This topic is locked
My desk top turned black with a purple hue surrounding all my icons. In red, there is a large text message saying my computer is infected and what my IP addres is further explaining I should seek antispyware assistance. I then started getting a little yellow triangle on my toolbar that when I clicked stated I have Trojandownloader.xs. When I click the link to go to the Microsoft web page for instructions on what to do Explorer opens up a page that is trying to sell me a spyware removal program. I also get alot of additional pop ups.
What I have tried so far is what you say to do in your before you post section. Here are my log files:
ActiveScan Report
Incident Status Location
Adware:Adware/SpywareDetect Not disinfected C:\WINDOWS\system32\vvgeowbv.exe
Adware:adware/eshopper Not disinfected c:\windows\system32\ESHOPEE.exe
Adware:adware/popuper Not disinfected c:\windows\system32\msole32.exe
Potentially unwanted tool:application/activitymon Not disinfected c:\program files\amsys
Adware:adware/activshopper Not disinfected c:\program files\e-zshopper
Adware:adware/adbars Not disinfected Windows Registry
Adware:adware/mirar Not disinfected Windows Registry
Dialer:dialer.xd Not disinfected HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}
Adware:adware/activesearch Not disinfected Windows Registry
Adware:adware/deskwizz Not disinfected Windows Registry
Adware:adware/404search Not disinfected Windows Registry
Adware:adware/adblaster Not disinfected Windows Registry
Adware:adware/adsincontext Not disinfected Windows Registry
Potentially unwanted tool:application/funweb Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
Adware:Adware/Yazzle Not disinfected C:\1A01.tmp
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@2o7[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@adrevolver[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@adrevolver[3].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@burstnet[1].txt
Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@did-it[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@doubleclick[1].txt
Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@enhance[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@statcounter[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Lisa Lewis\Desktop\SmitfraudFix\Process.exe
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\Lisa Lewis\Desktop\SmitfraudFix\Reboot.exe
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\Lisa Lewis\Desktop\SmitfraudFix\restart.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Lisa Lewis\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Virus:Trj/Rebooter.J Disinfected C:\Documents and Settings\Lisa Lewis\Desktop\SmitfraudFix.zip[SmitfraudFix/Reboot.exe]
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\Lisa Lewis\Desktop\SmitfraudFix.zip[SmitfraudFix/restart.exe]
Adware:Adware/SpyAway Not disinfected C:\WINDOWS\fkwggshm.exe
Virus:Generic Trojan Disinfected C:\WINDOWS\system32\i8\taldrvr11.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
Virus:Generic Malware Disinfected C:\WINDOWS\tsitra72.exe
Spyware:Cookie/Cgi-bin Not disinfected E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@cgi-bin[2].txt
Spyware:Cookie/Cgi-bin Not disinfected E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@cgi-bin[3].txt
Spyware:Cookie/did-it Not disinfected E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@did-it[1].txt
Spyware:Cookie/Go Not disinfected E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@go[1].txt
Spyware:Cookie/Target Not disinfected E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@target[2].txt
Spyware:Cookie/Advnt Not disinfected E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
Spyware:Cookie/Affiliate fuel Not disinfected E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
--------------------------------------------------------------------------------
SUPERAntiSpyware Scan Log
Generated 10/30/2007 at 06:25 PM
Application Version : 3.6.1000
Core Rules Database Version : 3333
Trace Rules Database Version: 1334
Scan type : Complete Scan
Total Scan Time : 01:00:49
Memory items scanned : 314
Memory threats detected : 0
Registry items scanned : 4162
Registry threats detected : 68
File items scanned : 67074
File threats detected : 82
Unclassified.Unknown Origin
HKLM\Software\Classes\CLSID\{696C6D97-CAC8-4961-B9B4-260C48A2DB5F}
HKCR\CLSID\{696C6D97-CAC8-4961-B9B4-260C48A2DB5F}
HKCR\CLSID\{696C6D97-CAC8-4961-B9B4-260C48A2DB5F}
HKCR\CLSID\{696C6D97-CAC8-4961-B9B4-260C48A2DB5F}\InProcServer32
HKCR\CLSID\{696C6D97-CAC8-4961-B9B4-260C48A2DB5F}\InProcServer32#ThreadingModel
C:\PROGRAM FILES\MSN GAMING ZONE\HOKE4444.DLL
HKLM\Software\Classes\CLSID\{6D720B5C-B835-45B1-A0C2-65C97BC7A0C9}
HKCR\CLSID\{6D720B5C-B835-45B1-A0C2-65C97BC7A0C9}
HKCR\CLSID\{6D720B5C-B835-45B1-A0C2-65C97BC7A0C9}
HKCR\CLSID\{6D720B5C-B835-45B1-A0C2-65C97BC7A0C9}\InProcServer32
HKCR\CLSID\{6D720B5C-B835-45B1-A0C2-65C97BC7A0C9}\InProcServer32#ThreadingModel
C:\PROGRAM FILES\MSN GAMING ZONE\HOKE83122.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{696C6D97-CAC8-4961-B9B4-260C48A2DB5F}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D720B5C-B835-45B1-A0C2-65C97BC7A0C9}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}
Adware.AdBreak
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}
411Ferret Toolbar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12F02779-6D88-4958-8AD3-83C12D86ADC7}
Adware.AdBlaster
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}
AdBars BHO
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}
Adware.404Search
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}
Adware.Accoona
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}
Trojan.PBar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}
Adware.k8l
C:\PROGRAM FILES\UNINSTALL INFORMATION\PROFSYCY.HTML
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Source
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#SubscribedURL
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#FriendlyName
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Flags
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Position
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#CurrentState
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#OriginalStateInfo
HKU\S-1-5-21-602162358-1326574676-682003330-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#RestoredStateInfo
Adware.Tracking Cookie
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@doubleclick[1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@zedo[1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@fastclick[2].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@hitbox[1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@directtrack[1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@specificclick[2].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@mediaplex[1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@questionmarket[2].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@atdmt[1].txt
C:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@advertising[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@AdBanner[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@adcentriconline[2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@adecn[2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@adknowledge[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@atwola[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@azjmp[2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@belnk[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@commonsensemedia[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@interclick[2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@kanoodle[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@nextag[2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@partner2profit[2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@windowsmedia[1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][1].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa [email protected][2].txt
E:\Documents and Settings\Lisa Lewis\Cookies\lisa lewis@xiti[1].txt
Trojan.NetMon/DNSChange
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#DeviceDesc
Trojan.cmdService
HKLM\SYSTEM\CurrentControlSet\Services\cmdService
HKLM\SYSTEM\CurrentControlSet\Services\cmdService#Type
HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum
HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#0
HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#Count
HKLM\SYSTEM\CurrentControlSet\Services\cmdService\Enum#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#DeviceDesc
Adware.Mirar/NetNucleus
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}#SystemComponent
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}#Installer
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\Contains
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\Contains\Files
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\Contains\Files#C:\WINDOWS\system32\WinATS.dll
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\DownloadInformation
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\DownloadInformation#CODEBASE
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\DownloadInformation#INF
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\InstalledVersion
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDB-6E20-489C-9041-C1E8A0352E75}\InstalledVersion#LastModified
C:\WINDOWS\Downloaded Program Files\WinATS.inf
Adware.AdSponsor/ISM
HKU\.DEFAULT\Software\BndDrive
HKU\S-1-5-18\Software\BndDrive
Trojan.Downloader-Gen/MobRules
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\UTCTETUB.DLL
C:\WINDOWS\TQRGDYPQ.DLL
Adware.ClickSpring/Yazzle
C:\PROGRAM FILES\COMMON FILES\YAZZLE1122OINUNINSTALLER.EXE
Trojan.Downloader-Gen/WinAble-Installer
C:\PROGRAM FILES\TEMPORARY\WININSTALL.EXE
Trojan.ZQuest
C:\SYSTEM VOLUME INFORMATION\_RESTORE{130EA137-3C0C-4E9E-8430-9C612C0168F7}\RP481\A0024057.DLL
Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{130EA137-3C0C-4E9E-8430-9C612C0168F7}\RP481\A0024058.VBS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{130EA137-3C0C-4E9E-8430-9C612C0168F7}\RP481\A0024059.VBS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{130EA137-3C0C-4E9E-8430-9C612C0168F7}\RP481\A0024060.EXE
C:\WINDOWS\SYSTEM32\E2\CAWS83122.EXE
C:\WINDOWS\TTC-4444.EXE
Trojan.Rootkit-TnCore
C:\SYSTEM VOLUME INFORMATION\_RESTORE{130EA137-3C0C-4E9E-8430-9C612C0168F7}\RP481\A0024062.SYS
Trojan.ZQuest-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{130EA137-3C0C-4E9E-8430-9C612C0168F7}\RP481\A0024064.EXE
Trojan.Downloader-Gen/Installer
C:\WINDOWS\B111.EXE
C:\WINDOWS\B122.EXE
Trojan.Downloader-FakeRX
C:\WINDOWS\SYSTEM32\AIVSKURQ.DLL
Unclassified.Unknown Origin/System
C:\WINDOWS\SYSTEM32\ESHOPEE.EXE
Trojan.Fakespy-B
C:\WINDOWS\SYSTEM32\MSOLE32.EXE
--------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:17:11 PM, on 10/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\vvgeowbv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\BellSouth\File and Printer Sharing\BellSouthFPS\McciTrayApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kuma Games\hcsystray\hc_tray.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Documents and Settings\Lisa Lewis\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\vvgeowbv.exe,C:\WINDOWS\system32\userinit.exe
O1 - Hosts: 194.54.90.238 google.com
O1 - Hosts: 194.54.90.238 google.ca
O1 - Hosts: 194.54.90.238 www.google.com
O1 - Hosts: 194.54.90.238 search.yahoo.com
O1 - Hosts: 194.54.90.238 search.msn.com
O1 - Hosts: 194.54.90.238 search.live.com
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: 0 - {47D951BA-607C-445A-2B86-41D51E6E7FB2} - C:\Program Files\Uninstall Information\lavuna.dll (file missing)
O2 - BHO: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: aivskurq.msdn_hlp - {A6E432B4-D4C2-43B3-BF55-C364F8F7362A} - C:\WINDOWS\system32\aivskurq.dll (file missing)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {c5c98920-1dd1-11b2-a3b4-8f5d84426fb7} - C:\WINDOWS\tqrgdypq.dll (file missing)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O3 - Toolbar: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [BellSouthFPS_McciTrayApp] C:\PROGRA~1\BellSouth\File and Printer Sharing\BellSouthFPS\McciTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CheckWinPerf] C:\DOCUME~1\LISALE~1\LOCALS~1\Temp\iowjwkem.exe
O4 - HKLM\..\Run: [utctetub] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\utctetub.dll"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Pxiq] "C:\Documents and Settings\Lisa Lewis\My Documents\s?stem\d?dplay.exe"
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: hc_tray.lnk = C:\Program Files\Kuma Games\hcsystray\hc_tray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - https://disneyblast....wareControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1154400815757
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1154443889390
O16 - DPF: {7E9522CF-6B95-46D6-8E2F-7638F507313F} (BLS_SpeedOP.systemcheck) - http://www.fastacces...bls_speedop.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://pbells.broad...wActiveXCab.CAB
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 9079 bytes
I also tried the AVG Antispyware program but could not get a log along with the Panda online scan. I also updated all my windows updates available. Thank you in advance for any assistance you can give and If I need to send anything eles please just ask...
Thanks
IBOrange
Edited by Iborange, 31 October 2007 - 11:08 AM.
Sign In
Create Account
