Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Aurora virus [RESOLVED]

Started by SickofAurora , Jun 04 2005 05:07 PM

  • This topic is locked This topic is locked

#1
SickofAurora
Posted 04 June 2005 - 05:07 PM

SickofAurora

    Member

  • Member
  • PipPip
  • 12 posts
:help: I have tried all kinds of software - ad-aware/microsoft antispyware/spybot to get rid of the annoying pop ups but nothing seems to help. This is my work laptop & I need to get rid of this virus ASAP. Please help :tazz: ;)
  • 0

Advertisements

#2
Guest_usetobe_*
Posted 05 June 2005 - 03:37 AM

Guest_usetobe_*
  • Guest
Hi Sick,

Please post a HJT this log to this thread.

HJT. DOWNLOAD IT, UNZIP IT TO A NEW FOLDER THAT YOU MUST CREATE, CARRY OUT A SCAN AND POST THE LOG BACK
  • 0

#3
SickofAurora
Posted 05 June 2005 - 06:09 AM

SickofAurora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
Hello Usetobe,
Thank you for your response. I ran a series of scans last night, per instructions posted on your website.

Here is the Hijackthis Log.

Logfile of HijackThis v1.99.1
Scan saved at 8:06:18 AM, on 6/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Quicken Loans\VPN Client\cvpnd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINDOWS\System32\svchost.exe
C:\OfficeScan NT\ofcdog.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\qFax\qFaxTray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\ipatnaik.IPATNA448Y861\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rockworld/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rockworld/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://rockworld/
F3 - REG:win.ini: run=
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Trend OfficeScan ImageSetup] "C:\OfficeScan NT\ImgSetup.exe" "/000f1fa3cabb"
O4 - HKLM\..\Run: [SmartMSG Client] C:\Program Files\Codespear\SmartMSG\\Client\SmartMSGClient.exe
O4 - HKLM\..\Run: [qFaxTray] C:\Program Files\qFax\qFaxTray.exe toolbar
O4 - HKLM\..\Run: [qs7T3pO] xpopwd.exe
O4 - HKLM\..\Run: [regsync] C:\WINDOWS\System32\regsync.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bBo3Rfimh] capsip.exe
O4 - Global Startup: Avaya IP Softphone Reset.lnk = C:\Program Files\Avaya\IP Service Provider\pwreset.exe
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://lola.rockfin.com
O15 - Trusted Zone: http://*.liimgdbdev01 (HKLM)
O15 - Trusted Zone: http://*.liimgweb01 (HKLM)
O15 - Trusted Zone: http://*.qfax (HKLM)
O15 - Trusted Zone: http://*.ql1sssql1 (HKLM)
O15 - Trusted Zone: http://rockworld.mi.corp.rockfin.com (HKLM)
O15 - Trusted Zone: http://rockworldapps...orp.rockfin.com (HKLM)
O15 - Trusted Zone: http://*.rockworld (HKLM)
O15 - Trusted Zone: http://*.rockworldapps (HKLM)
O15 - Trusted Zone: http://*.termweb (HKLM)
O16 - DPF: {5445BE81-B796-11D2-B931-002018654E2E} (MeadCo Security Manager) - https://dcu.egain.ne...g/ie/SecMgr.cab
O16 - DPF: {62CEC9E0-3811-4C36-A94E-4F7565DCD23F} (DDSC Class) - http://liolap01/Dashboard/msddsc.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://termweb/msrdp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.c...ropper1_6us.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mi.corp.rockfin.com
O17 - HKLM\Software\..\Telephony: DomainName = mi.corp.rockfin.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mi.corp.rockfin.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Quicken Loans, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Quicken Loans\VPN Client\cvpnd.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iClarityQoSService - Unknown owner - C:\WINDOWS\System32\QosServM.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - C:\OfficeScan NT\tmlisten.exe
  • 0

#4
Guest_usetobe_*
Posted 05 June 2005 - 06:16 AM

Guest_usetobe_*
  • Guest
Hi Sick,

Is www.rockworld familiar to you?
  • 0

#5
SickofAurora
Posted 05 June 2005 - 06:17 AM

SickofAurora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
That's the company I work for..
  • 0

#6
Guest_usetobe_*
Posted 05 June 2005 - 06:29 AM

Guest_usetobe_*
  • Guest
2 more quick questions

Is qfax familiar to you

Is iclarity familiar to you
  • 0

#7
SickofAurora
Posted 05 June 2005 - 06:39 AM

SickofAurora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
Yes they are..

I am hoping the series of scans & downloading windows SP1 & 2 has helped, and will keep my fingers crossed and wait to hear from you.

Thanks Usetobe :tazz:
  • 0

#8
Guest_usetobe_*
Posted 05 June 2005 - 06:46 AM

Guest_usetobe_*
  • Guest
Hi Sick,

OK here we go. When you get to the section re HJT, Check the entries marked O15, if you entered them into Trusted Zone then DO NOT CHECK THEM, just they are not known to me

It looks like you have had a nasty nail infection, and i don't mean on your fingers and toes :tazz:

We are going to hit this with a big hammer.

Firstly please create a new folder on your C drive (for example C\HJT). Install HJT into that folder and run it from there. That way it can create backups if required.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://users.pandora...chy/nailfix.zip
Unzip it to the desktop but please do NOT run it yet.

Please download Cleanup from here:
Cleanup. Do not run it yet.

Set up PC to show hidden files.(Click link if you do not know how)
Show hidden files

Click Start > Run > and type in:

services.msc

Click OK.

In the services window find .Service: System Startup Service
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

Once in Safe Mode, please double-click on Nailfix.bat. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. This may take some time, so go grab a coffee. Once it finds the first issue tick the box for all. Post the log from the scan here for me.

Then please run HijackThis, click Scan, and check:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
F3 - REG:win.ini: run=
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKLM\..\Run: [qFaxTray] C:\Program Files\qFax\qFaxTray.exe toolbar
O4 - HKLM\..\Run: [qs7T3pO] xpopwd.exe
O4 - HKLM\..\Run: [regsync] C:\WINDOWS\System32\regsync.exe
O4 - HKCU\..\Run: [bBo3Rfimh] capsip.exe
O15 - Trusted Zone: http://*.liimgdbdev01 (HKLM)
O15 - Trusted Zone: http://*.liimgweb01 (HKLM)
O15 - Trusted Zone: http://*.ql1sssql1 (HKLM)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)


Close all open windows except for HijackThis and click Fix Checked.

Now using windows explorer locate and delete the following files/folders if found.

C:\WINDOWS\System32\vbrundll.dll
C:\WINDOWS\System32\regsync.exe
C:\WINDOWS\svcproc.exe
xpopwd.exe <<-- Carry out a search for this one
capsip.exe <<--Carry out a search for this one

Now run Cleanup

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
  • 0

#9
SickofAurora
Posted 05 June 2005 - 06:57 AM

SickofAurora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
When I clicked on your HJT link, it just downloaded an exe file, and I placed it on my desktop. Do I just move it to the new directory?
  • 0

#10
SickofAurora
Posted 05 June 2005 - 06:59 AM

SickofAurora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
And I did also run the clean up and Ewido last night.
  • 0

Advertisements

#11
Guest_usetobe_*
Posted 05 June 2005 - 06:59 AM

Guest_usetobe_*
  • Guest
Yep please, if you run it from desktop, it cannot create backups if required
  • 0

#12
Guest_usetobe_*
Posted 05 June 2005 - 07:00 AM

Guest_usetobe_*
  • Guest
Plerase do it again to follow the sequence to make sure we get everything
  • 0

#13
SickofAurora
Posted 05 June 2005 - 07:28 AM

SickofAurora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
I do not see a nailfix.bat file when I unzip nailfix. There's just an .ext & a .cmd
  • 0

#14
Guest_usetobe_*
Posted 05 June 2005 - 07:34 AM

Guest_usetobe_*
  • Guest
Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.
  • 0

#15
SickofAurora
Posted 05 June 2005 - 08:55 AM

SickofAurora

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
I am done running everything, Usetobe. And here are the log files:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:31:05 AM, 6/5/2005
+ Report-Checksum: C032192E

+ Date of database: 6/5/2005
+ Version of scan engine: v3.0

+ Duration: 42 min
+ Scanned Files: 61686
+ Speed: 23.93 Files/Second
+ Infected files: 1
+ Removed files: 1
+ Files put in quarantine: 1
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\WINDOWS\system32\vzzazz.exe -> TrojanDownloader.Qoologic.n -> Cleaned with backup


::Report End

ogfile of HijackThis v1.99.1
Scan saved at 10:32:16 AM, on 6/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\ipatnaik.IPATNA448Y861\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rockworld/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://rockworld/
F3 - REG:win.ini: run=
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Trend OfficeScan ImageSetup] "C:\OfficeScan NT\ImgSetup.exe" "/000f1fa3cabb"
O4 - HKLM\..\Run: [SmartMSG Client] C:\Program Files\Codespear\SmartMSG\\Client\SmartMSGClient.exe
O4 - HKLM\..\Run: [qFaxTray] C:\Program Files\qFax\qFaxTray.exe toolbar
O4 - HKLM\..\Run: [qs7T3pO] xpopwd.exe
O4 - HKLM\..\Run: [regsync] C:\WINDOWS\System32\regsync.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bBo3Rfimh] capsip.exe
O4 - Global Startup: Avaya IP Softphone Reset.lnk = C:\Program Files\Avaya\IP Service Provider\pwreset.exe
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\My Product Name\ieSpell.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://lola.rockfin.com
O15 - Trusted Zone: http://*.liimgdbdev01 (HKLM)
O15 - Trusted Zone: http://*.liimgweb01 (HKLM)
O15 - Trusted Zone: http://*.qfax (HKLM)
O15 - Trusted Zone: http://*.ql1sssql1 (HKLM)
O15 - Trusted Zone: http://rockworld.mi.corp.rockfin.com (HKLM)
O15 - Trusted Zone: http://rockworldapps...orp.rockfin.com (HKLM)
O15 - Trusted Zone: http://*.rockworld (HKLM)
O15 - Trusted Zone: http://*.rockworldapps (HKLM)
O15 - Trusted Zone: http://*.termweb (HKLM)
O16 - DPF: {5445BE81-B796-11D2-B931-002018654E2E} (MeadCo Security Manager) - https://dcu.egain.ne...g/ie/SecMgr.cab
O16 - DPF: {62CEC9E0-3811-4C36-A94E-4F7565DCD23F} (DDSC Class) - http://liolap01/Dashboard/msddsc.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://termweb/msrdp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.c...ropper1_6us.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mi.corp.rockfin.com
O17 - HKLM\Software\..\Telephony: DomainName = mi.corp.rockfin.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mi.corp.rockfin.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Quicken Loans, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Quicken Loans\VPN Client\cvpnd.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iClarityQoSService - Unknown owner - C:\WINDOWS\System32\QosServM.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - C:\OfficeScan NT\tmlisten.exe
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP