Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

windows keeps restarting itself... malware? [RESOLVED]


  • This topic is locked This topic is locked

#16
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
Please print out or copy this page to Notepad for we will be doing most of our work in Safe Mode. Make sure to work through the steps in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fix.
  • Download a free trial version of Ewido security suite
  • Install Ewido security suite
  • When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu

[*]Launch Ewido, there should be an icon on your desktop, double-click it.
  • The program will now open to the main screen.
  • When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.

[*]You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the bottom will display "Update successful")

[*]Exit Ewido.


[*]DO NOT SCAN YET.
[/list]If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates


[*]Download DSRFIX by Atribune, et al... from HERE onto your Desktop.
  • Unzip and EXTRACT the files to your Desktop.
  • The program creates and names the new folder to house the files.
  • DO NOT RUN IT YET

[*]Download Cleanup from Here (Alternate site if the above is not working Go Here)
  • A window will open and choose SAVE, then DESKTOP as the destination.
  • On your Desktop, click on Cleanup40.exe icon.
  • Then, click RUN and place a checkmark beside "I Agree"
  • Then click NEXT followed by START and OK.
  • Click OPTIONS, Move the arrow down to "Custom Cleanup".
  • Put a check next to the following items: (Make sure nothing else is checked)
    • Empty Recycle Bins
    • Delete cookies
    • Delete Prefetch Files
    • Cleanup All Users
  • Click OK
  • DO NOT RUN IT YET

[*]Download this file: Revised Installer for the Nailfix Utility
  • Save it to your desktop.
  • DO NOT RUN IT YET.


[*]Reboot your computer into SafeMode by doing the following:
  • To reboot into SafeMode with Windows XP, you can follow these steps from Microsoft:
  • OR
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.

Once in Safe Mode,


[*]Double-click on nailfix.exe.
  • Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
  • Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

[*]Open the folder dsrfix
  • Double click on the dsrfix batch file( the one with the little gear in it )
  • Once dsrfix has completed it will close on its own

[*]Open Ewido and scan your system.
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.**
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now as the action.
  • Once the scan has completed, click the Save Report button located on the bottom of the screen and choose your DESKTOP as the destination.

[*]Now run HijackThis, click Scan, and place a checkmark next to each of the following items:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: lkotmbz C:\windows\system32\nepdlq.exe r
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{CA4CA9F9-C0E6-E28B-C54A-5C5376E4338A} - (no file)
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll (file missing)
O2 - BHO: Band Class - {0007522A-2297-43C1-8EB1-C90B0FF20DA5} - C:\WINDOWS\enhtb.dll
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: CATLEvents Object - {13589181-4F0D-4553-B9F8-B4B72172C139} - C:\DOCUME~1\Owner\LOCALS~1\Temp\tengmi.dat
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: CATLEvents Object - {68132581-10F2-416E-B188-4E648075325A} - C:\DOCUME~1\Owner\LOCALS~1\Temp\rbapa.dat
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\Owner\LOCALS~1\Temp\lldcbdo.dat
O2 - BHO: (no name) - {C86F9CB0-46EF-9009-AEC0-8F21DBADF551} - C:\WINDOWS\Mgmpgrbw.dll
O2 - BHO: CATLEvents Object - {D487068E-9B04-4FE5-8A83-08344F800BF5} - C:\DOCUME~1\Owner\LOCALS~1\Temp\niamlitu.dat
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Search - {89F4923E-32BA-758F-7DBB-20E40447D73D} - C:\WINDOWS\Mgmpgrbw.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ysb.dll
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [AFL0] C:\WINDOWS\udwldo.exe
O4 - HKLM\..\Run: [Enh Win Updt] C:\WINDOWS\enhupdt.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [*imgnet] C:\WINDOWS\security\logs\imgnet.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [ayosrv] c:\windows\system32\aihbwrf.exe
O4 - HKCU\..\Run: [dfrgui] C:\WINDOWS\System32\dfrgui.exe
O4 - HKCU\..\Run: [jgsh400] C:\WINDOWS\System32\jgsh400.exe
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O20 - Winlogon Notify: bakmfc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cfmkab.dat
O20 - Winlogon Notify: cmdtcp - C:\DOCUME~1\Owner\LOCALS~1\Temp\pctdmc.dat
O20 - Winlogon Notify: dvdsvc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cvsdvd.dat
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\Owner\LOCALS~1\Temp\tacdrah.dat
O20 - Winlogon Notify: imgnet - C:\DOCUME~1\Owner\LOCALS~1\Temp\tengmi.dat
O20 - Winlogon Notify: odbcdll - C:\DOCUME~1\Owner\LOCALS~1\Temp\lldcbdo.dat
O20 - Winlogon Notify: sfont - C:\DOCUME~1\Owner\LOCALS~1\Temp\tnofs.dat
O20 - Winlogon Notify: utiltapi - C:\DOCUME~1\Owner\LOCALS~1\Temp\ipatlitu.dat
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe





[*]Close all open windows except for HJT, click the Fix Checked button and EXIT HJT.

NOTE: The 04 entry may have changed names if you have rebooted since posting the log; look for an entry with a similar format, that will always end in a single letter r


[*]Now, using Windows Explorer, locate and DELETE the following Files/Folders (with all their content), if they are present:

c:\windows\system32\nepdlq.exe (or whatever the name may have changed to, as noted above).
C:\Program Files\Wimeting<===Folder
C:\WINDOWS\System32\mmfnseng.exe
C:\WINDOWS\system\apabr.exe
C:\Program Files\NaviSearch<===Folder
C:\WINDOWS\udwldo.exe
C:\WINDOWS\System32\nepdlq.exe
C:\Program Files\ISTsvc<===Folder
C:\WINDOWS\System32\196_150_ni.exe
C:\Program Files\Updates from HP\137903<===Folder
C:\WINDOWS\Nail.exe
C:\WINDOWS\nem220.dll
C:\WINDOWS\enhtb.dll
C:\WINDOWS\Bolger.dll
C:\WINDOWS\System32\nvms.dll
C:\DOCUME~1\Owner\LOCALS~1\Temp\<===Contents of Folder, not Folder itself
C:\WINDOWS\Mgmpgrbw.dll
C:\PROGRA~1\YOURSI~1\ysb.dll
C:\Program Files\Web_Rebates<===Folder
C:\WINDOWS\enhupdt.exe
C:\WINDOWS\security\logs\imgnet.exe
c:\windows\system32\aihbwrf.exe
C:\WINDOWS\System32\dfrgui.exe
C:\WINDOWS\System32\jgsh400.exe
C:\Program Files\SideFind<===Folder



[*]Run Cleanup
  • Click on the "Cleanup" button and let it run.
  • Once its done, close the program

[*]Finally, REBOOT into Normal Mode and please post a new HijackThis log, as well as the report log from the Ewido scan .
[/list][b]Regards,

Treburen

  • 0

Advertisements


#17
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
Logfile of HijackThis v1.99.1
Scan saved at 11:40:40 PM, on 8/23/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system\apabr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\BurnQuick\BQTray.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLHOS~1.EXE
C:\WINDOWS\System32\ycknhtr.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLServiceHost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.justinmayer.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {00F1D395-4744-40f0-A611-980F61AE2C59} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {302A3240-4805-4a34-97D7-1645A0B08410} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [*apabr] C:\WINDOWS\system\apabr.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110611359\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [*imgnet] C:\WINDOWS\security\logs\imgnet.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ijjdql] C:\WINDOWS\System32\ycknhtr.exe r
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by12fd.bay12....es/MsnPUpld.cab
O20 - Winlogon Notify: bakmfc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cfmkab.dat (file missing)
O20 - Winlogon Notify: cmdtcp - C:\DOCUME~1\Owner\LOCALS~1\Temp\pctdmc.dat (file missing)
O20 - Winlogon Notify: dvdsvc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cvsdvd.dat (file missing)
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\Owner\LOCALS~1\Temp\tacdrah.dat (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: imgnet - C:\DOCUME~1\Owner\LOCALS~1\Temp\tengmi.dat (file missing)
O20 - Winlogon Notify: odbcdll - C:\DOCUME~1\Owner\LOCALS~1\Temp\lldcbdo.dat (file missing)
O20 - Winlogon Notify: sfont - C:\DOCUME~1\Owner\LOCALS~1\Temp\tnofs.dat (file missing)
O20 - Winlogon Notify: utiltapi - C:\DOCUME~1\Owner\LOCALS~1\Temp\ipatlitu.dat (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


EWIDO SCAN

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 11:05:18 PM, 8/23/2005
+ Report-Checksum: 68603C4D

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Ignored
HKLM\SOFTWARE\Classes\CLSID\{0007522A-2297-43C1-8EB1-C90B0FF20DA5} -> Spyware.ShopNav : Ignored
HKLM\SOFTWARE\Classes\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Classes\CLSID\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Classes\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\CLSID\{8CBA1B49-8144-4721-A7B1-64C578C9EED7} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\CLSID\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Classes\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Interface\{03B800F9-2536-4441-8CDA-2A3E6D15B4F8} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Interface\{0F2A4ADC-DABF-4980-8DB4-19F67D7B1F95} -> Spyware.ClearSearch : Ignored
HKLM\SOFTWARE\Classes\Interface\{339D8AFF-0B42-4260-AD82-78CE605A9543} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E1357} -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\Interface\{A36A5936-CFD9-4B41-86BD-319A1931887F} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\Interface\{AA4939C3-DECA-4A48-A454-97CD587C0EF5} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Classes\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED11357} -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\Interface\{DFBCC1EB-B149-487E-80C1-CC1562021542} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Interface\{EEE4A2E5-9F56-432F-A6ED-F6F625B551E0} -> Dialer.Generic : Ignored
HKLM\SOFTWARE\Classes\NLS.UrlCatcher -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\NLS.UrlCatcher\CLSID -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\SideFind.Finder -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\SideFind.Finder\CLSID -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\SideFind.Finder\CurVer -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516C2E3} -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{4EE12B71-AA5E-45EC-8666-2DB3AD3FDF44} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{58634367-D62B-4C2C-86BE-5AAC45CDB671} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{D0288A41-9855-4A9B-8316-BABE243648DA} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{D5E06663-DE78-4A48-BB81-7C9AFF2E49E4} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Classes\Wbho.Band -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Ysb.YsbObj -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Ysb.YsbObj\CLSID -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Ysb.YsbObj\CurVer -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\eXactUtil -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\ISTsvc -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{10E42047-DEB9-4535-A118-B3F6EC39B807} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Ignored
HKLM\SOFTWARE\Microsoft\SideFind -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918} -> Spyware.TwainTech : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5} -> Spyware.ShopNav : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A7327C09-B521-4EDB-8509-7D2660C9EC98} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A7327C09-B521-4EDB-8509-7D2660C9EC98} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A7327C09-B521-4EDB-8509-7D2660C9EC98}\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A7327C09-B521-4EDB-8509-7D2660C9EC98}\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5} -> Spyware.ShopNav : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{00F1D395-4744-40f0-A611-980F61AE2C59}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{13589181-4F0D-4553-B9F8-B4B72172C139}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{00000010-6F7D-442C-93E3-4A4827C2E4C8}\{0007522A-2297-43C1-8EB1-C90B0FF20DA5}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{302A3240-4805-4a34-97D7-1645A0B08410}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918} -> Spyware.TwainTech : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{00A6FAF1-072E-44cf-8957-5838F569A31D} -> Spyware.MyWebSearch : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{00A6FAF1-072E-44cf-8957-5838F569A31D}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{00A6FAF1-072E-44cf-8957-5838F569A31D}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{00A6FAF1-072E-44cf-8957-5838F569A31D}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{00A6FAF1-072E-44cf-8957-5838F569A31D}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{00A6FAF1-072E-44cf-8957-5838F569A31D}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A7327C09-B521-4EDB-8509-7D2660C9EC98}\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{0000607D-D204-42C7-8E46-216055BF9918}\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A7327C09-B521-4EDB-8509-7D2660C9EC98}\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\SOFTWARE\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\{549B5CA7-4A86-11D7-A4DF-000874180BB3}\{68132581-10F2-416E-B188-4E648075325A}\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\{A7327C09-B521-4EDB-8509-7D2660C9EC98}\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0007522A-2297-43C1-8EB1-C90B0FF20DA5} -> Spyware.ShopNav : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68132581-10F2-416E-B188-4E648075325A} -> Spyware.VirtuMonde : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISTsvc -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout -> Spyware.InternetOptimizer : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NaviSearch -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SideFind -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YourSiteBar -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\NaviSearch -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Policies\Avenue Media -> Spyware.InternetOptimizer : Ignored
HKLM\SOFTWARE\PowerScan -> Spyware.PowerScan : Ignored
HKLM\SOFTWARE\SideFind -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\SideFind\History -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\YourSiteBar -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\YourSiteBar\Historyfiles -> Spyware.ISTBar : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\Bundles -> Spyware.SecondThought : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\IST -> Spyware.ISTBar : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\Microsoft\Internet Explorer\Explorer Bars\{8CBA1B49-8144-4721-A7B1-64C578C9EED7} -> Spyware.SideFind : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\Microsoft\Internet Explorer\MenuExt\Web Rebates -> Spyware.WebRebates : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\Policies\Avenue Media -> Spyware.InternetOptimizer : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\PowerScan -> Spyware.PowerScan : Ignored
[208] C:\DOCUME~1\Owner\LOCALS~1\Temp\lldcbdo.dat -> Spyware.VirtuMonde : Ignored
[860] C:\WINDOWS\System32\drqykk.exe -> Trojan.Agent.cp : Ignored
[1004] VM_02610000 -> Adware.BetterInternet : Ignored
C:\counter.cab/counter.exe -> TrojanDropper.Small.ls : Ignored
:mozilla.22:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Spylog : Ignored
:mozilla.27:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Googleadservices : Ignored
:mozilla.33:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Doubleclick : Ignored
:mozilla.34:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Doubleclick : Ignored
:mozilla.35:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Advertising : Ignored
:mozilla.36:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Advertising : Ignored
:mozilla.37:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Advertising : Ignored
:mozilla.41:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Advertising : Ignored
:mozilla.42:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Advertising : Ignored
:mozilla.43:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.Statcounter : Ignored
:mozilla.48:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.49:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.50:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.51:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.52:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.53:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.54:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.55:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.56:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.57:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.58:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.59:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.60:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.61:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.63:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.65:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.66:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.67:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.68:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7 : Ignored
:mozilla.69:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\s4u3vrr3.default\cookies.txt -> Spyware.Cookie.2o7
  • 0

