance

Logfile of HijackThis v1.99.1
Scan saved at 15:56:52, on 11/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.meshcomputers.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - (no file)
O3 - Toolbar: (no name) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EPSON Stylus D88 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE /P23 "EPSON Stylus D88 Series" /O6 "USB001" /M "Stylus D88"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Program Files\ladbrokesMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28177.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://www.warwick.ac.uk/newwebcam/AxisCamControl.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: bonspells - {11853d5f-f894-4cc7-bbc3-fc7a9dcfd896} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

1
1972vet
3305 Posts
308
0
Posted December 20th, 2006 17:00
There is evidence in the log of an old SmitFraud infection. The entry shows the file is missing...but that's not always true.
Let's run through the SmitFraud scan to be on the safe side:

Please download:
SmitfraudFix (by S!Ri)
Extract the contents (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press" Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply.

Note :
process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Please run HijackThis again and check the following:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: (no name) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - (no file)
O3 - Toolbar: (no name) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - (no file)
O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -k
These two "O9" entries below are from Poker sites...non of which do I recommend. Some of these sites are malware supported. I cannot say these are malware by themselves, but if you did not download or use these, put a check next to these too:
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Program Files\ladbrokesMPP\MPPoker.exe

Close all windows except HijackThis, then click Fix Checked.
Reboot the computer and post back the SmitFraud scan log along with a fresh HijackThis log. Thanks!
S
spring_time
10 Posts
308
0
Posted December 20th, 2006 20:00
I checked the boxes you said and have posted the HJT below, cheers:

Thanks Roy

Logfile of HijackThis v1.99.1
Scan saved at 07:52:12, on 12/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.meshcomputers.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EPSON Stylus D88 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE /P23 "EPSON Stylus D88 Series" /O6 "USB001" /M "Stylus D88"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28177.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://www.warwick.ac.uk/newwebcam/AxisCamControl.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: bonspells - {11853d5f-f894-4cc7-bbc3-fc7a9dcfd896} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
1
1972vet
3305 Posts
306
0
Posted December 20th, 2006 20:00
You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, reboot the computer into Safemode.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press" Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into your Normal Windows user mode.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Also post a fresh hijackthis log
S
spring_time
10 Posts
308
0
Posted December 20th, 2006 20:00
Hi 1972vet, below is the smithfraudfix log:

SmitFraudFix v2.131

Scan done at 7:41:11.61, 12/12/2006
Run from C:\Documents and Settings\ROY.ROYSPC\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\1024\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ROY.ROYSPC

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ROY.ROYSPC\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ROY~1.ROY\FAVORI~1

C:\DOCUME~1\ROY~1.ROY\FAVORI~1\Antivirus Test Online.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\iVideoCodec\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"="bonspells"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End
1
1972vet
3305 Posts
306
0
Posted December 21st, 2006 16:00
That log looks clean but we still need to clean up a bit:

Download and scan with AVG Anti-Spyware v7.5
( This is Ewido 4.0 renamed. If you already have Ewido installed, please update to this version which has a special "clean driver" for removing persistent malware)

After download, double click on the file to launch the install process.

Choose a language, click "OK" and then click "Next".

Read the "License Agreement" and click "I Agree".

Accept default installation path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5, click "Next", then click "Install".

After setup completes, click "Finish" to start the program automatically or launch AVG Anti-Spyware by double-clicking its icon on your desktop or in the system tray.

The main "Status" menu will appear. Select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'.

Then right click on AVG Anti-Spyware in the system tray and uncheck "Start with Windows".

Go to Start > Run and type: services.msc

Press "OK".

Click the "Extended tab" and scroll down the list to find AVG Anti-Spyware guard.

When you find the guard service, double-click on it.

In the Properties Window > General Tab that opens, click the "Stop" button.

From the drop-down menu next to "Startup Type", click on "Manual".

Now click "Apply", then "OK" and close the Services window.

Select the "Update" button and click "Start update". Wait until you see the "Update successful message. If you are having problems with the updater, manually update with the AVG Anti-Spyware Full database installer from here.

Once the updates are installed do the following:
Click on the " Scanner" button and choose the " Settings" tab.

Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.

Under "How to Scan?" check all (default).

Under "Possibly unwanted software" check all (default).

Under "What to Scan?" make sure "Scan every file" is selected (default).

Under "Reports" select "Automatically generate report after every scan" and UNcheck "Only if threats were found".

Close the application and reboot the computer into Safe mode. Once in safe mode continue with the instructions below:

Open the AVG Anti-Spyware application and click the " Scan" tab.
Click " Complete System Scan" to start.

Note: Close all open windows, programs, and DO NOT USE the computer while AVG Anti-Spyware is scanning. If Explorer or other programs are open during the scan that means certain files will also be in use. Some malware will insert itself and hide in areas that are "protected" by Windows when the files are being used. This can hamper AVG Anti-Spyware's ability to clean properly and may result in reinfection.

Note: If AVG Anti-Spyware "crashes" or "hangs" during the scan, try scanning again by doing this:

Scan one sector of the system at a time by using the "Custom Scan" feature. To do this select Scanner > Custom Scan and click on Add drive/directory/file. Browse to C:\Windows > System, add this folder to the list and click on "Start Scan". When the scan is complete, repeat the Custom Scan but this time, browse to and add the System32 folder. Then keep repeating this procedure until all your folders have been scanned. Make sure you include the Documents & Settings folder.

If this still does not help, then turn the ADS scanner off while making a Custom Scan. To do this select Scanner > Scan Settings and untick "Scan in NTFS Alternate Data Streams". Then repeat the steps above for performing a Custom Scan.

When the scan has finished you will be presented with a list of infected objects found. Click " Apply all actions" to place the files in Quarantine.

IMPORTANT! Do not save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate " No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button?

Click on " Save Report" to view all completed scans. Click on the most recent scan you just performed and select " Save report as" - the default file name will be in date/time format as follows: Report-Scan-20060620-142816.txt. Save to your desktop. A copy of each report will also be saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\

Exit AVG Anti-Spyware when done. Boot back to your normal user mode and post the scan log from AVG along with a fresh HijackThis log. Thanks!
S
spring_time
10 Posts
306
0
Posted December 21st, 2006 16:00
Hey, I have posted the smithfraud log below:

SmitFraudFix v2.131

Scan done at 9:28:10.92, 12/12/2006
Run from C:\Documents and Settings\ROY.ROYSPC\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"="bonspells"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\1024\ Deleted
C:\DOCUME~1\ROY~1.ROY\FAVORI~1\Antivirus Test Online.url Deleted
C:\Program Files\iVideoCodec\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End
S
spring_time
10 Posts
306
0
Posted December 21st, 2006 16:00
...and the HijackThis Log:

Thanks for your help

Roy

Logfile of HijackThis v1.99.1
Scan saved at 09:35:34, on 12/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.meshcomputers.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EPSON Stylus D88 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE /P23 "EPSON Stylus D88 Series" /O6 "USB001" /M "Stylus D88"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28177.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://www.warwick.ac.uk/newwebcam/AxisCamControl.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
S
spring_time
10 Posts
306
0
Posted December 22nd, 2006 16:00
HI 1972vet,

I have run Avg as you said, logs are posted below.

Cheers

Roy

HJT

Logfile of HijackThis v1.99.1
Scan saved at 00:44:45, on 13/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Dit.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.meshcomputers.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EPSON Stylus D88 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE /P23 "EPSON Stylus D88 Series" /O6 "USB001" /M "Stylus D88"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28177.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://www.warwick.ac.uk/newwebcam/AxisCamControl.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
S
spring_time
10 Posts
118
0
Posted December 22nd, 2006 16:00
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 21:29:55 12/12/2006

+ Scan result:

C:\WINDOWS\uxbzqrnrpd.exe -> Adware.BetterInternet : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1311\A0490676.dll -> Adware.BHO : Cleaned.
C:\WINDOWS\system32\MegasearchBarSetup.dll -> Adware.F1Organizer : Cleaned.
C:\WINDOWS\system32\MegasearchBarSetup.dlltmp -> Adware.F1Organizer : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1295\A0485081.ref -> Adware.SpyAxe : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1295\A0485083.exe -> Adware.SpyAxe : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1295\A0485087.exe -> Adware.SpyAxe : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1295\A0485082.exe -> Adware.SpywareStrike : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1310\A0489355.exe -> Adware.VirusBurst.b : Cleaned.
C:\WINDOWS\system32\mocupd.exe -> Adware.WurldMedia : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1311\A0490675.dll -> Hijacker.StartPage.ku : Cleaned.
C:\System Volume Information\_restore{134AD484-E341-4322-8048-58D4DE156F96}\RP1307\A0486754.dll -> Not-A-Virus.Hoax.Win32.Renos.gb : Cleaned.
C:\RECYCLER\NPROTECT\00220587.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220590.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220593.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220596.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220599.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220602.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220605.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220634.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220637.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220640.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220643.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220646.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220649.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220652.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220655.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220686.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220689.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220692.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220695.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220698.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220701.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220704.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220707.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220739.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220740.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220742.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220744.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220746.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220748.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220753.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220864.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220867.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220870.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220873.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220876.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220879.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220882.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220885.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220888.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220919.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220922.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220925.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220928.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220931.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220934.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220937.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220964.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220967.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220970.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220973.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220976.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220979.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00220982.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221013.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221016.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221019.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221022.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221025.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221028.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221031.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221034.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221037.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221067.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221070.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221073.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221076.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221079.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221082.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221085.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221104.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221105.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221106.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221108.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221109.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221110.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221111.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221152.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221155.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221158.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221161.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221164.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221167.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221170.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221172.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221173.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221174.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221175.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221176.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221177.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221178.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221207.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221210.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221213.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221216.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221219.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221222.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221225.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221228.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221261.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221264.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221267.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221270.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221273.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221276.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221279.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221307.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221310.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221313.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221316.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221319.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221322.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221325.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221328.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221356.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221359.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221362.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221365.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221368.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221371.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221374.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221401.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221404.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221407.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221410.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221413.TXT -> TrackingCookie.Abetterinternet : Cleaned.
C:\RECYCLER\NPROTECT\00221416.TXT -> TrackingCookie.Abetterinternet : Cleaned.
S
spring_time
10 Posts
306
0
Posted December 22nd, 2006 16:00

and the Avg logs: I ran a complete scan and then half way through i paused and deleted infected files and saved log (as I needed to turn pc off). So I ran the complete scan again, hence two logs:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 15:33:59 12/12/2006

+ Scan result:

C:\Documents and Settings\All Users\Application Data\Tools\tools.dll -> Adware.BHO : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3E4563A4-2A9B-4912-BE38-906A0CB702CC} -> Adware.FastFind : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEBA788A-C268-492A-B7FE-42C2B6C553D4} -> Adware.FastFind : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3E4563A4-2A9B-4912-BE38-906A0CB702CC} -> Adware.FastFind : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEBA788A-C268-492A-B7FE-42C2B6C553D4} -> Adware.FastFind : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D123AED6C340E304988D0F6852B28775 -> Adware.MediaMotor : Cleaned with backup (quarantined).
HKLM\SOFTWARE\WindowsRTS -> Dialer.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\WindowsRTS\Wininetd -> Dialer.Generic : Cleaned with backup (quarantined).
C:\Documents and Settings\LUKE\Local Settings\Temporary Internet Files\Content.IE5\ILG7U965\4a[1].htm -> Downloader.Agent.ab : Cleaned with backup (quarantined).
C:\Documents and Settings\ROY.ROYSPC\.jpi_cache\jar\1.0\loaderadv441.jar-18af2898-1623af78.zip/Matrix.class -> Downloader.OpenStream.c : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users\Application Data\Setup\Setup.dll -> Hijacker.StartPage.ku : Cleaned with backup (quarantined).
C:\Documents and Settings\ROY.ROYSPC\.jpi_cache\jar\1.0\ar3.jar-5ef20017-45d028d4.zip/Gummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\ROY.ROYSPC\.jpi_cache\jar\1.0\ar3.jar-77402a30-758ef01e.zip/Gummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\ROY.ROYSPC\.jpi_cache\jar\1.0\archive.jar-5e235207-6e54c0ab.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\ROY.ROYSPC\.jpi_cache\jar\1.0\loaderadv441.jar-18af2898-1623af78.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\MATT\Cookies\matt@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@atoc.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@microsoftgamestudio.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@eztracks.aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ad.admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@adtech[1].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@adtech[1].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@adviva[2].txt -> TrackingCookie.Adviva : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@adviva[2].txt -> TrackingCookie.Adviva : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@bfast[2].txt -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@banner.casinolasvegas[2].txt -> TrackingCookie.Casinolasvegas : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@casinolasvegas[1].txt -> TrackingCookie.Casinolasvegas : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@clickagents[1].txt -> TrackingCookie.Clickagents : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\MATT\Local Settings\Temp\Cookies\matt@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wfkicgazacq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wfkookczsho.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wfmykpc5obo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wgkyegazihp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wgl4ohajsdq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wjk4slczwkp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wjlioocpihp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@e-2dj6wjloskcpeco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@e-2dj6wfkikmd5ceo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@e-2dj6wfkoeoczmkp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@e-2dj6wfliegajwao.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@e-2dj6wgkycmcpakp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@e-2dj6whlyegcpiho.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\ROY.ROYSPC\Cookies\roy@e-2dj6wjl4apazicp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@media.fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@media.fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@ehg-nokiafin.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@ehg-reebok.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@hg1.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\LUKE\Cookies\luke@hitbox[3].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-aha.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-autotrader.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-bskyb.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-fastweb.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-fxcm.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-gamespot.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-hotgroup.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-idg.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-idgentertainment.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-ittoolbox.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-iwantoneofthose.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-ladbrokes.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-littlewoods.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-logantod.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-machinas.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-nokiafin.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-pjbc.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-sonycomputer.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-sonyesolutions.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-twi.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-ubisoft.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ehg-vonage.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@phg.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@ehg-bcstore.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@ehg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\SANDRA\Cookies\sandra@phg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ilead.itrack[1].txt -> TrackingCookie.Itrack : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@linkbuddies[2].txt -> TrackingCookie.Linkbuddies : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@linksynergy[1].txt -> TrackingCookie.Linksynergy : Cleaned.
C:\Documents and Settings\MATT\Cookies\matt@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.

HijackThis Log

Dell Support Resources

Latest Solutions

I need a laptop to get a job and get my GED and go to college online

Fixed an issue with the Dell OptiPlex displaying no video from the onboard graphics after the driver installation.

I have lost my KM2223W KEYBOARD DONGLE WHAT SHOULD I DO NOW I WANT USE IT FOR MY WORK

BIOS Admin Password Locked - Need Master Code -6FF1

Help with reactivating account