Hacked by numerous popups stemming from ad.firstadsolutions.com [

Welcome Guest ( Log In | Register )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

3 Pages

1 2 3 >

Hacked by numerous popups stemming from ad.firstadsolutions.com [

Options

bigdaddyfro View Member Profile	Jul 17 2006, 12:48 AM Post #1
Member Posts: 22 OS: Windows xp	Hello. Ive been hacked by spyware, adware etc before and usually i can figure it out on my own, but this one is a little different. A week or so ago i was hit hard by surfsidekick3. After extensive reg cleaning, program running, ewido, cws, adaware, spybot, avg, i believed i had taken care of most of the problematic files. The only thing that remains are these annoying popups from ad.firstadsolution.com. They are generally random, some for credit cards, some for casions, no real uniformity as far as im concerned. I will post my log, thank you for your help. Logfile of HijackThis v1.99.1 Scan saved at 2:47:12 AM, on 7/17/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\PELMICED.EXE C:\program files\mcafee.com\vso\mcvsshld.exe C:\WINDOWS\System32\LXSUPMON.EXE C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe c:\program files\mcafee.com\agent\mcagent.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe E:\Downloadz\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://127.0.0.1:8080 O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [Internet Explorer Updater] C:\WINDOWS\system32\lexbac.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE O4 - HKLM\..\Run: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AIM] E:\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\AIM95\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O15 - Trusted IP range: 67.19.178.84 O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9D1673BD-2B53-4763-BAF4-5034DC4CA65A}: NameServer = 68.94.156.1 68.94.157.1 O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: Security Agent (scagent) - Unknown owner - C:\WINDOWS\system32\scagent.exe" start (file missing)

Crustyoldbloke View Member Profile	Jul 17 2006, 02:36 AM Post #2
Malware Surgeon Posts: 15,099 From: Worcestershire, England OS: Windows XP Professional SP2	Hello bigdaddyfro and welcome to Geeks to Go As an introduction, please note that I am not Superhuman, I do not know everything, but what I do know has taken me years to learn. I am happy to pass on this information to you, but please bear in mind that I am also fallible. Please note that you should have Administrator rights to perform the fixes. Also note that multiple identity PC’s (family PC’s) present a different problem; please tell me if your PC has more than one individual’s setting, but continue with the fix. Before we get underway, you may wish to print these instructions for easy reference during the fix, although please be aware that many of the required URLs are hyperlinks in the red names shown on your screen. Part of the fix may require you to be in Safe Mode, which will not allow you to access the internet, or my instructions! You have quite a mixture of malware and Trojans. Let’s see what we can do. You appear to have two antivirus (AV) programmes running; McAfee and AVG. This is bad practice as they will cause slowness and also conflicts. Please uninstall one of them. You have an entry in your trusted zone that I want to check with you. It points to: ThePlanet.com Internet Services, Inc. 1333 North Stemmons Freeway, Suite 110, Dallas, TX. Do you trust the company from that IP address? 1. Please open Ewido Anti-Spyware On the main screen select the icon "Update" then select the "Update now" link. Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab. Once in the Settings screen click on "Recommended actions" and then select "Quarantine". Under "Reports" Select "Automatically generate report after every scan" Un-Select "Only if threats were found" Close Ewido anti-spyware, Do Not run a scan just yet, we will shortly 2. Please download Brute Force Uninstaller to your desktop. Right click the BFU folder on your desktop, and choose Extract All Click "Next" In the box to choose where to extract the files to, Click "Browse" Click on the + sign next to "My Computer" Click on "Local Disk (C:) or whatever your primary drive is Click "Make New Folder" Type in BFU Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish". 3. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover. Save it in the same folder you made earlier (c:\BFU). Do not do anything with these yet! 4.. Safe Mode Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter. IMPORTANT: Do not open any other windows or programmes while Ewido is scanning, it may interfere with the scanning proccess: Lauch Ewido-anti-spyware by double-clicking the icon on your desktop. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan". Ewido will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following: If you have any infections you will prompted, then select "Apply all actions" Next select the "Reports" icon at the top. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important). 5. Then, please go to Start > My Computer and navigate to the C:\BFU folder. Start the Brute Force Uninstaller by doubleclicking BFU.exe Checkmark/Tick show log after script ends In the scriptline to execute field type or paste c:\bfu\alcanshorty.bfu Press Execute and let it do it’s job. (You ought to see a progress bar if you did this correctly.) Wait for the complete script execution box to pop up and press OK. Press exit to terminate the BFU programme. Reboot into normal windows and post the contents of Ewido text report that you saved, the BFU log (in the folder C:\bintheredunthat\) and a new HiJackThis log, from normal mode. This post has been edited by Crustyoldbloke: Jul 17 2006, 02:39 AM

bigdaddyfro View Member Profile	Jul 17 2006, 12:34 PM Post #3
Member Posts: 22 OS: Windows xp	Alright so lets start from the beginning. There are 2 users on this pc, as in me and one other. If you were me which virus program would you keep? As far as ThePlanet.com Internet Services is concerned, i dont even know what that is, and i dont believe i ever ok'd it to be a trusted zone, or what not. I will post my logs here. Thanks for your assistance. ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 2:10:10 PM 7/17/2006 + Scan result: C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025707.exe -> Adware.Apropos : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025706.dll -> Adware.Aws : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025699.dll -> Adware.BiSpy : Cleaned with backup (quarantined). E:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025708.dll -> Adware.Cydoor : Cleaned with backup (quarantined). E:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025709.dll -> Adware.Cydoor : Cleaned with backup (quarantined). E:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025710.dll -> Adware.Cydoor : Cleaned with backup (quarantined). E:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025711.dll -> Adware.Cydoor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025532.exe -> Adware.Linkmaker : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025537.exe -> Adware.Linkmaker : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025700.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025701.exe -> Adware.Look2Me : Cleaned with backup (quarantined). C:\Documents and Settings\Mark\Local Settings\Temp\ICD4.tmp\amm06.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025705.ocx -> Adware.MediaMotor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025487.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025507.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025534.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025703.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025704.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025528.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025539.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025526.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025533.dll -> Adware.Suggestor : Cleaned with backup (quarantined). C:\!Submit\repairs303169590.dll -> Adware.SurfSide : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025585.exe -> Adware.SurfSide : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025587.dll -> Adware.SurfSide : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025702.dll -> Adware.Zbar : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025345.exe -> Downloader.Adload.ct : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025331.exe -> Downloader.Adload.cu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025337.exe -> Downloader.Adload.cu : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025690.prx:gjblx -> Downloader.Agent.al : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025522.exe -> Downloader.Agent.ala : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025693.exe:hdemg -> Downloader.Agent.bc : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025691.EXE:yvomv -> Downloader.Agent.bq : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025692.INI:xcuqp -> Downloader.Agent.bq : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025695.ini:ggkuq -> Downloader.Agent.cd : Cleaned with backup (quarantined). E:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025745.exe -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). E:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025746.exe -> Downloader.Qoologic.bj : Cleaned with backup (quarantined). C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\JV2H1VZD\start[1].exe -> Downloader.Small.csh : Cleaned with backup (quarantined). C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\052JCPA3\start[2].exe -> Downloader.Small.dfj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025696.dll -> Downloader.Small.hr : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025503.exe -> Downloader.VB.aga : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025516.exe -> Downloader.VB.aga : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025694.exe:cpvue -> Downloader.WinShow.ak : Cleaned with backup (quarantined). C:\Documents and Settings\Mark\Local Settings\Temp\oins.exe -> Dropper.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025688.dll -> Hijacker.StartPage.qr : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025689.dll -> Hijacker.StartPage.vw : Cleaned with backup (quarantined). C:\Documents and Settings\Mark\Local Settings\Temp\SystemDoctor2006FreeInstall.