[Fate]

Well like others, I'm infected with W32.Desktophijack & Trojan.Desktophijack.B. Any help is greatly appreciated, thanks. Heres my Hijack This logfile:



Logfile of HijackThis v1.99.1
Scan saved at 12:34:47 AM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\NL0137~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {474BC714-CE9E-6D6E-EFD4-FC75E4F9B77C} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://candidcamera.....us/kxhcm10.ocx
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100387727293
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay10...ex/HMAtchmt.ocx
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[Advertisements]

Hi Fate and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"

3. Please DELETE your current HJT program from its present location.

4. Download and run the following HijackThis autoinstall program from Here HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

A. Close ALL windows except HJT

B. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')

C. POST the log in this thread using 'Add Reply' (Ctrl-V to 'paste')


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER


Regards,

Trevuren

[Trevuren]

Hi Fate and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"

3. Please DELETE your current HJT program from its present location.

4. Download and run the following HijackThis autoinstall program from Here HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

A. Close ALL windows except HJT

B. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')

C. POST the log in this thread using 'Add Reply' (Ctrl-V to 'paste')


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER


Regards,

Trevuren

[Fate]

Logfile of HijackThis v1.99.1
Scan saved at 12:13:38 PM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {474BC714-CE9E-6D6E-EFD4-FC75E4F9B77C} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://candidcamera.....us/kxhcm10.ocx
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100387727293
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay10...ex/HMAtchmt.ocx
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[Trevuren]

Hi Fate,

1. I want you to download and run a free trial version of an anti-trojan program called Trojan Hunter: Trojan Hunter . Let it scan your whole system and remove anything it finds.


2. Note any files that it is unable to delete and post them to me.

3.REBOOT your system.

4. Finally, run HijackThis, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

[Fate]

Logfile of HijackThis v1.99.1
Scan saved at 5:45:03 PM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {474BC714-CE9E-6D6E-EFD4-FC75E4F9B77C} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://candidcamera.....us/kxhcm10.ocx
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100387727293
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay10...ex/HMAtchmt.ocx
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[Trevuren]

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view (tab)
*choose to "show hidden files and folders,"
*uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
*Close the window with ok
*All hidden files will now be visible

Please RUN HijackThis.
. Click the SCAN button to produce a log.

Place a check mark beside each one of the following items:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {474BC714-CE9E-6D6E-EFD4-FC75E4F9B77C} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://candidcamera.....us/kxhcm10.ocx

Now with all the items selected, delete them by clicking the FIX checked button. Close the HijackThis window and Reboot Your System

Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everytjhing looks now.

Please tell me how the system is running.

Regards,

Trevuren

[Fate]

Logfile of HijackThis v1.99.1
Scan saved at 9:06:02 PM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100387727293
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay10...ex/HMAtchmt.ocx
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[Trevuren]

How is your system running now?

Trevuren

[Fate]

Norton Antivirus is still saying WININET.DLL and OLEADM.DLL are infected with
"W32.Desktophijack & Trojan.Desktophijack.B". Should I uninstall NAV and go with the one you have listed? Auto Protect for Norton's go crazy everytime i load it, alot of msg's for these 2 files.

[Trevuren]

Norton says they can't remove it.........

The #1 Trojan remover didn't remove it......


Is it really there or is it a false positive?

--------------------------------------------------------------------------------

We will try the easy way first, if we don't get what we want, we'll just adapt.

Please follow the instructions provided, you may want to print out these instructions and use them as a reference.


1. Please download ewido security suite it is a trial version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will prompt you to update click the OK button
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Click on Start

The update will start and a progress bar will show the updates being installed.
Once the updates are installed do the following:

• Click on scanner
• Make sure the following boxes are checked before scanning:
  • Binder
  • Crypter
  • Archives
  REBOOT into Safe Mode
  
• Click on Start Scan
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files, click OK

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop

Reboot your machine and post back a new HJT log and the ewido .txt log file you saved by using Add Reply

Regards,

Trevuren

[Fate]

WININET.DLL Still comes up with norton as infected, but OLEADM.DLL doesnt anymore. 1/2 way there lol


Logfile of HijackThis v1.99.1
Scan saved at 11:27:34 AM, on 6/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

F3 - REG:win.ini: load=????
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [StopSignStatus] Rundll32.exe "C:\Program Files\Common Files\eAcceleration\Installer\stopsinfo.dll",VerifyStatus
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100387727293
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay10...ex/HMAtchmt.ocx
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe






---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 11:16:20 AM, 6/25/2005
+ Report-Checksum: C424DAD9

+ Date of database: 6/25/2005
+ Version of scan engine: v3.0

+ Duration: 495 min
+ Scanned Files: 44946
+ Speed: 1.51 Files/Second
+ Infected files: 17
+ Removed files: 17
+ Files put in quarantine: 17
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\Documents and Settings\N L\Cookies\n l@adknowledge[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@advertising[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@com[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@doubleclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@fastclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@overture[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@realmedia[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@tradedoubler[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@tribalfusion[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n l@valueclick[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\N L\Cookies\n [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll.tcf -> Spyware.Wheaterbug.a -> Cleaned with backup
C:\WINDOWS\gunist.exe.tcf -> TrojanDownloader.IstBar.er -> Cleaned with backup
C:\WINDOWS\system32\oleadm.dll -> Trojan.Agent.eo -> Cleaned with backup


::Report End

[Trevuren]

I see that we had a couple of lurking trojans too that Ewido got rid of.

Locate the full path of wininet.dll and upload to this free online virus scanner and please tell me what they say,

http://www.kaspersky.com/scanforvirus

After you receive the results of that file, go a bit lower on the same page and submit your system to their beta free online system checker. Keep any reports that are issued.

Regards,

Trevuren

[Fate]

I tried to upload the file, but it just goes back to the same screen over and over. The Beta test did find alot heres the log. ALot of the things look like files from my Raven Shield game I play online, possibly could have spread.


-------------------------------------------------------------------------------
KASPERSKY ANTI-VIRUS WEB SCANNER REPORT
Saturday, June 25, 2005 17:03:06
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Anti-Virus Web Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 25/06/2005
Kaspersky Anti-Virus database records: 127764
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 35244
Number of viruses found: 7
Number of infected objects: 145
Number of suspicious objects: 0
Duration of the scan process: 1603 sec

Infected Object Name - Virus Name
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3B47400E.dll Infected: Trojan.Win32.Agent.eo
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\444A2BDD.ani Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\55684506.dll Infected: Trojan.Win32.Agent.eo
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\561F743D.exe Infected: Trojan.Win32.Agent.eo
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7FF50D58.dll Infected: Trojan.Win32.Agent.eo
C:\WINDOWS\002394_.tmp:dsste:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\002394_.tmp:hdxan:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\002394_.tmp:iszkx:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\002394_.tmp:pxzro:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\002394_.tmp:yqwvv:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\1.50.add:cbhpu:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\1.50.add:ibcgj:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\1.50.add:ifajy:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\1.50.add:soeiz:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\1.50.add:vocqd:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\1.50.add:ypwid:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\benkq.dat:aafvf:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\benkq.dat:atkps:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\benkq.dat:etvqf:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\benkq.dat:fearr:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\benkq.dat:kiwoq:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\benkq.dat:pwfve:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\benkq.dat:txnjh:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\benkq.dat:yvkut:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Blue Lace 16.bmp:hrsyf:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Blue Lace 16.bmp:tjygm:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\bootstat.dat:dgnin:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\bootstat.dat:rqfen:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\clock.avi:ijaor:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\clock.avi:sehvh:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\clock.avi:sxisj:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\clock.avi:szcjk:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\clock.avi:xukvet:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Coffee Bean.bmp:gqfjz:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Coffee Bean.bmp:iqzbz:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Coffee Bean.bmp:kdfzg:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Coffee Bean.bmp:wdokpk:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\explorer.scf:celws:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\explorer.scf:llctp:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\explorer.scf:nlyzb:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\explorer.scf:pezuh:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\explorer.scf:sdbxs:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\explorer.scf:vqolg:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\explorer.scf:zxvgw:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\FeatherTexture.bmp:gzzyx:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\FeatherTexture.bmp:haygj:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\FeatherTexture.bmp:hqmof:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\FeatherTexture.bmp:tawvw:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Gone Fishing.bmp:eprou:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Gone Fishing.bmp:kcqkl:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Gone Fishing.bmp:nrzai:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Gone Fishing.bmp:rvxcj:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Gone Fishing.bmp:tdacq:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Greenstone.bmp:nfoho:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Greenstone.bmp:ptmlo:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Greenstone.bmp:wnfdm:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Greenstone.bmp:xrrwc:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\kwv2.dat:vouyw:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\kwv2.dat:wqgmqg:$DATA Infected: Trojan.Win32.Agent.bi
C:\WINDOWS\mgqty.txt:hgaqw:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\msdfmap(2).ini:pqrssq:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\mtwtl.txt:pzjaa:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\PowerReg.dat:atfaa:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\PowerReg.dat:nzxfm:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\PowerReg.dat:tlfin:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Prairie Wind.bmp:bukru:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Prairie Wind.bmp:eexws:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Prairie Wind.bmp:gzual:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Prairie Wind.bmp:udbxo:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Prairie Wind.bmp:uocxp:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Prairie Wind.bmp:wojsn:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Prairie Wind.bmp:xnczd:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\PUNKBUSTER.RTP:hpaxf:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\PUNKBUSTER.RTP:llovd:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\PUNKBUSTER.RTP:nhaft:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\PUNKBUSTER.RTP:sguwm:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\PUNKBUSTER.RTP:uazii:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\PUNKBUSTER.RTP:vwcdif:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\PUNKBUSTER.RTP:zczgr:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\qjhwq.txt:gmyms:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\qjhwq.txt:kscyrq:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\QSync(2).INI:lbzib:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\QSync(2).INI:oiocz:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\QSync(2).INI:ulslz:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\QSync(2).INI:xhavg:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\QSync(2).INI:zbldl:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\QSync(2).INI:zmgva:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Rhododendron.bmp:dafwn:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Rhododendron.bmp:gboxk:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Rhododendron.bmp:stkrb:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Rhododendron.bmp:zlqslj:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\River Sumida.bmp:ihemf:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\River Sumida.bmp:jvwsu:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\River Sumida.bmp:jzlye:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\River Sumida.bmp:knrgw:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\River Sumida.bmp:llljt:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\River Sumida.bmp:thnzw:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\River Sumida.bmp:wcctx:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\River Sumida.bmp:zjruw:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\RVS_1.0_1.54_US.RTP:itiat:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\RVS_1.0_1.54_US.RTP:legav:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\RVS_1.0_1.54_US.RTP:ngfvpn:$DATA Infected: Trojan.Win32.Agent.bi
C:\WINDOWS\RVS_1.0_1.54_US.RTP:rcdgc:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\RVS_1.54_1.55_US.RTP:cctmg:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\RVS_1.54_1.55_US.RTP:qufyf:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\RVS_1.54_1.55_US.RTP:yrhae:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\RVS_1.55_1.56_US.RTP:benkq:$DATA Infected: Trojan-Dropper.Win32.Small.tn
C:\WINDOWS\RVS_1.55_1.56_US.RTP:ijcxv:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Santa Fe Stucco.bmp:aotwp:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Santa Fe Stucco.bmp:bqjzd:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Santa Fe Stucco.bmp:xyfyi:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\SchedLgU.Txt:gjuey:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\SchedLgU.Txt:jepif:$DATA Infected: Trojan-Dropper.Win32.Small.tn
C:\WINDOWS\SchedLgU.Txt:rinbz:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\SchedLgU.Txt:yqocy:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\setupapi.log.0.old:uxabc:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Soap Bubbles.bmp:dqzdin:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Soap Bubbles.bmp:nitxj:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Soap Bubbles.bmp:nlbnvb:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Sti_Trace.log:odaqnu:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\Sti_Trace.log:rspoz:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Sti_Trace.log:tfpxw:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\tmp.hta Infected: Trojan-Downloader.VBS.Psyme.at
C:\WINDOWS\wiaservc.log:dgiil:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\wiaservc.log:gmema:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\wiaservc.log:kxswu:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\wiaservc.log:scklp:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\WindowsUpdate.log:qmlru:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\WindowsUpdate.log:wlike:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\winnt256.bmp:ddnvl:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\winnt256.bmp:klzhf:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\winnt256.bmp:nqjkr:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\winnt256.bmp:nvoxw:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\winnt256.bmp:qqgln:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\winnt256.bmp:rnpfx:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\winnt256.bmp:wwigo:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\WMSysPr9(2).prx:bnokr:$DATA Infected: Trojan-Downloader.Win32.Agent.bq
C:\WINDOWS\WMSysPr9(2).prx:kggnm:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\WMSysPr9(2).prx:lpiej:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\WMSysPr9(2).prx:wbzmoq:$DATA Infected: Trojan.Win32.Agent.bi
C:\WINDOWS\WMSysPr9(3).prx:wbzmoq:$DATA Infected: Trojan.Win32.Agent.bi
C:\WINDOWS\Zapotec.bmp:aajtl:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Zapotec.bmp:rdmds:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Zapotec.bmp:wcuvs:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\Zapotec.bmp:ywzhl:$DATA Infected: Trojan-Downloader.Win32.Agent.bq

Scan process completed.

[Trevuren]

This is a new and very bad Trojan. It enables other trojans to be downloaded to your machine. It just appeared in June of this year and Symantec say that their virus definitions of June 11, 2005. Should take care of it.

Now if your definitions have not been updated, please do so, then pull the plug on your internet connection and do a complete scan of your system and check the results.

If your subscription has run out or if Symantec cannot remove it, I recommend that you download a 30-day trial of the full Kaspersky antivirus program, install it, and update its definitions. It is easy to run, it is what I am currently using on a trial basis also.

Then disable Symantec AV as much as possible (The continuous monitoring part at least), pull the plug on your internet, and run a full system scan removing everything it wants to.

Once this is done, it's a lot of work, please get back to me and tell me what happened.


Regards,

Trevuren

[Fate]

I think Kapersky is the BEST Antivirus program out, all others I tried could not remove anything I had, this one offered to disinfect or delete it on start up before it was run. Amazing! Would you like anymore logs just to make sure everything is ok? With my startup, I dont want Quicktime to run, any software for my logitech quick cam, etc. Things I dont want to slow my startup and resources down esp when I rarely use them. Thanks alot!

Logfile of HijackThis v1.99.1
Scan saved at 2:17:44 AM, on 6/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100387727293
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay10...ex/HMAtchmt.ocx
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Edited by Fate, 26 June 2005 - 12:18 AM.