Can't get rid of Trojan Generic3.Uns & Program Files\func

Welcome Guest ( Log In | Register )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis™ Logs Go Here

3 Pages

1 2 3 >

Can't get rid of Trojan Generic3.Uns & Program Files\func, Someone Please take a look at my logs!!

Options

rlfaress View Member Profile	May 5 2008, 08:13 PM Post #1
Member Posts: 24 OS: Windows XP	Nephews came to visit this weekend and loaded Limewire (which I removed). Got lots of popups, AVG detected threats (many trojans, I wipe and they come back on reboot), also VnrPack15 and C:\Program Files\func.js" failed (Access is denied) is popping up, IE closing (took 3 times to run Panda) and my mouse is acting squirrely. Every program I've run has detected threats. I have followed advice and have copied all logs below. I have IE 7 with service pack 2 already installed, updates daily. Thanks ahead of time for the help. Rhonda Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:56:06 PM, on 5/5/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Dell\QuickSet\QuickSet.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Microsoft Office\Office\FINDFAST.EXE C:\Program Files\Microsoft Office\Office\OSA.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = .local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {718FFD62-B1B2-420C-BC73-0A14B6EB80A7} - C:\Program Files\ATI Technologies\pexyh66225.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe O4 - HKLM\..\Run: [ShowLOMControl] O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\CVS\CVS Photo Editor Plus\Corel Photo Downloader.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...wlscbase370.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1101076214519 O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebas...sCamControl.ocx O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://www.dlink.com/products/livedemo/plugin/h263ctrl.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 8712 bytes Adobe Flash Player ActiveX Adobe Reader 8.1.2 Adobe Shockwave Player 11 ALPS Touch Pad Driver Apple Mobile Device Support Apple Software Update ArcSoft Software Suite ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver AVG 7.5 Bink and Smacker Bonjour CCScore Conexant D480 MDC V.92 Modem CVS Photo Editor Plus Dell Wireless WLAN Card DivX Codec ESSCDBK ESScore ESSgui ESSini ESSPCD ESSSONIC ESSTOOLS essvatgt Family Tree Maker 2005 HijackThis 2.0.2 Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB935448) Intel® PRO Network Adapters and Drivers iTunes Java™ 6 Update 3 Java™ 6 Update 5 kgcbase kgcmove Kodak EasyShare software KSU Malwarebytes' Anti-Malware Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 97, Professional Edition Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 MSXML 4.0 SP2 (KB936181) netbrdg Notifier OfotoXMI OpenOffice.org 2.1 Panda ActiveScan 2.0 PC Tools Firewall Plus 3.0 PCDADDIN PCDHELP PHOTOfunSTUDIO -viewer- PowerDVD 5.7 QuickTime Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) SFR SHASTA SKIN0001 SKINXSDK Sonic DLA Sonic RecordNow! Plus Sonic Update Manager Spelling Dictionaries Support For Adobe Reader 8 staticcr SUPERAntiSpyware Free Edition tooltips TUGZip 3.4 Update for Windows XP (KB904942) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) VPRINTOL Windows Defender Windows Internet Explorer 7 Windows Live installer Windows Live Messenger Windows Live Sign-in Assistant Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 WIRELESS Yahoo! Messenger ;**************************************************************************** ****************************************************************************** * ***************** ANALYSIS: 2008-05-05 21:51:38 PROTECTIONS: 1 MALWARE: 24 SUSPECTS: 0 ;*************************************************************************** ****************************************************************************** * ***************** PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================ = =================== AVG 7.5.524 7.5.524 Yes Yes ;=============================================================================== ================================================================================ = =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================ = =================== 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@trafficmp[1].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@doubleclick[1].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@doubleclick[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@atdmt[3].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@atdmt[1].txt 00139535 Application/Processor HackTools No 0 Yes No C:\WINDOWS\system32\Process.exe 00139535 Application/Processor HackTools No 0 Yes No C:\Documents and Settings\Everyone Else\Desktop\SmitfraudFix\Process.exe 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@fastclick[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@tribalfusion[3].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@tribalfusion[1].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@mediaplex[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@mediaplex[1].txt 00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@findwhat[1].txt 00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@findwhat[2].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt 00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@yadro[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ad.yieldmanager[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ad.yieldmanager[3].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@apmebf[1].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@burstnet[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@advertising[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@advertising[1].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@media.adrevolver[1].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@media.adrevolver[5].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@realmedia[2].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@questionmarket[1].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@zedo[2].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@zedo[3].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@adrevolver[2].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Everyone Else\Cookies\everyone_else@adrevolver[3].