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025524.exe -> Trojan.Runner.j : Cleaned with backup (quarantined). C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP218\A0025697.dll -> Trojan.Small.j : Cleaned with backup (quarantined). ::Report end BFU v1.00.9 Windows XP SP1 (WinNT 5.01.2600 SP1) Script started at 2:31:42 PM, on 7/17/2006 Option Unload Explorer: Yes Failed: DllUnregister C:\WINDOWS\DH.dll\|1 (file not found) Failed: ServiceStop Network Monitor (service not found) Failed: ServiceStop cmdService (service not found) Failed: ServiceDisable Network Monitor (service not found) Failed: ServiceDisable cmdService (service not found) Failed: ServiceDelete Network Monitor (service not found) Failed: ServiceDelete cmdService (service not found) Failed: RegDelValue HKCU\System\CurrentControlSet\Control\Lsa\|p2pnetwork (key not found) Failed: RegDelValue HKCU\SOFTWARE\Microsoft\OLE\|p2pnetwork (key not found) Failed: RegDelValue HKCU\SOFTWARE\Microsoft\OLE\|winlog (key not found) Failed: RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\|LowRiskFileTypes (key not found) Failed: RegDelValue HKCU\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\|WinUpdate.exe (key not found) Option pause between commands: 300 ms Option pause between commands: 50 ms Failed: FolderDelete C:\Program Files\MsConfigs (folder not found) Failed: FolderDelete C:\Program Files\winupdates (folder not found) Failed: FolderDelete C:\Program Files\winupdate (folder not found) Failed: FolderDelete C:\Program Files\winsupdater (folder not found) Failed: FolderDelete C:\Program Files\MsUpdate (folder not found) Failed: FolderDelete C:\Program Files\MsMovies (folder not found) Failed: FolderDelete C:\Program Files\wmplayer (folder not found) Failed: FolderDelete C:\Program Files\outlook (folder not found) Failed: FileDelete C:\Program Files\Common Files\Windows\mc--.exe (operation failed) Failed: FileDelete C:\Program Files\Common Files\Download\mc--.exe (operation failed) Failed: FileDelete C:\DOCUME~1\Mark\LOCALS~1\Temp\~DFBB0C.tmp (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\052JCPA3 (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\0FKRGN67 (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\4567KPA3 (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\5RFA6727 (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\BS280WDK (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\CTQ3OX2V (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\JV2H1VZD (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\KD6NGHMR (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\KTMNSPEJ (operation failed) Failed: FolderDelete C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\OHQF85UF (operation failed) Failed: FolderDelete C:\Program Files\Maxifiles (folder not found) Failed: FolderDelete C:\Program Files\DNS (folder not found) Failed: FolderDelete C:\Program Files\EQAdvice (folder not found) Failed: FolderDelete C:\Program Files\FCAdvice (folder not found) Failed: FolderDelete C:\Program Files\Common Files\FreeProd1 (folder not found) Failed: FolderDelete C:\Program Files\Common Files\FreeProd2 (folder not found) Failed: FolderDelete C:\Program Files\Common Files\InetGet (folder not found) Failed: FolderDelete C:\Program Files\Common Files\InetGet2 (folder not found) Failed: FolderDelete C:\Program Files\Common Files\svchostsys (folder not found) Failed: FolderDelete C:\Program Files\Common Files\simtest (folder not found) Failed: FolderDelete C:\Program Files\Common Files\misc001 (folder not found) Failed: FolderDelete C:\Program Files\InetGet2 (folder not found) Failed: FolderDelete C:\Program Files\Common Files\VCClient (folder not found) Failed: FolderDelete C:\Program Files\Network Monitor (folder not found) Failed: FolderDelete C:\WINDOWS\inet20001 (folder not found) Failed: FolderDelete C:\Program Files\Update06 (folder not found) Failed: FolderDelete C:\Program Files\Update03 (folder not found) Failed: FolderDelete C:\Program Files\Update04 (folder not found) Failed: FolderDelete C:\Program Files\Update08 (folder not found) Failed: FolderDelete C:\Program Files\W-Update (folder not found) Failed: FolderDelete C:\Program Files\Yazzle Sudoku (folder not found) Failed: FolderDelete C:\Program Files\Cas (folder not found) Failed: FolderDelete C:\Program Files\CasStub (folder not found) Failed: FolderDelete C:\Program Files\Cas2Stub (folder not found) Failed: FolderDelete C:\Program Files\ipwins (folder not found) Failed: FolderDelete C:\temp (folder not found) Failed: FolderDelete C:\WINDOWS\mdrive (folder not found) Failed: FolderDelete C:\Program Files\PECarlin (folder not found) Failed: FolderDelete C:\Program Files\AXVenore (folder not found) Failed: FolderDelete C:\Program Files\SDVita (folder not found) Failed: FolderDelete C:\Program Files\EQBranch (folder not found) Failed: FolderDelete C:\Program Files\EQArticle (folder not found) Failed: FolderCreate C:\bintheredunthat (folder already exists) Failed: FileMove C:\WINDOWS\win-.exe\|C:\bintheredunthat (source file not found) Script completed. Logfile of HijackThis v1.99.1 Scan saved at 2:34:12 PM, on 7/17/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\PELMICED.EXE C:\program files\mcafee.com\vso\mcvsshld.exe C:\WINDOWS\System32\LXSUPMON.EXE C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\System32\svchost.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\explorer.exe E:\Downloadz\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://127.0.0.1:8080 O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [Internet Explorer Updater] C:\WINDOWS\system32\lexbac.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE O4 - HKLM\..\Run: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AIM] E:\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\AIM95\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O15 - Trusted IP range: 67.19.178.84 O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9D1673BD-2B53-4763-BAF4-5034DC4CA65A}: NameServer = 68.94.156.1 68.94.157.1 O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: Security Agent (scagent) - Unknown owner - C:\WINDOWS\system32\scagent.exe" start (file missing)

Crustyoldbloke View Member Profile	Jul 17 2006, 02:18 PM Post #4
Malware Surgeon Posts: 15,099 From: Worcestershire, England OS: Windows XP Professional SP2	Hello again Please disable Ewido Guard from running as it will hinder our attempts to change anything. Right click on the orange icon in the taskbar (near the clock) and uncheck Resident Shield. The icon will change to a grey colour. Go to Start>Run and type Services.msc then hit OK Scroll down and find this service: Security Agent (scagent) When you find it, double-click on it. In the next window that opens, click the Stop button, then click on Properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then OK. Run HiJackThis. Click on None of the above, just start the program. Now, click on the Config button (bottom right), then click on Misc Tools, then click on Delete an NT Service a window will pop up. Enter this item into that field (copy and paste): scagent Click OK. It should pull up information about the service, when it asks if you want to reboot now click YES Right click on this link Del 015 Domains.inf and choose Save (link) As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O4 - HKLM\..\Run: [Internet Explorer Updater] C:\WINDOWS\system32\lexbac.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O15 - Trusted IP range: 67.19.178.84 O23 - Service: Security Agent (scagent) - Unknown owner - C:\WINDOWS\system32\scagent.exe" start (file missing) Now close all windows other than HiJackThis, then click Fix Checked. Reboot into Safe Mode: please see here if you are not sure how to do this. Using Windows Explorer, locate the following files/folders, and delete them: C:\Program Files\Viewpoint\ - folder C:\Program Files\MediaGateway\ - folder C:\WINDOWS\system32\scagent.exe - file C:\WINDOWS\system32\lexbac.exe - file Exit Explorer, and reboot as normal afterwards. combofix.exe Double click combofix.exe & follow the prompts. When it has finished, it will produce a log. Please post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall Please right click on HijackThis.exe and rename it to crusty.exe, this is because some malware hides from HJT. Post back a fresh HijackThis log (from normal mode) and I will take another look.

bigdaddyfro

Jul 17 2006, 08:17 PM

Post #5

Member

Posts: 22
OS: Windows xp

When i went into safe mode to manually delete the files, C:\Program Files\Viewpoint\ - folder
C:\Program Files\MediaGateway\ - folder
C:\WINDOWS\system32\scagent.exe - file
C:\WINDOWS\system32\lexbac.exe - file, the only one i found was the viewpoint, the others appear to be gone? I will post both logs, thanks again.

Start Time= Mon 07/17/2006 22:06:44.23
Running from: C:\Documents and Settings\Mark\Desktop

((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log )))))))))))))))))))))))))))))))))))))))))))))))))))

22:08:52.95

Not all files found by this method are bad. There may be legitimate files found
This log should be examined by a trained analyst

No infected Qoologic files found. Reg entries were fixed

(((((((((((((((((((((((((((((((((((((((((((((((( Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\!Submit\SskCore.dll
C:\Documents and Settings\Ann\Application Data\Sskcwrd.dll
C:\Documents and Settings\Ann\Application Data\Sskknwrd.dll
C:\Documents and Settings\Ann\Application Data\Sskuknwrd.dll
C:\Documents and Settings\Mark\Application Data\Sskcwrd.dll
C:\Documents and Settings\Mark\Application Data\Sskknwrd.dll
C:\Documents and Settings\Mark\Application Data\Sskuknwrd.dll
C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Ssk.log

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

22:09:58.34
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\teller2.chk
C:\Documents and Settings\LocalService\Application Data\NetMon

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-07-17 18:07 <DIR> C:\Program Files\all sound recorder xp 210
2006-07-17 12:53 <DIR> C:\Program Files\ewido anti-spyware 4.0
2006-07-14 16:29 <DIR> C:\Program Files\musicmatch
2006-07-09 21:36 <DIR> C:\Program Files\outlook express
2006-07-09 20:09 410 C:\WINDOWS\jxcdf.dll
2006-07-09 20:05 <DIR> C:\Documents and Settings\Mark\Application Data\avg7
2006-07-09 20:04 776,096 C:\WINDOWS\system32\drivers\avg7core.sys
2006-07-09 20:04 4,288 C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-07-09 20:04 27,776 C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-07-09 20:04 23,424 C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-07-09 20:04 <DIR> C:\Program Files\grisoft
2006-07-09 20:03 <DIR> C:\Documents and Settings\Mark\Application Data\microsoft
2006-07-09 04:43 <DIR> C:\Program Files\common files
2006-07-08 04:05 <DIR> C:\Program Files\netmeeting
2006-06-28 15:12 <DIR> C:\Program Files\project64 1.6
2006-06-28 03:03 <DIR> C:\Program Files\windows nt
2006-06-28 01:51 <DIR> C:\Program Files\msn gaming zone
2006-06-28 01:44 <DIR> C:\Program Files\1964
2006-06-28 01:43 <DIR> C:\Program Files\zipgenius 6
2006-06-28 01:14 <DIR> C:\Documents and Settings\Mark\Application Data\zipgenius
2006-05-07 23:56 <DIR> C:\Program Files\quicktime
2006-04-29 03:48 <DIR> C:\Program Files\hp
2006-04-29 03:48 <DIR> C:\Program Files\hewlett-packard
2006-04-27 10:02 5 C:\Documents and Settings\Mark\Application Data\kc.tmp
2006-03-09 18:23 <DIR> C:\Program Files\Common Files\microsoft shared
2006-02-09 15:24 <DIR> C:\Program Files\allmymovies
2006-02-09 03:07 <DIR> C:\Documents and Settings\Mark\Application Data\blueberry
2006-02-09 03:02 <DIR> C:\Documents and Settings\Mark\Application Data\seven zip
2005-11-21 17:37 <DIR> C:\Program Files\windows media player
2005-10-12 01:57 <DIR> C:\Program Files\pc camera
2005-10-12 01:57 <DIR> C:\Program Files\Common Files\pccamera
2005-09-30 22:41 <DIR> C:\Program Files\directx
2005-09-21 22:03 <DIR> C:\Documents and Settings\Mark\Application Data\adobeum
2005-09-08 21:24 <DIR> C:\Program Files\yahoo!
2005-08-18 01:05 <DIR> C:\Documents and Settings\Mark\Application Data\adobeaum
2005-07-10 16:28 <DIR> C:\Program Files\Common Files\xing shared
2005-07-10 16:28 <DIR> C:\Program Files\Common Files\real
2005-05-28 18:28 <DIR> C:\Program Files\dell
2005-05-27 13:42 <DIR> C:\Documents and Settings\Mark\Application Data\gtek
2005-05-26 10:05 <DIR> C:\Program Files\dell support
2005-05-05 13:07 <DIR> C:\Program Files\msn messenger
2005-03-01 16:36 <DIR> C:\Program Files\winrar
2005-02-25 22:34 <DIR> C:\Program Files\installshield installation information
2005-02-25 22:33 <DIR> C:\Documents and Settings\Mark\Application Data\musicmatch
2005-02-25 22:32 <DIR> C:\Program Files\Common Files\installshield
2005-02-19 18:02 <DIR> C:\Documents and Settings\Mark\Application Data\syszd
2005-02-19 18:02 <DIR> C:\Documents and Settings\Mark\Application Data\msxw
2005-02-19 17:38 <DIR> C:\Documents and Settings\Mark\Application Data\lavasoft
2005-02-19 17:37 <DIR> C:\Program Files\lavasoft
2005-02-17 22:35 <DIR> C:\Program Files\cleanup!
2005-02-10 20:49 <DIR> C:\Documents and Settings\Mark\Application Data\alta
2005-02-04 17:56 <DIR> C:\Program Files\Common Files\adobe
2005-02-04 17:47 <DIR> C:\Documents and Settings\Mark\Application Data\leadertech
2005-02-02 22:48 <DIR> C:\Documents and Settings\Mark\Application Data\adobe
2005-02-02 22:46 <DIR> C:\Program Files\adobe
2005-01-16 23:49 <DIR> C:\Program Files\internet explorer
2004-12-30 18:52 <DIR> C:\Program Files\windowsupdate
2004-12-30 15:04 <DIR> C:\Documents and Settings\Mark\Application Data\help
2004-11-27 22:25 <DIR> C:\Documents and Settings\Mark\Application Data\aim
2004-11-27 21:26 <DIR> C:\Program Files\aws
2004-11-27 21:26 <DIR> C:\Program Files\aod
2004-10-16 22:15 <DIR> C:\Documents and Settings\Mark\Application Data\yahoo! messenger
2004-07-19 20:49 <DIR> C:\Program Files\sierra on-line
2004-05-28 12:40 <DIR> C:\Documents and Settings\Mark\Application Data\lycos
2004-05-22 18:42 <DIR> C:\Program Files\spybot - search & destroy
2004-04-24 17:35 <DIR> C:\Documents and Settings\Mark\Application Data\real
2004-04-12 21:25 <DIR> C:\Documents and Settings\Mark\Application Data\macromedia
2004-03-19 22:39 <DIR> C:\Program Files\divx
2004-02-25 19:31 <DIR> C:\Documents and Settings\Mark\Application Data\corel
2004-01-24 18:47 <DIR> C:\Program Files\kazaa lite
2004-01-24 17:26 <DIR> C:\Program Files\Common Files\swf studio
2004-01-21 17:07 <DIR> C:\Program Files\mcafee.com
2004-01-15 09:28 <DIR> C:\Program Files\jasc software inc
2004-01-15 09:28 <DIR> C:\Program Files\dell computer
2004-01-15 09:28 <DIR> C:\Documents and Settings\Mark\Application Data\jasc software inc
2004-01-15 09:25 <DIR> C:\Documents and Settings\Mark\Application Data\sonic
2004-01-15 09:22 <DIR> C:\Program Files\microsoft encarta
2004-01-15 09:21 <DIR> C:\Program Files\wordperfect office 11
2004-01-15 09:21 <DIR> C:\Program Files\Common Files\borland shared
2004-01-15 09:20 <DIR> C:\Program Files\real
2004-01-15 09:20 <DIR> C:\Program Files\Common Files\corel
2004-01-15 09:19 <DIR> C:\Program Files\learn2.com
2004-01-15 09:19 <DIR> C:\Program Files\Common Files\nullsoft
2004-01-15 09:19 <DIR> C:\Program Files\Common Files\aol
2004-01-15 09:17 <DIR> C:\Program Files\sonic
2004-01-15 09:17 <DIR> C:\Program Files\modem helper
2004-01-15 09:17 <DIR> C:\Program Files\Common Files\surething shared
2004-01-15 09:17 <DIR> C:\Program Files\Common Files\sonic
2004-01-15 09:15 <DIR> C:\Program Files\broadcom management programs
2004-01-15 09:06 <DIR> C:\Program Files\java
2004-01-15 09:06 <DIR> C:\Program Files\Common Files\java
2004-01-15 09:06 <DIR> C:\Documents and Settings\Mark\Application Data\sun
2004-01-15 08:41 <DIR> C:\Program Files\xerox
2004-01-15 08:41 <DIR> C:\Program Files\uninstall information
2004-01-15 08:41 <DIR> C:\Program Files\online services
2004-01-15 08:41 <DIR> C:\Program Files\msn
2004-01-15 08:41 <DIR> C:\Program Files\movie maker
2004-01-15 08:41 <DIR> C:\Program Files\microsoft frontpage
2004-01-15 08:41 <DIR> C:\Program Files\messenger
2004-01-15 08:41 <DIR> C:\Program Files\complus applications
2004-01-15 08:41 <DIR> C:\Program Files\Common Files\system
2004-01-15 08:41 <DIR> C:\Program Files\Common Files\speechengines
2004-01-15 08:41 <DIR> C:\Program Files\Common Files\services
2004-01-15 08:41 <DIR> C:\Program Files\Common Files\odbc
2004-01-15 08:41 <DIR> C:\Program Files\Common Files\mssoap
2004-01-15 08:41 <DIR> C:\Documents and Settings\Mark\Application Data\identities

(((((((((((((((((((((((((((((((((((((( Files Created - Last 30days )))))))))))))))))))))))))))))))))))))))))))

2006-07-17 22:02 266,407,936 C:\hiberfil.sys
2006-07-09 20:14 684,032 C:\WINDOWS\libeay32.dll
2006-07-09 20:14 478,720 C:\WINDOWS\WRUninstall.dll
2006-07-09 20:14 155,648 C:\WINDOWS\ssleay32.dll
2006-07-09 04:05 410 C:\WINDOWS\jxcdf.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"BCMSMMSG"="BCMSMMSG.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"StorageGuard"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"VSOCheckTask"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcmnhdlr.exe\" /checktask"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="C:\\PROGRA~1\\mcafee.com\\agent\\McUpdate.exe"
"Mouse Suite 98 Daemon"="PELMICED.EXE"
"VirusScan Online"="c:\\program files\\mcafee.com\\vso\\mcvsshld.exe"
"LXSUPMON"="C:\\WINDOWS\\System32\\LXSUPMON.EXE RUN"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe"
"HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"AIM"="E:\\AIM95\\aim.exe -cnetwait.odl"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe\" -quiet"
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"flags"=dword:00000008

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex\000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"notepad.exe"="msmsgs.exe"
"notepad2.exe"="popuper.exe"
"winlogon.exe"="msole32.exe"
"paint.exe"="shnlog.exe"
"Ibs"="C:\\WINDOWS\\ibs.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"WallpaperStyle"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispAppearancePage"=dword:00000000
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="C:\\Program Files\\MSN Gaming Zone\\pojox.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\Program Files\\Windows NT\\megevuq.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="C:\\WINDOWS\\desktop.html"
"SubscribedURL"="C:\\WINDOWS\\desktop.html"
"FriendlyName"="Security"
"Flags"=dword:00004002
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,80,04,00,00,3f,03,00,00,ec,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,32,00,00,00,32,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,01,00,00,00,80,04,00,00,3f,03,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,80,04,00,00,60,03,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Microsoft Windows Update"="scvvhost.exe"
"svphost.exe"="C:\\WINDOWS\\system32\\svphost.exe"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Microsoft Windows Update"="scvvhost.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Microsoft Windows Update"="scvvhost.exe"
"svphost.exe"="C:\\WINDOWS\\system32\\svphost.exe"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"Microsoft Windows Update"="scvvhost.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{0656A137-B161-CADD-9777-E37A75727E78}"="OLE Module"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^dkhwt.exe]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\dkhwt.exe"
"backup"="C:\\WINDOWS\\pss\\dkhwt.exeCommon Startup"
"location"="Common Startup"
"command"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\dkhwt.exe"
"item"="dkhwt"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Antc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="oros"
"hkey"="HKCU"
"command"="C:\\Documents and Settings\\Mark\\Application Data\\oros.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ehfovtt]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="w?wexec"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\System32\\w?wexec.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hrgpo]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="lduvnf"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\System32\\lduvnf.exe reg_run"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kuynnd]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="lduvnf"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\lduvnf.exe reg_run"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mfcvc32.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mfcvc32"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\mfcvc32.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMsgSvc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Messenger]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\msmsgs.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mswspl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ViewMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntxm.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ntxm"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\ntxm.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OSSProxy]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ossproxy"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\ossproxy.exe -boot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TINTSETP"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TINTSETP"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sdkln32.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sdkln32"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\sdkln32.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Security iGuard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Security iGuard"
"hkey"="HKLM"
"command"="C:\\Program Files\\Security iGuard\\Security iGuard.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="se"
"hkey"="HKLM"
"command"="rundll32 C:\\DOCUME~1\\Mark\\LOCALS~1\\Temp\\se.dll,DllInstall"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SurfSideKick 3]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ssk"
"hkey"="HKLM"
"command"="C:\\Program Files\\SurfSideKick 3\\Ssk.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Win32 Explorer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="explorer32"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\explorer32.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zSPGuard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="spguard"
"hkey"="HKLM"
"command"="c:\\program files\\pjw\\spguard\\spguard.exe /s "
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ZESOFT"=dword:00000002

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Update Check (COMPUTER-Ann).job
C:\WINDOWS\tasks\McAfee.com Update Check (COMPUTER-Mark).job
C:\WINDOWS\tasks\McAfee.com Update Check (DHZJV441-Owner).job

Completion time: Mon 07/17/2006 22:10:04.51
ComboFix ver 06.07.16.2 - This logfile is located at C:\ComboFix.txt

ComboFix.txt

Logfile of HijackThis v1.99.1
Scan saved at 10:14:00 PM, on 7/17/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\PELMICED.EXE
C:\program files\mcafee.com\vso\mcvsshld.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\notepad.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Downloadz\crusty.exe.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://127.0.0.1:8080
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] E:\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -