Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

HiJackThis Log: f0mered.exe and WindUpdates


  • This topic is locked This topic is locked

#1
ferret

ferret

    New Member

  • Member
  • Pip
  • 2 posts
Ok here my log, see below. I believe these 2 entries are bad but I can not get rid of them. They keep reappearing every time I "fix" them

O4 - HKLM\..\RunServices: [Start aThx Roll] f0mered.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -


Also, Adaware keeps highllighting the following problem which seems to be connected with one of the problem listed above. Adaware will not remove it permanently either. It keeps reappearing after every reboot.

WindUpdates Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\code store database\distribution units\{15ad4789-cdb4-47e1-a9da-992ee8e6bad6}



Can anybody help me here.


Logfile of HijackThis v1.99.1
Scan saved at 11:26:29 AM, on 8/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\csrss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\Explorer.EXE
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
I:\Program Files\Analog Devices\SoundMAX\Smtray.exe
I:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
I:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
I:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
J:\PowerDVD\PDVDServ.exe
I:\Program Files\QuickTime\qttask.exe
J:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
I:\WINDOWS\System32\ctfmon.exe
I:\WINDOWS\System32\alg.exe
I:\WINDOWS\Microsoft.NET\Framework\v2.0.40607\aspnet_admin.exe
I:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
I:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
I:\WINDOWS\System32\nvsvc32.exe
J:\Kerio\persfw.exe
I:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
I:\WINDOWS\System32\svchost.exe
J:\Utilities\xplorer2\xplorer2.exe
F:\Original_DownLoaded_Source\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.multiline.com.au/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = I:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = I:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Multiline Internet
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - J:\UTILIT~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] I:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Smapp] I:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [CloneCDTray] "I:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "I:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [AVG7_CC] I:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] I:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NVRTCLK] I:\WINDOWS\System32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [RemoteControl] J:\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "J:\Utilities\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\RunServices: [Start aThx Roll] f0mered.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] J:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = I:\Office2000\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\WINDOWS\System32\msjava.dll
O16 - DPF: ppctlcab - http://ppupdates.ca....er/ppctlcab.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca....r/axscanner.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = multiline.com.au
O17 - HKLM\Software\..\Telephony: DomainName = multiline.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = multiline.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 203.5.127.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 203.5.127.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - I:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - I:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - I:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - J:\Kerio\persfw.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - I:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  • 0

Advertisements


#2
ferret

ferret

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Well it seems people here are pretty busy and resources are stretched a bit thin so consider the thread closed.

I have now posted here and have got an initial response so I will stick with them and see where that leads.

Thanks
  • 0

#3
little eagle

little eagle

    Member

  • Member
  • PipPipPip
  • 170 posts
HaveN't I seen you some where before. :tazz:
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP