UNSOLVED
Log File- Deleted virus, error on startup
Hi,
My brother got hit with several viruses. Norton removed all of them except one. I had to delete it manually from the Systems32 folder. I also unchecked it in msconfig, Startup. Now every time he boots he gets this error message. I'd like to get rid of it.
This file was the virus that I removed.
I posted on the virus board and was told to run HijackThis. I did that. Here's the Startup List and Log File.
I do see the file still listed in Startup under [Shell & screensaver key from Registry:] if it helps. Also a lot of no name files and missing files.
Also in the Log File [F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe]
Thanks for any help.
START UP----------------------------------------------------------------------------------------------------------------------------
StartupList report, 7/24/2005, 10:22:11 AM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\DEE\My Documents\Rich's Files, Don't Use\HyjackThis\Unzipped Files\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\DEE\My Documents\Rich's Files, Don't Use\HyjackThis\Unzipped Files\HijackThis.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
NAV Agent = C:\PROGRA~1\NORTON~1\navapw32.exe
Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
SSC_UserPrompt = C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
Yahoo! Pager = C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
winrnr = C:\WINDOWS\System32\winrnr.exe
ltimg11n = C:\WINDOWS\System32\ltimg11n.exe
ir41_qcx = C:\WINDOWS\System32\ir41_qcx.exe
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=mad.dll
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\ssmypics.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
StartupList version: 1.52.2
Started from : C:\Documents and Settings\DEE\My Documents\Rich's Files, Don't Use\HyjackThis\Unzipped Files\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\DEE\My Documents\Rich's Files, Don't Use\HyjackThis\Unzipped Files\HijackThis.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
NAV Agent = C:\PROGRA~1\NORTON~1\navapw32.exe
Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
SSC_UserPrompt = C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
Yahoo! Pager = C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
winrnr = C:\WINDOWS\System32\winrnr.exe
ltimg11n = C:\WINDOWS\System32\ltimg11n.exe
ir41_qcx = C:\WINDOWS\System32\ir41_qcx.exe
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=mad.dll
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\ssmypics.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - (no file) - SOFTWARE
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {3D8A06ED-FF1B-41AF-8744-E7EF29D95D24}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {4887CE34-8A91-44E9-A61B-34F1254E784B}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {7B9F24CF-BDDE-4675-B894-9C8D4C6FBE7E}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {7EA2ECDA-590E-4F75-9C72-E0D80A66BEBB}
(no name) - (no file) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {A1C0A78F-A833-45CE-BCC9-92AD02FB6ED9}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {B171FEC8-4E36-47B4-B2F1-EE7ABDE6D0FA}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {B9156E9D-3F9B-431C-B32C-FBA7A2E5B461}
(no name) - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {C67D2CF8-00C7-49D9-A223-D7BEA56F330C}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {DA51AB3F-2978-4994-AA36-914E19C4BB8B}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {F6D7C63A-C30A-4E4E-A6D8-56BBDF21EF25}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {F952BE02-0FD8-4F90-9F40-42A3EDA47A04}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job
--------------------------------------------------
Enumerating Download Program Files:
[{0335A685-ED24-4F7B-A08E-3BD15D84E668}]
CODEBASE = http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
[{1D0D9077-3798-49BB-9058-393499174D5D}]
CODEBASE = file://c:\counter.cab
[YInstStarter Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CWDL_DownLoad.dll
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
[MFInstall Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MFInstall.ocx
CODEBASE = http://c.ancestry.com/MFInstall/MFInstall.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
--------------------------------------------------
End of report, 7,415 bytes
Report generated in 0.220 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
(no name) - (no file) - SOFTWARE
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {3D8A06ED-FF1B-41AF-8744-E7EF29D95D24}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {4887CE34-8A91-44E9-A61B-34F1254E784B}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {7B9F24CF-BDDE-4675-B894-9C8D4C6FBE7E}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {7EA2ECDA-590E-4F75-9C72-E0D80A66BEBB}
(no name) - (no file) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {A1C0A78F-A833-45CE-BCC9-92AD02FB6ED9}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {B171FEC8-4E36-47B4-B2F1-EE7ABDE6D0FA}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {B9156E9D-3F9B-431C-B32C-FBA7A2E5B461}
(no name) - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {C67D2CF8-00C7-49D9-A223-D7BEA56F330C}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {DA51AB3F-2978-4994-AA36-914E19C4BB8B}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {F6D7C63A-C30A-4E4E-A6D8-56BBDF21EF25}
(no name) - C:\Program Files\CSBB\CSBB.dll (file missing) - {F952BE02-0FD8-4F90-9F40-42A3EDA47A04}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job
--------------------------------------------------
Enumerating Download Program Files:
[{0335A685-ED24-4F7B-A08E-3BD15D84E668}]
CODEBASE = http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
[{1D0D9077-3798-49BB-9058-393499174D5D}]
CODEBASE = file://c:\counter.cab
[YInstStarter Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CWDL_DownLoad.dll
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
[MFInstall Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MFInstall.ocx
CODEBASE = http://c.ancestry.com/MFInstall/MFInstall.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
--------------------------------------------------
End of report, 7,415 bytes
Report generated in 0.220 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Log File--------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.0
Scan saved at 9:58:31 AM, on 7/24/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.exe
C:\Documents and Settings\DEE\My Documents\Rich's Files, Don't Use\HyjackThis\Unzipped Files\HijackThis.exe
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {3D8A06ED-FF1B-41AF-8744-E7EF29D95D24} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {4887CE34-8A91-44E9-A61B-34F1254E784B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {7B9F24CF-BDDE-4675-B894-9C8D4C6FBE7E} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {7EA2ECDA-590E-4F75-9C72-E0D80A66BEBB} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O2 - BHO: (no name) - {A1C0A78F-A833-45CE-BCC9-92AD02FB6ED9} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {B171FEC8-4E36-47B4-B2F1-EE7ABDE6D0FA} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {B9156E9D-3F9B-431C-B32C-FBA7A2E5B461} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C67D2CF8-00C7-49D9-A223-D7BEA56F330C} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {DA51AB3F-2978-4994-AA36-914E19C4BB8B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {F6D7C63A-C30A-4E4E-A6D8-56BBDF21EF25} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {F952BE02-0FD8-4F90-9F40-42A3EDA47A04} - C:\Program Files\CSBB\CSBB.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [winrnr] C:\WINDOWS\System32\winrnr.exe
O4 - HKCU\..\Run: [ltimg11n] C:\WINDOWS\System32\ltimg11n.exe
O4 - HKCU\..\Run: [ir41_qcx] C:\WINDOWS\System32\ir41_qcx.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {4226E9B7-D637-40E8-893A-13298AB41477} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} (MFInstall Class) - http://c.ancestry.com/MFInstall/MFInstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{705B4CF5-7701-4FFE-92B9-5531A1314A65}: NameServer = 65.169.138.9 65.169.138.11
O20 - AppInit_DLLs: mad.dll
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: PCTEL Speaker Phone - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Scan saved at 9:58:31 AM, on 7/24/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.exe
C:\Documents and Settings\DEE\My Documents\Rich's Files, Don't Use\HyjackThis\Unzipped Files\HijackThis.exe
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {3D8A06ED-FF1B-41AF-8744-E7EF29D95D24} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {4887CE34-8A91-44E9-A61B-34F1254E784B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {7B9F24CF-BDDE-4675-B894-9C8D4C6FBE7E} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {7EA2ECDA-590E-4F75-9C72-E0D80A66BEBB} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O2 - BHO: (no name) - {A1C0A78F-A833-45CE-BCC9-92AD02FB6ED9} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {B171FEC8-4E36-47B4-B2F1-EE7ABDE6D0FA} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {B9156E9D-3F9B-431C-B32C-FBA7A2E5B461} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C67D2CF8-00C7-49D9-A223-D7BEA56F330C} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {DA51AB3F-2978-4994-AA36-914E19C4BB8B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {F6D7C63A-C30A-4E4E-A6D8-56BBDF21EF25} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {F952BE02-0FD8-4F90-9F40-42A3EDA47A04} - C:\Program Files\CSBB\CSBB.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [winrnr] C:\WINDOWS\System32\winrnr.exe
O4 - HKCU\..\Run: [ltimg11n] C:\WINDOWS\System32\ltimg11n.exe
O4 - HKCU\..\Run: [ir41_qcx] C:\WINDOWS\System32\ir41_qcx.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {4226E9B7-D637-40E8-893A-13298AB41477} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} (MFInstall Class) - http://c.ancestry.com/MFInstall/MFInstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{705B4CF5-7701-4FFE-92B9-5531A1314A65}: NameServer = 65.169.138.9 65.169.138.11
O20 - AppInit_DLLs: mad.dll
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: PCTEL Speaker Phone - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Message Edited by Mr Rich on 07-24-2005 12:24 PM
Message Edited by Mr Rich on 07-24-2005 12:35 PM
Message Edited by Mr Rich on 07-24-2005 07:41 PM
Message Edited by Mr Rich on 07-24-2005 07:51 PM