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Administrator\Cookies\administrator@target[1].txt 02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\Documents and Settings\Everyone Else\Desktop\SmitfraudFix\Reboot.exe 02913340 Adware/InternetSpeedMonitor Adware No 0 No No C:\WINDOWS\two222222.exe[ism.exe] 02913340 Adware/InternetSpeedMonitor Adware No 0 Yes No C:\System Volume Information\_restore{6B8BF05F-EEFE-4A41-96AD-B82E393DA7FC}\RP39\A0009143.exe 02927671 Adware/TTC Adware No 0 Yes No C:\WINDOWS\LOT66225.exe 02927675 Adware/TTC Adware Yes 1 Yes No C:\PROGRAM FILES\ATI TECHNOLOGIES\PEXYH66225.DLL 02927675 Adware/TTC Adware No 0 No No C:\WINDOWS\LOT66225.exe[TTC.dll] ;=============================================================================== ================================================================================ = =================== SUSPECTS Sent Location V ;=============================================================================== ================================================================================ = =================== ;=============================================================================== ================================================================================ = =================== VULNERABILITIES Id Severity Description V ;=============================================================================== ================================================================================ = =================== ;=============================================================================== ================================================================================ = =================== Malwarebytes' Anti-Malware 1.11 Database version: 716 Scan type: Quick Scan Objects scanned: 40998 Time elapsed: 16 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\banneradsgalore (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\{c90d1d70-4e6c-7d26-aaaf-73ab021c3bbe}.dll-uninst.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\page.html (Malware.Trace) -> Quarantined and deleted successfully. SUPERAntiSpyware Scan Log Generated 05/05/2008 at 05:49 PM Application Version : 3.6.1000 Core Rules Database Version : 3452 Trace Rules Database Version: 1444 Scan type : Complete Scan Total Scan Time : 01:21:57 Memory items scanned : 556 Memory threats detected : 0 Registry items scanned : 4182 Registry threats detected : 0 File items scanned : 48236 File threats detected : 95 Adware.Tracking Cookie C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads.domainsuite[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@2o7[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@apmebf[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@rotator.adjuggler[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@specificclick[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@media.adrevolver[3].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@208.122.40[3].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@zedo[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@yadro[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads.realtechnetwork[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads.revsci[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads.techguy[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@enhance[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@adopt.specificclick[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@linksynergy[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads.bleepingcomputer[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@interclick[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@partner.googleadservices[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@clickarrows[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@redorbit[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@media6degrees[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@advertising[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@anat.tacoda[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@doubleclick[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@www.adtrak[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@casalemedia[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@realmedia[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@data.liquidmedianetworks[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@208.122.40[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@burstnet[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@imrworldwide[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@anad.tacoda[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads.vidsense[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@msnportal.112.2o7[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@numarasoftware.112.2o7[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@trafficmp[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@tribalfusion[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ehg-ripedigitalentertainment.hitbox[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@media.adrevolver[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@statse.webtrendslive[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@findwhat[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@adrevolver[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@mediaplex[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@www.burstnet[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@adsby.zwoops[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@hitbox[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads.k8l[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@adserver.itdrive[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ad.yieldmanager[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@statcounter[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ads2.k8l[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@atdmt[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@collective-media[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@tacoda[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@googleadservices[1].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@ehg-foxsports.hitbox[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@indextools[2].txt C:\Documents and Settings\Everyone Else\Cookies\everyone_else@fastclick[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@adbrite[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@adinterax[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@adopt.euroclick[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@adopt.specificclick[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@ads.adbrite[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@ads.addynamix[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@ads.revsci[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@advertising[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@apmebf[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@bs.serving-sys[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@casalemedia[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@collective-media[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@fastclick[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@focalex[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@insightexpressai[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@kontera[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@media.adrevolver[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@media6degrees[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@realmedia[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@reunion.adbureau[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@revsci[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@specificclick[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@windowsmedia[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@zedo[1].txt Adware.RAC C:\DOCUMENTS AND SETTINGS\EVERYONE ELSE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\0HD4TDZT\ACDT-PID76[1].EXE Adware.k8l C:\PROGRAM FILES\PAGE.HTML Adware.SysMon C:\SYSTEM VOLUME INFORMATION\_RESTORE{6B8BF05F-EEFE-4A41-96AD-B82E393DA7FC}\RP39\A0009285.EXE This post has been edited by rlfaress**: May 6 2008, 01:53 PM

Rorschach112 View Member Profile	May 7 2008, 03:16 PM Post #2
GeekU Teacher Posts: 19,711 From: Dublin OS: XP	Hello Download avz4.zip from here Unzip it to your desktop to a folder named avz4 Double click on AVZ.exe to run it. Run an update by clicking the Auto Update button on the Right of the Log window: Click Start to begin the update Note: If you recieve an error message, chose a different source, then click Start again After the update, from the "File" menu, choose "Standard Scripts" Put a check next to item 2: Advanced System Investigation Click Execute selected scripts At the next prompt, click the OK button Let the scan run and click "OK" when the completion prompt pops up Now Close out of the Standard Scripts window, and exit AVZ Navigate to the avz4 folder and locate the folder LOG Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip Attach virusinfo_syscheck.htm to your next reply, along with a fresh HijackThis log

rlfaress View Member Profile	May 7 2008, 11:30 PM Post #3
Member Posts: 24 OS: Windows XP	Hello and thank you so much for your help. I've attached both files. Rhonda Attached File(s) virusinfo_syscheck.htm ( 209.21K ) Number of downloads: 13 Logfile_of_Trend_Micro_HijackThis_v2.doc ( 36K ) Number of downloads: 3

Rorschach112 View Member Profile	May 8 2008, 05:12 AM Post #4
GeekU Teacher Posts: 19,711 From: Dublin OS: XP	Hello Please do an online scan with Kaspersky WebScanner Click on Kaspersky Online Scanner and click Accept You will be prompted to install an ActiveX component from Kaspersky, Click Yes. The program will launch and then begin downloading the latest definition files: Once the files have been downloaded click on NEXT Now click on Scan Settings In the scan settings make that the following are selected: Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Options: Scan Archives Scan Mail Bases Click OK Now under select a target to scan: Select My Computer This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Now click on the Save as Text button: Save the file to your desktop. Copy and paste that information in your next post. Please download Deckard's System Scanner (DSS) and save it to your Desktop. Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. If your anti-virus or firewall complains, please allow this script to run as it is not malicious. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

rlfaress

May 8 2008, 03:23 PM

Post #5

Member

Posts: 24
OS: Windows XP

Hello, forum not letting me post the entire Kasper log in one reply (error message says too large). I will post Kasper Log in multiple posts after this. Below is Deckards main.txt & extra.txt logs. Thank you.

Deckard's System Scanner v20071014.68
Run by Everyone Else on 2008-05-08 16:44:57
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
48: 2008-05-08 20:45:15 UTC - RP48 - Deckard's System Scanner Restore Point
47: 2008-05-08 00:03:42 UTC - RP47 - System Checkpoint
46: 2008-05-06 19:49:06 UTC - RP46 - Software Distribution Service 3.0
45: 2008-05-06 19:44:04 UTC - RP45 - Removed Windows Live Messenger
44: 2008-05-06 19:43:17 UTC - RP44 - Removed PHOTOfunSTUDIO -viewer-

-- First Restore Point --
1: 2008-03-27 01:15:57 UTC - RP1 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

-- HijackThis (run as Everyone Else.exe) ---------------------------------------

logfile has no content; running clone.
-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-05-08 16:46:04
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WLTRAY.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\ApntEx.exe
C:\Program Files\Apoint\hidfind.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Everyone Else\Desktop\dss.exe
C:\Program Files\Trend Micro\HijackThis\Everyone Else.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {718FFD62-B1B2-420C-BC73-0A14B6EB80A7} - C:\Program Files\ATI Technologies\pexyh66225.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [ShowLOMControl] 1
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\CVS\CVS Photo Editor Plus\Corel Photo Downloader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock...director/sw.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...wlscbase370.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1101076214519
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebas...sCamControl.ocx
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://www.dlink.com/products/livedemo/plugin/h263ctrl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\system32\WLTRYSVC.EXE

--
End of file - 8905 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20080506-030802-286 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

-- File Associations -----------------------------------------------------------

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 aarich - c:\windows\system32\drivers\aarich.sys <Not Verified; Adaptec, Inc.; Adaptec hostRAID for Serial ATA>
R0 cercsr6 (DELL CERC SATA 1.5/6ch RAID Miniport Driver) - c:\windows\system32\drivers\cercsr6.sys <Not Verified; Adaptec, Inc.; Dell RAID Controller>
R1 APPDRV - c:\windows\system32\drivers\appdrv.sys <Not Verified; Dell Inc; Application Driver>
R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus® ASPI Shell>
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>
R3 SFilter (PCTools Driver) - c:\windows\system32\drivers\pctfw.sys <Not Verified; PC Tools; PC Tools NDIS Driver>

S3 E1000 (Intel® PRO/1000 Adapter Driver) - c:\windows\system32\drivers\e1000325.sys <Not Verified; Intel Corporation; Intel® PRO/1000 Adapter>
S4 a320raid - c:\windows\system32\drivers\a320raid.sys <Not Verified; Adaptec, Inc.; Adaptec hostRAID for Ultra320 SCSI>
S4 aac (PERC 320/DC SCSI RAID Miniport Driver) - c:\windows\system32\drivers\aac.sys <Not Verified; Adaptec, Inc.; Adaptec RAID Controller>
S4 fasttx2k - c:\windows\system32\drivers\fasttx2k.sys <Not Verified; Promise Technology, Inc.; Promise FastTrak Series Driver>
S4 vmscsi - c:\windows\system32\drivers\vmscsi.sys <Not Verified; VMware, Inc.; VMware, Inc. Script1 Application>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R2 ProtexisLicensing - c:\windows\system32\psiservice.exe <Not Verified; ; PSIService>

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-05-08 14:47:01 330 --ah----- C:\WINDOWS\Tasks\MP Schedul