#18
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
Whew that took a while :tazz: ...just so you know, right after I posted the 2 logs the computer restarted again.
  • 0

#19
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
Print this out please

1. Download Process Explorer from http://www.sysintern...ssExplorer.html

2. Run Process Explorer and find the Process in the list of Processes.

ycknhtr.exe

3. Select the process and click Process > Suspend.

4. Then in HijackThis click Config > Misc Tools > Delete a file on reboot...

5. In the explorer Window, locate and select the file C:\WINDOWS\system32\ycknhtr.exe

6. When prompted if you want to reboot click YES

Leave Process explorer running with the process suspended.

7. After the reboot, check the following items in HijackThis.

O4 - HKLM\..\Run: [ijjdql] C:\WINDOWS\System32\ycknhtr.exe r

Close all windows except HijackThis and click Fix checked:

8. REBOOT your system

9. Finally, run HijackThis, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

  • 0

#20
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
ok I downloaded process explorer but ycknhtr.exe isn't on the list anywhere. However apabr.exe and svchost.exe are both there, and I thought we already got rid of them. Any ideas?
  • 0

#21
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
NOTE: The 04 entry may have changed names if you have rebooted since posting the log; look for an entry with a similar format, that will always end in a single letter r

So that means run an HJT log and find the 04 with an r at the end and do the substitution of the different values.

Trevuren
  • 0

#22
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
here is the latest log... I should also mention that his computer has Aurora... I'm assuming something we do will get rid of that as well...


Logfile of HijackThis v1.99.1
Scan saved at 5:52:04 PM, on 8/24/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
C:\WINDOWS\Explorer.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system\apabr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\BurnQuick\BQTray.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLHOS~1.EXE
C:\Hijackthis\HijackThis.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLServiceHost.exe
C:\WINDOWS\System32\dsylfs.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.justinmayer.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {00F1D395-4744-40f0-A611-980F61AE2C59} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {302A3240-4805-4a34-97D7-1645A0B08410} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [*apabr] C:\WINDOWS\system\apabr.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110611359\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [*imgnet] C:\WINDOWS\security\logs\imgnet.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [hxvarqx] C:\WINDOWS\System32\dsylfs.exe r
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by12fd.bay12....es/MsnPUpld.cab
O20 - Winlogon Notify: bakmfc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cfmkab.dat (file missing)
O20 - Winlogon Notify: cmdtcp - C:\DOCUME~1\Owner\LOCALS~1\Temp\pctdmc.dat (file missing)
O20 - Winlogon Notify: dvdsvc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cvsdvd.dat (file missing)
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\Owner\LOCALS~1\Temp\tacdrah.dat (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: imgnet - C:\DOCUME~1\Owner\LOCALS~1\Temp\tengmi.dat (file missing)
O20 - Winlogon Notify: odbcdll - C:\DOCUME~1\Owner\LOCALS~1\Temp\lldcbdo.dat (file missing)
O20 - Winlogon Notify: sfont - C:\DOCUME~1\Owner\LOCALS~1\Temp\tnofs.dat (file missing)
O20 - Winlogon Notify: utiltapi - C:\DOCUME~1\Owner\LOCALS~1\Temp\ipatlitu.dat (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#23
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
Please print out or copy this page to Notepad for we will be doing most of our work in Safe Mode. Make sure to work through the steps in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fix.
  • Download a free trial version of Ewido security suite
  • Install Ewido security suite
  • When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu

[*]Launch Ewido, there should be an icon on your desktop, double-click it.
  • The program will now open to the main screen.
  • When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.

[*]You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the bottom will display "Update successful")

[*]Exit Ewido.


[*]DO NOT SCAN YET.
[/list]If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates


[*]Download DSRFIX by Atribune, et al... from HERE onto your Desktop.
  • Unzip and EXTRACT the files to your Desktop.
  • The program creates and names the new folder to house the files.
  • DO NOT RUN IT YET

[*]Download Cleanup from Here (Alternate site if the above is not working Go Here)
  • A window will open and choose SAVE, then DESKTOP as the destination.
  • On your Desktop, click on Cleanup40.exe icon.
  • Then, click RUN and place a checkmark beside "I Agree"
  • Then click NEXT followed by START and OK.
  • Click OPTIONS, Move the arrow down to "Custom Cleanup".
  • Put a check next to the following items: (Make sure nothing else is checked)
    • Empty Recycle Bins
    • Delete cookies
    • Delete Prefetch Files
    • Cleanup All Users
  • Click OK
  • DO NOT RUN IT YET

[*]Download this file: Revised Installer for the Nailfix Utility
  • Save it to your desktop.
  • DO NOT RUN IT YET.


[*]Reboot your computer into SafeMode by doing the following:
  • To reboot into SafeMode with Windows XP, you can follow these steps from Microsoft:
  • OR
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.

Once in Safe Mode,


[*]Double-click on nailfix.exe.
  • Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
  • Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

[*]Open the folder dsrfix
  • Double click on the dsrfix batch file( the one with the little gear in it )
  • Once dsrfix has completed it will close on its own

[*]Open Ewido and scan your system.
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.**
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now as the action.
  • Once the scan has completed, click the Save Report button located on the bottom of the screen and choose your DESKTOP as the destination.

[*]Now run HijackThis, click Scan, and place a checkmark next to each of the following items:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [hxvarqx] C:\windows\system32\dsylfs.exe r
O2 - BHO: (no name) - {00F1D395-4744-40f0-A611-980F61AE2C59} - (no file)
O2 - BHO: (no name) - {302A3240-4805-4a34-97D7-1645A0B08410} - (no file)
O4 - HKLM\..\Run: [*apabr] C:\WINDOWS\system\apabr.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [*imgnet] C:\WINDOWS\security\logs\imgnet.exe
O20 - Winlogon Notify: bakmfc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cfmkab.dat (file missing)
O20 - Winlogon Notify: cmdtcp - C:\DOCUME~1\Owner\LOCALS~1\Temp\pctdmc.dat (file missing)
O20 - Winlogon Notify: dvdsvc - C:\DOCUME~1\Owner\LOCALS~1\Temp\cvsdvd.dat (file missing)
O20 - Winlogon Notify: imgnet - C:\DOCUME~1\Owner\LOCALS~1\Temp\tengmi.dat (file missing)
O20 - Winlogon Notify: odbcdll - C:\DOCUME~1\Owner\LOCALS~1\Temp\lldcbdo.dat (file missing)
O20 - Winlogon Notify: sfont - C:\DOCUME~1\Owner\LOCALS~1\Temp\tnofs.dat (file missing)
O20 - Winlogon Notify: utiltapi - C:\DOCUME~1\Owner\LOCALS~1\Temp\ipatlitu.dat (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe





[*]Close all open windows except for HJT, click the Fix Checked button and EXIT HJT.

NOTE: The 04 entry may have changed names if you have rebooted since posting the log; look for an entry with a similar format, that will always end in a single letter r


[*]Now, using Windows Explorer, locate and DELETE the following Files/Folders (with all their content), if they are present:

c:\windows\system32\dsylfs.exe (or whatever the name may have changed to, as noted above).
C:\WINDOWS\system\apabr.exe
C:\WINDOWS\Nail.exe
C:\WINDOWS\farmmext.exe
C:\WINDOWS\security\logs\imgnet.exe
C:\WINDOWS\svcproc.exe


[*]Run Cleanup
  • Click on the "Cleanup" button and let it run.
  • Once its done, close the program

[*]Finally, REBOOT into Normal Mode and please post a new HijackThis log, as well as the report log from the Ewido scan .
[/list]Regards,

Treburen

  • 0

#24
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
Logfile of HijackThis v1.99.1
Scan saved at 12:20:44 PM, on 8/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\BurnQuick\BQTray.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\wormny.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLServiceHost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.justinmayer.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110611359\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [tngxge] C:\WINDOWS\System32\wormny.exe r
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by12fd.bay12....es/MsnPUpld.cab
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\Owner\LOCALS~1\Temp\tacdrah.dat (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


EWIDO SCAN:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 12:09:06 PM, 8/25/2005
+ Report-Checksum: 869DE974

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Classes\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\CLSID\{8CBA1B49-8144-4721-A7B1-64C578C9EED7} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Interface\{03B800F9-2536-4441-8CDA-2A3E6D15B4F8} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Interface\{0F2A4ADC-DABF-4980-8DB4-19F67D7B1F95} -> Spyware.ClearSearch : Ignored
HKLM\SOFTWARE\Classes\Interface\{339D8AFF-0B42-4260-AD82-78CE605A9543} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E1357} -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\Interface\{A36A5936-CFD9-4B41-86BD-319A1931887F} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\Interface\{AA4939C3-DECA-4A48-A454-97CD587C0EF5} -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Classes\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED11357} -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\Interface\{DFBCC1EB-B149-487E-80C1-CC1562021542} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Interface\{EEE4A2E5-9F56-432F-A6ED-F6F625B551E0} -> Dialer.Generic : Ignored
HKLM\SOFTWARE\Classes\NLS.UrlCatcher -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\NLS.UrlCatcher\CLSID -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\SideFind.Finder -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\SideFind.Finder\CLSID -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\SideFind.Finder\CurVer -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516C2E3} -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{4EE12B71-AA5E-45EC-8666-2DB3AD3FDF44} -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{58634367-D62B-4C2C-86BE-5AAC45CDB671} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{D0288A41-9855-4A9B-8316-BABE243648DA} -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Classes\TypeLib\{D5E06663-DE78-4A48-BB81-7C9AFF2E49E4} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Classes\Wbho.Band -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> Spyware.IEPlugin : Ignored
HKLM\SOFTWARE\Classes\Ysb.YsbObj -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Ysb.YsbObj\CLSID -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\Classes\Ysb.YsbObj\CurVer -> Spyware.YourSiteBar : Ignored
HKLM\SOFTWARE\eXactUtil -> Spyware.BargainBuddy : Ignored
HKLM\SOFTWARE\ISTsvc -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Ignored
HKLM\SOFTWARE\Microsoft\SideFind -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{302A3240-4805-4a34-97D7-1645A0B08410} -> Spyware.VX2 : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISTsvc -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout -> Spyware.InternetOptimizer : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NaviSearch -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SideFind -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YourSiteBar -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\NaviSearch -> Spyware.NaviSearch : Ignored
HKLM\SOFTWARE\Policies\Avenue Media -> Spyware.InternetOptimizer : Ignored
HKLM\SOFTWARE\PowerScan -> Spyware.PowerScan : Ignored
HKLM\SOFTWARE\SideFind -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\SideFind\History -> Spyware.SideFind : Ignored
HKLM\SOFTWARE\YourSiteBar -> Spyware.ISTBar : Ignored
HKLM\SOFTWARE\YourSiteBar\Historyfiles -> Spyware.ISTBar : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\Bundles -> Spyware.SecondThought : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\IST -> Spyware.ISTBar : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\Microsoft\Internet Explorer\Explorer Bars\{8CBA1B49-8144-4721-A7B1-64C578C9EED7} -> Spyware.SideFind : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\Policies\Avenue Media -> Spyware.InternetOptimizer : Ignored
HKU\S-1-5-21-1682955727-1994323607-1483581510-1003\Software\PowerScan -> Spyware.PowerScan : Ignored
[976] C:\WINDOWS\System32\ywioji.exe -> Trojan.Agent.cp : Ignored
[1180] VM_015B0000 -> Adware.BetterInternet : Ignored
C:\counter.cab/counter.exe -> TrojanDropper.Small.ls : Ignored
C:\Documents and Settings\Owner\Cookies\owner@abetterinternet[1].txt -> Spyware.Cookie.Abetterinternet : Ignored
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Ignored
C:\Documents and Settings\Owner\Desktop\Shame 2 yo Game\SmileyCentralPFSetup2.0.3.10.exe -> Spyware.MyWebSearch : Ignored
C:\Documents and Settings\Owner\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0F.dat/files\wtvh.dll -> Spyware.WildTangent : Ignored
C:\Hijackthis\backups\backup-20050823-231647-122.dll -> Spyware.NoName : Ignored
C:\Hijackthis\backups\backup-20050823-231647-414.dll -> Spyware.BargainBuddy : Ignored
C:\Hijackthis\backups\backup-20050823-231647-765.dll -> Spyware.SideFind : Ignored
C:\Hijackthis\backups\backup-20050823-231647-825.dll -> Spyware.VirtuMonde : Ignored
C:\Hijackthis\backups\backup-20050823-231648-467.dll -> TrojanSpy.Agent.ce : Ignored
C:\Hijackthis\backups\backup-20050823-231648-976.dll -> Spyware.SearchBand : Ignored
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Ignored
C:\WINDOWS\bsx32 -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ADBN3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ADTMI1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ADVC5.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ADVCTX2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIB9894.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIC29667.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASID12180.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIE17070.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIF29819.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIF4502.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIFA15376.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIFWH29233.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIG21943.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIGT10102.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIH21180.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIH7853.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASII21469.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIL18549.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASILS29399.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIM4381.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIM9740.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIOG19375.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIOT25456.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIPF1965.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIR21184.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIRE20082.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIS24110.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIS31590.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIT17011.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIT26116.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIW11211.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\ASIWS3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\AUTOS2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\BID1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\BingoRoom1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\CARD2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\CARS3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\CASH2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\DATE4.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\EECH1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\EML1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\FAST1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\FINC3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\FINC5.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\FLWR1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\FMND1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\HEBE3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\HERBS1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\HOGAR3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\INK1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\JOBS4.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\MORT4.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\MOVS2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\NEWS2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\OPPR3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\SHOP2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\SPZ3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\TECH2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\TMP3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\TRVL6.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\UTONE2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\VENUE1.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\WWW3.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bsx32\XTFL2.bsx -> Spyware.BookedSpace : Ignored
C:\WINDOWS\bundles\bs5-vwqouc.exe -> Spyware.BookedSpace.c : Ignored
C:\WINDOWS\bxxs5.dll -> Spyware.BookedSpace : Ignored
C:\WINDOWS\Config\crftp.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\Cursors\dbole.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\drabjdqvo.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\enhuninstall.exe -> Spyware.NoName : Ignored
C:\WINDOWS\farmmext.exe -> Spyware.ConsCorr : Ignored
C:\WINDOWS\Fonts\antidvd.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\Fonts\dllrun.exe -> Spyware.Virtumonde : Ignored
C:\WINDOWS\fowreny.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\Help\SBSI\inetreg.exe -> Spyware.Virtumonde : Ignored
C:\WINDOWS\Microsoft.NET\javas.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\pcad.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\preInsMt.exe -> Spyware.BiSpy : Ignored
C:\WINDOWS\preInsTT.exe -> Spyware.BiSpy : Ignored
C:\WINDOWS\security\logs\vgamc.exe -> Spyware.Virtumonde : Ignored
C:\WINDOWS\svrmc.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\system\cabbin.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\system\dbjava.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\system32\bbchk.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\exdl.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\exdl0.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\exdl2.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\exul.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\exul2.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\id113.exe -> Trojan.SecondThought.ak : Ignored
C:\WINDOWS\system32\instsrv.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\javex80.vxd/C:/WINDOWS/System32/nvms.dll -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\javex80.vxd/C:/Program Files/NaviSearch/bin/nls.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\javexulm.vxd -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\minst.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\system32\mqexdlm.srg -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\msexreg.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/exdl.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/mqexdlm.srg -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/exul.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/javexulm.vxd -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/bbchk.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/msexreg.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/instsrv.exe -> Spyware.BargainBuddy : Ignored
C:\WINDOWS\system32\Restore\antibak.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\system32\trkgif.exe -> Spyware.Winpup32 : Ignored
C:\WINDOWS\system32\xJHTYWXQTGU.exe -> TrojanDownloader.Agent.am : Ignored
C:\WINDOWS\system32\ywioji.exe -> Trojan.Agent.ay : Ignored
C:\WINDOWS\tdtb.exe -> Trojan.Imiserv.c : Ignored
C:\WINDOWS\Web\printers\urldos.exe -> TrojanDownloader.Virtumonde.g : Ignored
C:\WINDOWS\wsem302.dll -> TrojanDownloader.Dyfuca.dc : Ignored


::Report End
  • 0

#25
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
Please print this out as we will be working from safe mode

1. Download Process Explorer from http://www.sysintern...ssExplorer.html

2. Run Process Explorer and find the Process in the list of Processes.

wormny.exe

3. Select the process and click Process > Suspend.

4. Then in HijackThis click Config > Misc Tools > Delete a file on reboot...

5. In the explorer Window, locate and select the file C:\WINDOWS\System32\wormny.exe

6. When prompted if you want to reboot click YES

Leave Process explorer running with the process suspended.

7. After the reboot, check the following items in HijackThis.

O4 - HKLM\..\Run: [tngxge] C:\WINDOWS\System32\wormny.exe r

Close all windows except HijackThis and click Fix checked:

8. REBOOT your system

9. Finally, run HijackThis, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

  • 0

Advertisements


#26
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
Logfile of HijackThis v1.99.1
Scan saved at 2:04:01 PM, on 8/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\hugtsa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\BurnQuick\BQTray.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLHOS~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLServiceHost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.justinmayer.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110611359\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [lmmhlea] C:\WINDOWS\System32\hugtsa.exe r
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by12fd.bay12....es/MsnPUpld.cab
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\Owner\LOCALS~1\Temp\tacdrah.dat (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#27
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
*Run HJT immediately prior to starting the following fix.
* Check the 04 entries in your scan.
*If the 04 entry which finishes with an "r" is different from the one below, then change all values in the fix to mirror what you have in your HJT scan.

Please print this out as we will be working from safe mode

1. Download Process Explorer from http://www.sysintern...ssExplorer.html

2. Run Process Explorer and find the Process in the list of Processes.

hugtsa.exe

3. Select the process and click Process > Suspend.

4. Then in HijackThis click Config > Misc Tools > Delete a file on reboot...

5. In the explorer Window, locate and select the file C:\WINDOWS\System32\hugtsa.exe

6. When prompted if you want to reboot click YES

Leave Process explorer running with the process suspended.

7. After the reboot, check the following items in HijackThis.

O4 - HKLM\..\Run: [lmmhlea] C:\WINDOWS\System32\hugtsa.exe r

Close all windows except HijackThis and click Fix checked:

8. REBOOT your system

9. Finally, run HijackThis, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

  • 0

#28
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
Logfile of HijackThis v1.99.1
Scan saved at 11:37:09 PM, on 8/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\BurnQuick\BQTray.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLServiceHost.exe
C:\WINDOWS\System32\lynevta.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.justinmayer.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110611359\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [wnftfil] C:\WINDOWS\System32\lynevta.exe r
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by12fd.bay12....es/MsnPUpld.cab
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\Owner\LOCALS~1\Temp\tacdrah.dat (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#29
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
It is still there. Send me a new HJT log and I will immediately send you the fix.


***Do not turn off your machne or reboot.


Trevuren
  • 0

#30
AlyK620

AlyK620

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
it restarted itself since i made the last post, but here's the newest log...


Logfile of HijackThis v1.99.1
Scan saved at 12:06:29 AM, on 8/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\BurnQuick\BQTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLHOS~1.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\COMMON~1\AOL\111061~1\EE\AOLServiceHost.exe
C:\WINDOWS\System32\afypsjd.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.justinmayer.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110611359\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [fqfbumm] C:\WINDOWS\System32\afypsjd.exe r
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by12fd.bay12....es/MsnPUpld.cab
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\Owner\LOCALS~1\Temp\tacdrah.dat (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Owner\Desktop\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP