Logfile of HijackThis v1.99.1
Scan saved at 5:39:45 PM, on 6/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\AOL\1144028886\ee\AOLSoftware.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ea91384e.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Documents and Settings\ShadowX\Desktop\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {DCE9D58D-EDDB-4EAA-9ACA-5F4F100E8502} - (no file)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1144028886\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ea91384e.exe] C:\WINDOWS\system32\ea91384e.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ea91384e.exe] C:\Documents and Settings\ShadowX\Local Settings\Application Data\ea91384e.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1143996173843
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: vtstq - C:\WINDOWS\system32\vtstq.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PinnacleUpdate Service (PinnacleUpdateSvc) - KALiNKOsoft - C:\Program Files\KALiNKOsoft\Pinnacle Game Profiler\pinnacle_updater.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Here's my Two logs of ewidos one of like 2 days ago and then the recent one i did like 1 hour ago:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 5:50:57 PM, 6/16/2006
+ Report-Checksum: F1F60F23
+ Scan result:
:mozilla.7:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.10:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned with backup
:mozilla.12:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned with backup
:mozilla.16:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.17:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.18:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.19:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.20:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.21:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.22:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.23:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.24:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.25:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.26:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.27:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.28:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.30:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\ShadowX\Cookies\shadowx@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\ShadowX\Cookies\[email protected][2].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\ShadowX\Cookies\shadowx@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Program Files\Cain\Abel.dll -> Not-A-Virus.PSWTool.Win32.Cain.f : Cleaned with backup
C:\Program Files\Cain\Abel.exe -> Not-A-Virus.PSWTool.Win32.Cain.e : Cleaned with backup
C:\Program Files\MUGEN\Misc MUGEN files\gca_v09k.exe -> Trojan.Regspy : Cleaned with backup
C:\WINDOWS\system32\ssqqqnl.dll -> Adware.Virtumonde : Cleaned with backup
::Report End
Recent One:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 4:23:05 PM, 6/17/2006
+ Report-Checksum: 89E27F23
+ Scan result:
:mozilla.9:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.10:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.11:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.12:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.17:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.18:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.19:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.20:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.22:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.27:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.28:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.29:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.65:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.68:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.70:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.71:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.72:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.73:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.76:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.77:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.78:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.79:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.80:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.81:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.82:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.83:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.87:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned with backup
:mozilla.88:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.103:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup
:mozilla.104:C:\Documents and Settings\ShadowX\Application Data\Mozilla\Firefox\Profiles\73hqpshw.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
::Report End
I'm betting i'm still infected. My pc moves so slow even when i stop all my programs except 4 it still goes slow. Thank you for taking your time out to read this.