Logfile of HijackThis v1.99.1
Scan saved at 3:28:08 PM, on 8/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\Common Files\Aol\aoltpspd.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Owner\Local Settings\Temp\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.pogo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page =
C:\Program Files\AOL Toolbar\welcome.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} -
C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [Pure Networks Port Magic]
"C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center]
C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32
C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
/STARTUP
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common
Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection]
"C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [Xmieps] C:\WINDOWS\system32\w?auclt.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat
7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [Oowm] C:\Program Files\ddsl\sera.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common
Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America
Online 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL
Companion\companion.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program
Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL
Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} -
C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar -
{4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL
Toolbar\toolbar.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
Files\AIM\aim.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet
Zone (HKLM)
O16 - DPF: Aces Up! by pogo -
http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: Ali Baba Slots TM by pogo -
http://game1.pogo.co...a-ob-assets.cab
O16 - DPF: Blackjack by pogo -
http://game1.pogo.co...k-ob-assets.cab
O16 - DPF: Canasta by pogo -
http://game1.pogo.co...a-ob-assets.cab
O16 - DPF: Checkers by pogo -
http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: Chess by pogo -
http://game1.pogo.co...2-ob-assets.cab
O16 - DPF: First Class Solitaire by pogo -
http://game1.pogo.co...2-ob-assets.cab
O16 - DPF: Fortune Bingo by pogo -
http://game1.pogo.co...o-ob-assets.cab
O16 - DPF: Greenback Bayou by pogo -
http://game1.pogo.co...k-ob-assets.cab
O16 - DPF: Harvest Mania by pogo -
http://game1.pogo.co...t-ob-assets.cab
O16 - DPF: Hearts by pogo -
http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: High Stakes Poker by pogo -
http://game1.pogo.co...r-ob-assets.cab
O16 - DPF: High Stakes Pool by pogo -
http://game1.pogo.co...l-ob-assets.cab
O16 - DPF: Jigsaw Detective by pogo -
http://game1.pogo.co...w-ob-assets.cab
O16 - DPF: Jungle Gin by pogo -
http://game1.pogo.co...n-ob-assets.cab
O16 - DPF: Lottso by pogo -
http://game1.pogo.co...o-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo -
http://game1.pogo.co...g-ob-assets.cab
O16 - DPF: Payday FreeCell by pogo -
http://game5.pogo.co...l-ob-assets.cab
O16 - DPF: Perfect Pair Solitaire by pogo -
http://game1.pogo.co...l-ob-assets.cab
O16 - DPF: Phlinx by pogo -
http://game1.pogo.co...r-ob-assets.cab
O16 - DPF: Pirate's Gold by pogo -
http://game1.pogo.co...d-ob-assets.cab
O16 - DPF: Pop Fu by pogo -
http://game1.pogo.co...u-ob-assets.cab
O16 - DPF: Poppit by pogo -
http://game1.pogo.co...2-ob-assets.cab
O16 - DPF: Spider Solitaire by pogo -
http://game1.pogo.co...r-ob-assets.cab
O16 - DPF: Squelchies by pogo -
http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: Sweet Tooth TM by pogo -
http://game1.pogo.co...h-ob-assets.cab
O16 - DPF: Texas Hold'em Poker by pogo -
http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: Tri-Peaks by pogo -
http://game1.pogo.co...s-ob-assets.cab
O16 - DPF: Tumble Bees by pogo -
http://game1.pogo.co...e-ob-assets.cab
O16 - DPF: Turbo 21 TM by pogo -
http://game1.pogo.co...1-ob-assets.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} -
http://install.wildt...iveLauncher.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj
Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://v5.windowsupd...n/x86/client/wu
web_site.cab?1109181250265
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime
Environment 1.4.0) -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
http://playweb03.pog...aploader_v6.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{BE4109CD-5DF3-44B6-A671-AB191D71487D}:
NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. -
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner -
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner -
C:\WINDOWS\system32\msCMTSrvc.exe (file missing)