all kinds of problems: "choose the program you w.nt to use to ope |
Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
  |
 Apr 25 2008, 01:52 PM
Post
#1
|
|
|
Member  Posts: 11 OS: xp  |
Trojan.Click.18576: Virus c:\windows\resources\unknowndrive.dll is Deleted. Trojan.DownLoader.59098: Virus c:\windows\system32\drivers\spools.exe is Deleted. Trojan.Starter.384: Virus c:\windows\explorer.exe is Infected. c:\windows\system32\spoolsv.exe is Infected. c:\windows\system32\services.exe is Infected. c:\windows\system32\svchost.exe is Infected. c:\windows\system32\lsass.exe is Infected Here is the Hijackthis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:52:11 PM, on 4/25/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\winself.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\OpenCASE\OpenCASE Media Agent\MediaAgent.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_svc.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\Program Files\eAcceleration\Firewall\FWService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\mozilla.org\Mozilla\mozilla.exe C:\Program Files\eAcceleration\Station\station.exe C:\Program Files\eAcceleration\Station\station_bk.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = I R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ˆ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = úp’w F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file) O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file) O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file) O2 - BHO: (no name) - {45383823-0C19-4C5D-B9C2-C44C53D97B4C} - C:\WINDOWS\system32\xxyyaWQg.dll (file missing) O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file) O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file) O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file) O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file) O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file) O2 - BHO: (no name) - {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - C:\WINDOWS\system32\opnnlLff.dll (file missing) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file) O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file) O2 - BHO: (no name) - {9cac3cda-d467-85c1-15e7-a38f00227ce0} - C:\WINDOWS\system32\tpl.dll (file missing) O2 - BHO: e404 helper - {c03fd59d-9104-44b7-929a-9eaa0ba05211} - C:\Program Files\Helper\1208809123.dll (file missing) O2 - BHO: (no name) - {c613ce22-151c-4331-94ff-f113a153f66d} - error (file missing) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: DVA Storm - {f87141ce-278d-49a0-ae0a-c33ebb863537} - C:\WINDOWS\qnmargolxpg.dll O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file) O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: dpevflbg - {859D10F7-0E0F-43A8-8DF7-EC0466A40301} - C:\WINDOWS\dpevflbg.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll",VerifyStatus O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll",VerifyStatus O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k O4 - HKLM\..\Run: [StopSignSsFwMon] Rundll32.exe "C:\Program Files\eAcceleration\Firewall\ssfwmon.dll",VerifyStatus O4 - HKLM\..\Run: [OnAccess] "C:\Program Files\eAcceleration\OnAccess\onaccess.exe" -erk O4 - HKLM\..\Run: [xepglwpg] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\xepglwpg.dll" O4 - HKLM\..\Run: [WebAplApi] C:\Documents and Settings\All Users\Application Data\Common\vgdidazs.exe O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Erin and Charlie\cftmon.exe O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe O4 - HKLM\..\Run: [e8b12e5b] rundll32.exe "C:\WINDOWS\system32\mrflbeqk.dll",b O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\system32\icasServ.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [asaqelbj] C:\WINDOWS\system32\uvozgdqf.exe O4 - HKCU\..\Run: [Sen] "C:\WINDOWS\TSKS~1\cmd.exe" -vt yazb O4 - HKCU\..\Run: [Tvnmm] C:\WINDOWS\system32\M?crosoft\e?plorer.exe O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Erin and Charlie\cftmon.exe O4 - HKLM\..\Policies\Explorer\Run: [Ozrf1i6d5f] C:\Documents and Settings\All Users\Application Data\wvabuvqr\wbcfwruh.exe O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [InetChk] C:\WINDOWS\TEMP\ms1209071492.exe work (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {24BE56F9-F0B6-4ac7-97F1-8CACEDA9A427} - C:\PROGRA~1\ACCELE~1\StopSign\webcbrowse.dll O9 - Extra 'Tools' menuitem: Block This Page - {24BE56F9-F0B6-4ac7-97F1-8CACEDA9A427} - C:\PROGRA~1\ACCELE~1\StopSign\webcbrowse.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} - http://intranet.ntc.edu/qp2.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} (MediaControl Class) - http://entriq.vo.llnwd.net/o1/NBCUniversal...0_15_Silent.cab O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal...sal_1_0_0_9.cab O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2CF24C0E-F912-4C83-8146-10F044CE0722}: NameServer = 85.255.115.69,85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\..\{4BBC421E-2FFD-4134-8D03-F5145890075F}: NameServer = 85.255.115.69,85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\..\{6F76A79F-3FDD-4230-8A51-D4EC3C03BB48}: NameServer = 85.255.115.69,85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\..\{B257D7E8-71E8-4B7D-AE43-6906EB0F28AC}: NameServer = 85.255.115.69,85.255.112.7 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.7 O20 - Winlogon Notify: opnnllff - opnnlLff.dll (file missing) O21 - SSODL: UnknownDrive - {984ee551-8974-4ea3-86bc-972c67babd16} - C:\WINDOWS\Resources\UnknownDrive.dll (file missing) O21 - SSODL: zip - {3ef620f1-86e8-4a4f-843c-58a6ae807ffc} - C:\WINDOWS\Installer\{3ef620f1-86e8-4a4f-843c-58a6ae807ffc}\zip.dll (file missing) O21 - SSODL: vadokmxt - {F2ADEE91-D092-44B0-8721-A378BDD0C6B2} - C:\WINDOWS\vadokmxt.dll O21 - SSODL: wdpoefan - {DE15E7FD-4181-4A2F-9FD6-A4CFC705F9B8} - C:\WINDOWS\wdpoefan.dll O21 - SSODL: kRnvR - {E8B12EF5-421B-845F-A444-6EFABDEE9A4C} - C:\WINDOWS\system32\vk.dll O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DHCP Client DhcpADVService (dhcpadvservice) - Unknown owner - C:\WINDOWS\system32\aaaamonf.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: eAcceleration Notification Service (eac_notifysvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_svc.exe O23 - Service: eAcceleration Product Manager Service (eac_productsvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: FWService - eAcceleration Corp - C:\Program Files\eAcceleration\Firewall\FWService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\winself.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: OpenCASE Media Agent - ExtendMedia Inc. - C:\Program Files\OpenCASE\OpenCASE Media Agent\MediaAgent.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing) O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe O23 - Service: Wireless Zero Configuration WZCSVCRasAuto (wzcsvcrasauto) - Unknown owner - C:\WINDOWS\system32\6C8C8E3348v.exe O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm -- End of file - 16670 bytes here is the uninstall txt ABBYY FineReader 5.0 Sprint Plus Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Default Language CS3 Adobe ExtendScript Toolkit 2 Adobe Flash Player ActiveX Adobe Flash Player Plugin Adobe Fonts All Adobe Help Viewer CS3 Adobe InDesign CS3 Adobe InDesign CS3 Adobe InDesign CS3 Icon Handler Adobe Linguistics CS3 Adobe PDF Library Files Adobe Reader 7.0 Adobe Setup Adobe Shockwave Player Adobe SING CS3 Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 ALPS Touch Pad Driver Amazon Unbox Video America Online (Choose which version to remove) AOL Coach Version 1.0(Build:20040229.1 en) AOL Connectivity Services AOL Instant Messenger AOLIcon Banctec Service Agreement Broadcom Management Programs 2 BUM Canon Camera Support Core Library Canon Camera Window for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon RemoteCapture Task for ZoomBrowser EX Canon Utilities PhotoStitch 3.1 Canon Utilities ZoomBrowser EX CDex extraction audio Cliprex DS DVD Player CoffeeCup Flash Website Font Conexant D110 MDC V.9x Modem Dell Driver Reset Tool Dell Media Experience Dell Photo AIO Printer 922 Dell Picture Studio v3.0 Dell Support Center DellSupport Digital Line Detect DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player eAcceleration - StopSign Popup Blocker EarthLink setup files Entriq MediaSphere 3.6.0.15 ffdshow (remove only) FileZilla Client 3.0.5.2 FreeRIP v2.96 FriendBlasterPro Google Toolbar for Internet Explorer HijackThis 2.0.0 Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Intel® Graphics Media Accelerator Driver for Mobile Intel® PROSet/Wireless Software Internal Network Card Power Management Internet Explorer Default Page iTunes Jasc Paint Shop Photo Album Jasc Paint Shop Photo Album 5 Jasc Paint Shop Pro 8 Dell Edition Jasc Paint Shop Pro Studio, Dell Editon Jasc Paint Shop Pro Studio.01 , Dell Edition 1.0.1.1 Patch Java 2 Runtime Environment, SE v1.4.2_03 Java™ 6 Update 3 Java™ 6 Update 5 LaSofStuf InVerse (remove only) Lernout & Hauspie TruVoice American English TTS Engine LimeWire 4.14.10 Macromedia Flash Player mCore mDrWiFi mHlpDell Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft User-Mode Driver Framework Feature Pack 1.0 mIWA mIWCA mLogView mMHouse Modem Helper Mozilla (1.7.13) MP3 Converter Simple mPfMgr mPfWiz mProSafe mSSO MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) mToolkit Musicmatch® Jukebox mWlsSafe mXML mZConfig Netflix Movie Viewer NetWaiting OpenCASE Media Agent OverDrive Media Console PageBreeze Free HTML Editor Panda ActiveScan 2.0 PANTECH PC Card Software PDF Settings Pdf995 PdfEdit995 Picasa 2 PowerDVD 5.5 QuickBooks Simple Start Special Edition QuickLink Mobile QuickTime RealPlayer Registry Mechanic 5.0 SC Audio DJ Mixer 2.3.0.0 Scripture Memory System Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944338) Security Update for Windows XP (KB944533) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB947864) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Sonic Audio module Sonic DLA Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager StopSign by eAcceleration SysSnap TaxCut Basic 2006 Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB946627) Verizon High Speed Internet Verizon Online DSL Viewpoint Media Player WebCyberCoach 3.2 Dell WebVideo Support Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 10 Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB893086 WinRAR archiver WordPerfect Office 12 Xvid 1.1.2 final uninstall Yahoo! extras Yahoo! Install Manager Thanks! |
 |
 
|
|
Apr 27 2008, 06:50 PM
Post
#2
|
|
 Moderator / Malware Staff  Posts: 2,372 From: USA OS: Windows XP professional |
Hello and welcome to Geeks To Go! My name is BHowett and I will be helping you to get sorted. If for any reason you do not understand any of the instructions, or are just unsure then please do not guess , simply post back with your question, and we will go through it again.
The fixes may take several attempts and my replies may take some time but stick with it, and we will be sure to get you sorted. I am reviewing your log, and will post your first set of instructions shortly. |
|
|
|
|
Apr 27 2008, 07:39 PM
Post
#3
|
|
|
Moderator / Malware Staff Posts: 2,372 From: USA OS: Windows XP professional |
Hi CharlieSal7,
You have a lot of nasty stuff going on here… lets see what we can do. FixWareout Please download FixWareout from here: http://downloads.subratam.org/Fixwareout.exe Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. If your firewall gives an alert, (because this tool will download an additional file from the internet), please don't let your firewall block it, but allow it instead. Then you will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal. Once the desktop loads please post the text that will open (report.txt) and a new Hijackthis log =============================================== SDFix Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
=============================================== ComboFix Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** =============================================== Needed in you next reply: FixWareout (report.txt) SDFix Report.txt ComboFix.txt" new HijackThis log Also let me know if things are running better  |
|
|
|
|
Apr 27 2008, 10:33 PM
Post
#4
|
|
|
Member Posts: 11 OS: xp |
Wow, thanks for the help. Things have been running much better so far. Here are the reports. Thanks again, Charlie Username "Erin and Charlie" - 04/27/2008 21:46:55 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters "nameserver"="85.255.115.69 85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{2CF24C0E-F912-4C83-8146-10F044CE0722} "nameserver"="85.255.115.69,85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{4BBC421E-2FFD-4134-8D03-F5145890075F} "nameserver"="85.255.115.69,85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{6F76A79F-3FDD-4230-8A51-D4EC3C03BB48} "nameserver"="85.255.115.69,85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{B257D7E8-71E8-4B7D-AE43-6906EB0F28AC} "nameserver"="85.255.115.69,85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{2810EB22-763D-4D0C-9450-64BBD1758685} "DhcpNameServer"="85.255.115.69,85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{2CF24C0E-F912-4C83-8146-10F044CE0722} "DhcpNameServer"="85.255.115.69,85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{4BBC421E-2FFD-4134-8D03-F5145890075F} "DhcpNameServer"="85.255.115.69,85.255.112.7" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{6F76A79F-3FDD-4230-8A51-D4EC3C03BB48} "DhcpNameServer"="85.255.115.69,85.255.112.7" <Value cleared. Successfully flushed the DNS Resolver Cache. System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "System"="" .... .... ~~~~~ Misc files. .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\\Program Files\\Apoint\\Apoint.exe" "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe\"" "IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless" "PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\"" "DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "Dell Photo AIO Printer 922"="\"C:\\Program Files\\Dell Photo AIO Printer 922\\dlbtbmgr.exe\"" "DLBTCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\DLBTtime.dll,_RunDLLEntry@16" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "dscactivate"="\"C:\\Program Files\\Dell Support Center\\gs_agent\\custom\\dsca.exe\"" "RegistryMechanic"="" "SoftwareStation"="\"C:\\Program Files\\eAcceleration\\Station\\station.exe\" /b Startup" "StopSignSsTsMon"="Rundll32.exe \"C:\\Program Files\\Acceleration Software\\Anti-Virus\\sstsmon.dll\",VerifyStatus" "StopSignSsSsMon"="Rundll32.exe \"C:\\Program Files\\Acceleration Software\\Anti-Virus\\ssssmon.dll\",VerifyStatus" "webscan"="\"C:\\Program Files\\Acceleration Software\\Anti-Virus\\stopsignav.exe\" -k" "StopSignSsFwMon"="Rundll32.exe \"C:\\Program Files\\eAcceleration\\Firewall\\ssfwmon.dll\",VerifyStatus" "OnAccess"="\"C:\\Program Files\\eAcceleration\\OnAccess\\onaccess.exe\" -erk" "xepglwpg"="regsvr32 /u \"C:\\Documents and Settings\\All Users\\Application Data\\xepglwpg.dll\"" "ntuser"="C:\\WINDOWS\\system32\\drivers\\spools.exe" "autoload"="C:\\Documents and Settings\\Erin and Charlie\\cftmon.exe" "e8b12e5b"="rundll32.exe \"C:\\WINDOWS\\system32\\mrflbeqk.dll\",b" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe" "DellSupport"="\"C:\\Program Files\\DellSupport\\DSAgnt.exe\" /startup" "Sen"="\"C:\\WINDOWS\\TSKS~1\\cmd.exe\" -vt yazb" "Tvnmm"="C:\\WINDOWS\\system32\\M?crosoft\\e?plorer.exe" "ntuser"="C:\\WINDOWS\\system32\\drivers\\spools.exe" "autoload"="C:\\Documents and Settings\\Erin and Charlie\\cftmon.exe" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater] .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~ SDFix: Version 1.176 Run by Erin and Charlie on Sun 04/27/2008 at 10:21 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name : fkjdfje Path : \??\C:\WINDOWS\fkjdfje.sys fkjdfje - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default Desktop Wallpaper Restoring Default Schedule Service Path Rebooting Checking Files : Trojan Files Found: C:\-39104~1 - Deleted C:\WINDOWS\mgwwgmke\1.png - Deleted C:\WINDOWS\mgwwgmke\2.png - Deleted C:\WINDOWS\mgwwgmke\3.png - Deleted C:\WINDOWS\mgwwgmke\4.png - Deleted C:\WINDOWS\mgwwgmke\5.png - Deleted C:\WINDOWS\mgwwgmke\6.png - Deleted C:\WINDOWS\mgwwgmke\7.png - Deleted C:\WINDOWS\mgwwgmke\8.png - Deleted C:\WINDOWS\mgwwgmke\9.png - Deleted C:\WINDOWS\mgwwgmke\bottom-rc.gif - Deleted C:\WINDOWS\mgwwgmke\config.png - Deleted C:\WINDOWS\mgwwgmke\content.png - Deleted C:\WINDOWS\mgwwgmke\download.gif - Deleted C:\WINDOWS\mgwwgmke\frame-bg.gif - Deleted C:\WINDOWS\mgwwgmke\frame-bottom-left.gif - Deleted C:\WINDOWS\mgwwgmke\frame-h1bg.gif - Deleted C:\WINDOWS\mgwwgmke\head.png - Deleted C:\WINDOWS\mgwwgmke\icon.png - Deleted C:\WINDOWS\mgwwgmke\indexwp.html - Deleted C:\WINDOWS\mgwwgmke\main.css - Deleted C:\WINDOWS\mgwwgmke\memory-prots.png - Deleted C:\WINDOWS\mgwwgmke\net.png - Deleted C:\WINDOWS\mgwwgmke\pc.gif - Deleted C:\WINDOWS\mgwwgmke\pc-mag.gif - Deleted C:\WINDOWS\mgwwgmke\poloska1.png - Deleted C:\WINDOWS\mgwwgmke\poloska2.png - Deleted C:\WINDOWS\mgwwgmke\poloska3.png - Deleted C:\WINDOWS\mgwwgmke\promowp1.html - Deleted C:\WINDOWS\mgwwgmke\promowp2.html - Deleted C:\WINDOWS\mgwwgmke\promowp3.html - Deleted C:\WINDOWS\mgwwgmke\promowp4.html - Deleted C:\WINDOWS\mgwwgmke\promowp5.html - Deleted C:\WINDOWS\mgwwgmke\reg.png - Deleted C:\WINDOWS\mgwwgmke\repair.png - Deleted C:\WINDOWS\mgwwgmke\scr-1.png - Deleted C:\WINDOWS\mgwwgmke\scr-2.png - Deleted C:\WINDOWS\mgwwgmke\start.png - Deleted C:\WINDOWS\mgwwgmke\styles.css - Deleted C:\WINDOWS\mgwwgmke\top-rc.gif - Deleted C:\WINDOWS\mgwwgmke\vline.gif - Deleted C:\WINDOWS\mgwwgmke\wp.png - Deleted C:\WINDOWS\default.htm - Deleted C:\WINDOWS\sys.log - Deleted C:\WINDOWS\Temp\SALM.EXE - Deleted C:\WINDOWS\Web\def.htm - Deleted C:\WINDOWS\fkjdfje.sys - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-27 22:36:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\clb.dll] "0"=hex:00,00,28,0a,01,00,05,00 "1"=hex:b6,00,b6,eb,2f,6b,03,cb,5a,e8,c3,ac,b9,40,38,e1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\clbcatex.dll] "0"=hex:2a,00,3e,11,0c,00,d1,07 "1"=hex:cf,24,2a,85,a4,d7,fe,3c,03,76,96,fe,18,b6,ec,d3 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\clbcatq.dll] "0"=hex:2a,00,3e,11,0c,00,d1,07 "1"=hex:6a,b7,9d,1d,7d,d8,1d,46,23,79,12,2a,da,6a,19,42 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys] @="driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\clbdriver.sys] @="driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver] "start"=dword:00000001 "type"=dword:00000001 "imagepath"=str(2):"\??\globalroot\systemroot\system32\drivers\clbdriver.sys" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Nls\MUILanguages\RCV2\clb.dll] "0"=hex:00,00,28,0a,01,00,05,00 "1"=hex:b6,00,b6,eb,2f,6b,03,cb,5a,e8,c3,ac,b9,40,38,e1 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Nls\MUILanguages\RCV2\clbcatex.dll] "0"=hex:2a,00,3e,11,0c,00,d1,07 "1"=hex:cf,24,2a,85,a4,d7,fe,3c,03,76,96,fe,18,b6,ec,d3 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Nls\MUILanguages\RCV2\clbcatq.dll] "0"=hex:2a,00,3e,11,0c,00,d1,07 "1"=hex:6a,b7,9d,1d,7d,d8,1d,46,23,79,12,2a,da,6a,19,42 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\Minimal\clbdriver.sys] @="driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\Network\clbdriver.sys] @="driver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\clbdriver] "start"=dword:00000001 "type"=dword:00000001 "imagepath"=str(2):"\??\globalroot\systemroot\system32\drivers\clbdriver.sys" scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\clbImageData] "affid"="7" "subid"="0" "prov"="10010" "paneladserver"="http://update.microsofttransfer.com/adsensegen.php" "googleadserver"="pagead2.googlesyndication.com" "server"="72.232.212.29" "flagged"=dword:00000001 scanning hidden files ... C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\clbcatex.dll 110080 bytes executable C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\clbcatq.dll 498688 bytes executable C:\WINDOWS\system32\drivers\clbdriver.sys 7168 bytes executable C:\WINDOWS\system32\clb.dll 10752 bytes executable C:\WINDOWS\system32\clbcatex.dll 110080 bytes executable C:\WINDOWS\system32\clbcatq.dll 498688 bytes executable C:\WINDOWS\system32\clbcfg.dat 1695 bytes C:\WINDOWS\system32\clbdll.dll 28160 bytes executable C:\WINDOWS\$NtUninstallKB902400$\clbcatex.dll 110080 bytes executable C:\WINDOWS\$NtUninstallKB902400$\clbcatq.dll 501248 bytes executable C:\Program Files\Common Files\Real\Plugins\clbascauth.dll 41023 bytes executable scan completed successfully hidden processes: 0 hidden services: 1 hidden files: 11 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0" "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater" "C:\\Program Files\\Kodak\\Kodak EasyShare Software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare Software\\bin\\EasyShare.exe:*:Enabled:EasyShare" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\FriendBlasterPro\\FriendBlasterPro.exe"="C:\\Program Files\\FriendBlasterPro\\FriendBlasterPro.exe:*:Enabled:FriendBlasterPro" "C:\\Program Files\\Kontiki\\KService.exe"="C:\\Program Files\\Kontiki\\KService.exe:*:Enabled:Delivery Manager Service" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Conference\\Conference.dll"="C:\\Program Files\\Conference\\Conference.dll:*:Enabled:Audio/Video Conference" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Wed 1 Sep 2004 54,384 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe" Wed 1 Sep 2004 156,784 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe" Wed 1 Sep 2004 31,344 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe" Thu 18 Oct 2007 5,903,928 A..H. --- "C:\Program Files\Picasa2\setup.exe" Mon 21 Apr 2008 23,040 A.SH. --- "C:\WINDOWS\system32\1025u.dll" Sun 16 Jul 2006 56 ..SHR --- "C:\WINDOWS\system32\6C8C8E3348.sys" Mon 21 Apr 2008 37,888 A.SHR --- "C:\WINDOWS\system32\aaaamonf.exe" Sun 16 Jul 2006 1,890 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Wed 4 Aug 2004 1,028,096 ...H. --- "C:\WINDOWS\system32\mfc42.dll" Wed 4 Aug 2004 54,784 ...H. --- "C:\WINDOWS\system32\msvcirt.dll" Wed 4 Aug 2004 565,760 ...H. --- "C:\WINDOWS\system32\msvcp50.dll" Wed 4 Aug 2004 413,696 ...H. --- "C:\WINDOWS\system32\msvcp60.dll" Wed 4 Aug 2004 343,040 ...H. --- "C:\WINDOWS\system32\msvcrt.dll" Wed 4 Aug 2004 253,952 ...H. --- "C:\WINDOWS\system32\msvcrt20.dll" Wed 4 Aug 2004 61,440 ...H. --- "C:\WINDOWS\system32\msvcrt40.dll" Sun 20 Apr 2008 89,088 ..SHR --- "C:\WINDOWS\T?sks\cmd.exe" Mon 28 Jan 2008 13 ...H. --- "C:\Documents and Settings\All Users\Application Data\ys.sys" Mon 6 Aug 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 14 Nov 2007 25,600 ...H. --- "C:\Documents and Settings\cs\My Documents\~WRL4097.tmp" Tue 6 Jun 2006 75,776 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL0056.tmp" Tue 6 Jun 2006 77,312 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL0109.tmp" Tue 6 Jun 2006 75,776 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL0816.tmp" Wed 7 Jun 2006 539,136 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL0906.tmp" Tue 6 Jun 2006 76,288 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL0988.tmp" Fri 2 Feb 2007 24,576 ...H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1040.tmp" Tue 6 Jun 2006 71,168 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1123.tmp" Tue 6 Jun 2006 72,704 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1326.tmp" Tue 6 Jun 2006 71,680 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1411.tmp" Tue 6 Jun 2006 71,168 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1755.tmp" Tue 6 Jun 2006 55,808 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1828.tmp" Tue 6 Jun 2006 71,168 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1856.tmp" Tue 6 Jun 2006 64,512 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL1883.tmp" Tue 6 Jun 2006 76,288 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2040.tmp" Tue 6 Jun 2006 74,240 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2047.tmp" Tue 6 Jun 2006 77,824 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2197.tmp" Wed 7 Jun 2006 235,008 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2234.tmp" Wed 7 Jun 2006 542,720 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2344.tmp" Tue 6 Jun 2006 71,680 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2352.tmp" Tue 6 Jun 2006 77,312 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2936.tmp" Tue 6 Jun 2006 77,312 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL2969.tmp" Mon 26 Jun 2006 39,424 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL3254.tmp" Tue 6 Jun 2006 75,776 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL3467.tmp" Tue 6 Jun 2006 71,168 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL3613.tmp" Tue 6 Jun 2006 63,488 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL3665.tmp" Tue 6 Jun 2006 62,976 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL3796.tmp" Wed 7 Jun 2006 323,072 A..H. --- "C:\Documents and Settings\Erin and Charlie\My Documents\~WRL3962.tmp" Sun 6 Apr 2008 66,560 A.SH. --- "C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP392\A0043965.dll" Mon 7 Apr 2008 66,560 A.SH. --- "C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP397\A0044204.dll" Tue 8 Apr 2008 66,560 A.SH. --- "C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP397\A0044237.dll" Tue 8 Apr 2008 66,560 A.SH. --- "C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP399\A0044276.dll" Tue 8 Apr 2008 66,560 A.SH. --- "C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP400\A0044738.dll" Tue 8 Apr 2008 66,560 A.SH. --- "C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP402\A0044916.dll" Tue 8 Apr 2008 66,560 A.SH. --- "C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586 |