In addition, Norton appeared to be updating for several days as I was running numerous virus scans, but the update date never changed. (My son eventually mentioned receiving an error message that Norton had been tampered with.) I followed Norton's instructions to fix (disable System Restore, backup registry, uninstall, reinstall, etc.) I repeatedly have 18 files Norton still can't remove and I suspect it's not updating again.
I've run Adaware repeatedly. Some objects are removed, but it always ends with the message "Some objects could not be removed. Try closing all open browser windows prior to removal, etc." As Adaware is removing objects, my desktop icons disappear, the screen flashes briefly and the My Documents window always opens.
I'm feeling way over my head, but I've read your instructions to others.....obtain logs only, no removal of anything...... and will post the logs here.
Please help! I apologize if I'm giving you way more than you need in terms of logs. Thanks in advance for anything you can do.
Here's the Find It NT-2K-XP log....
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
Find.bat is running from: C:\Program Files\finditnt2000xp\Find It NT-2K-XP
------- System Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 3441-CED9
Directory of C:\WINDOWS\System32
12/19/2004 05:56 PM 225,787 OUE2.DLL
12/19/2004 05:56 PM 225,915 f82m0if1e82.dll
12/19/2004 05:42 PM 225,914 jt2m07f1e.dll
12/19/2004 02:03 PM 226,087 f00o0ad3ed0.dll
12/19/2004 01:54 PM 226,196 lv0409dqe.dll
12/19/2004 02:37 AM 223,924 e6020gdoe60c0.dll
12/18/2004 05:39 PM 225,787 gp68l3ju1.dll
12/18/2004 05:05 PM 224,177 fpn2035oe.dll
12/17/2004 02:04 PM 224,983 OKEACC.DLL
12/17/2004 01:48 PM 224,983 IHWPHBK.DLL
12/17/2004 01:46 PM 223,046 i660lgjm16oa.dll
12/17/2004 01:39 PM 223,046 witdecod.dll
12/17/2004 10:23 AM 224,983 mwwstr10.dll
12/17/2004 09:03 AM 224,635 p6p60g7se6.dll
12/17/2004 08:35 AM 224,635 MANSSPC.DLL
12/17/2004 08:10 AM 223,225 SNRMDLL.DLL
12/17/2004 12:48 AM 223,225 SLPRV.DLL
12/17/2004 12:48 AM 224,557 i2lolc331f.dll
12/16/2004 03:01 PM 224,424 WT2TOPL.DLL
12/16/2004 10:05 AM 225,098 SWSSETUP.DLL
12/16/2004 08:51 AM 224,424 MZRCLR40.DLL
12/16/2004 03:17 AM 225,285 dnro0193e.dll
12/16/2004 02:18 AM 224,424 dxwave.dll
12/16/2004 02:09 AM 225,285 IEAGEHLP.DLL
12/16/2004 02:06 AM 224,424 II32_32.DLL
12/16/2004 01:45 AM 225,881 ddcompos.dll
12/16/2004 01:20 AM 223,222 IUETPP.DLL
12/13/2004 01:59 AM 226,050 lvp0097me.dll
12/12/2004 12:40 PM <DIR> DLLCACHE
12/12/2004 07:55 AM 223,017 DBMASF.DLL
12/11/2004 10:43 PM 223,017 MPBSYNC.DLL
12/11/2004 10:07 PM 224,612 RGVPSP.DLL
12/11/2004 09:49 PM 223,017 wccdlg.dll
12/11/2004 08:18 PM 226,158 WHBHITS.DLL
12/11/2004 07:44 PM 226,158 NGMSMGR.DLL
12/11/2004 07:44 PM 222,833 enn2l15o1.dll
12/11/2004 12:16 PM 226,158 WZN87EM.DLL
12/11/2004 12:14 PM 224,359 j8l40i3qe8.dll
12/11/2004 12:44 AM 223,327 hrr0059me.dll
12/06/2004 06:53 AM 389,120 ??chost.exe
03/22/2004 09:13 PM <DIR> Microsoft
39 File(s) 8,925,398 bytes
2 Dir(s) 67,442,290,688 bytes free
------- Hidden Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 3441-CED9
Directory of C:\WINDOWS\System32
12/12/2004 12:40 PM <DIR> DLLCACHE
12/06/2004 06:53 AM 389,120 ??chost.exe
06/26/2004 10:32 PM <DIR> GroupPolicy
09/03/2002 01:33 PM 488 WindowsLogon.manifest
09/03/2002 01:33 PM 488 logonui.exe.manifest
09/03/2002 01:33 PM 749 sapi.cpl.manifest
09/03/2002 01:33 PM 749 nwc.cpl.manifest
09/03/2002 01:33 PM 749 ncpa.cpl.manifest
09/03/2002 01:33 PM 749 wuaucpl.cpl.manifest
09/03/2002 01:33 PM 749 cdplayer.exe.manifest
8 File(s) 393,841 bytes
2 Dir(s) 67,442,290,688 bytes free
---------- Files Named "Guard" -------------
Volume in drive C has no label.
Volume Serial Number is 3441-CED9
Directory of C:\WINDOWS\System32
--------- Temp Files in System32 Directory --------
Volume in drive C has no label.
Volume Serial Number is 3441-CED9
Directory of C:\WINDOWS\System32
08/29/2002 05:00 AM 2,577 CONFIG.TMP
1 File(s) 2,577 bytes
0 Dir(s) 67,442,282,496 bytes free
---------------- User Agent ------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{F2217E10-EE42-4C5E-871C-BD3C7B8B26FE}"=""
------------ Keys Under Notify ------------
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Management]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\gp68l3ju1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
------------------ Locate.com Results ------------------
C:\WINDOWS\SYSTEM32\
dbmasf.dll Sun Dec 12 2004 7:55:06a ..S.R 223,017 217.79 K
ddcompos.dll Thu Dec 16 2004 1:45:42a ..S.R 225,881 220.59 K
dnro01~1.dll Thu Dec 16 2004 3:17:30a ..S.R 225,285 220.00 K
dxwave.dll Thu Dec 16 2004 2:18:46a ..S.R 224,424 219.16 K
e6020g~1.dll Sun Dec 19 2004 2:37:38a ..S.R 223,924 218.68 K
enn2l1~1.dll Sat Dec 11 2004 7:44:58p ..S.R 222,833 217.61 K
f00o0a~1.dll Sun Dec 19 2004 2:04:00p ..S.R 226,087 220.79 K
f82m0i~1.dll Sun Dec 19 2004 5:56:08p ..S.R 225,915 220.62 K
fpn203~1.dll Sat Dec 18 2004 5:05:56p ..S.R 224,177 218.92 K
gp68l3~1.dll Sat Dec 18 2004 5:39:36p ..S.R 225,787 220.49 K
hrr005~1.dll Sat Dec 11 2004 12:44:36a ..S.R 223,327 218.09 K
i2lolc~1.dll Fri Dec 17 2004 12:48:02a ..S.R 224,557 219.29 K
i660lg~1.dll Fri Dec 17 2004 1:46:58p ..S.R 223,046 217.82 K
ieagehlp.dll Thu Dec 16 2004 2:09:36a ..S.R 225,285 220.00 K
ihwphbk.dll Fri Dec 17 2004 1:48:24p ..S.R 224,983 219.71 K
ii32_32.dll Thu Dec 16 2004 2:06:18a ..S.R 224,424 219.16 K
iuetpp.dll Thu Dec 16 2004 1:20:28a ..S.R 223,222 217.99 K
j8l40i~1.dll Sat Dec 11 2004 12:14:52p ..S.R 224,359 219.10 K
jt2m07~1.dll Sun Dec 19 2004 5:42:16p ..S.R 225,914 220.62 K
lv0409~1.dll Sun Dec 19 2004 1:54:10p ..S.R 226,196 220.89 K
lvp009~1.dll Mon Dec 13 2004 1:59:26a ..S.R 226,050 220.75 K
mansspc.dll Fri Dec 17 2004 8:35:06a ..S.R 224,635 219.37 K
mpbsync.dll Sat Dec 11 2004 10:43:06p ..S.R 223,017 217.79 K
mwwstr10.dll Fri Dec 17 2004 10:23:38a ..S.R 224,983 219.71 K
mzrclr40.dll Thu Dec 16 2004 8:51:50a ..S.R 224,424 219.16 K
ngmsmgr.dll Sat Dec 11 2004 7:44:58p ..S.R 226,158 220.86 K
okeacc.dll Fri Dec 17 2004 2:04:26p ..S.R 224,983 219.71 K
oue2.dll Sun Dec 19 2004 5:56:10p ..S.R 225,787 220.49 K
p6p60g~1.dll Fri Dec 17 2004 9:03:06a ..S.R 224,635 219.37 K
rgvpsp.dll Sat Dec 11 2004 10:07:36p ..S.R 224,612 219.35 K
slprv.dll Fri Dec 17 2004 12:48:02a ..S.R 223,225 217.99 K
snrmdll.dll Fri Dec 17 2004 8:10:52a ..S.R 223,225 217.99 K
swssetup.dll Thu Dec 16 2004 10:05:56a ..S.R 225,098 219.82 K
wccdlg.dll Sat Dec 11 2004 9:49:30p ..S.R 223,017 217.79 K
whbhits.dll Sat Dec 11 2004 8:18:18p ..S.R 226,158 220.86 K
witdecod.dll Fri Dec 17 2004 1:39:58p ..S.R 223,046 217.82 K
wt2topl.dll Thu Dec 16 2004 3:01:36p ..S.R 224,424 219.16 K
wzn87em.dll Sat Dec 11 2004 12:16:02p ..S.R 226,158 220.86 K
chost~1.exe Mon Dec 6 2004 6:53:08a ..SHR 389,120 380.00 K
39 items found: 39 files, 0 directories.
Total of file sizes: 8,925,398 bytes 8.51 M
------------ Strings.exe Qoologic Results ------------
-------------- Strings.exe Aspack Results -------------
----------------- HKLM Run Key ------------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"URLLSTCK.exe"="C:\\Program Files\\Norton Internet Security\\UrlLstCk.exe"
"WildTangent CDA"="RUNDLL32.exe \"C:\\Program Files\\WildTangent\\Apps\\CDA\\cdaEngine0400.dll\",cdaEngineMain"
"ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"ueUiaK.exe"="C:\\documents and settings\\tammy\\local settings\\temp\\ueUiaK.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"StorageGuard"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"pvbDp.exe"="C:\\documents and settings\\tammy\\local settings\\temp\\pvbDp.exe"
"Pure Networks Port Magic"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"PPMemCheck"="C:\\PROGRA~1\\PESTPA~1\\PPMemCheck.exe"
"PJQ.exe"="C:\\documents and settings\\tammy\\local settings\\temp\\PJQ.exe"
"PestPatrol Control Center"="C:\\PROGRA~1\\PESTPA~1\\PPControl.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe"
"mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe"
"javaba32.exe"="C:\\WINDOWS\\javaba32.exe"
"Iomega Automatic Backup 1.0.1"="C:\\Program Files\\Iomega\\Iomega Automatic Backup\\ibackup.exe"
"IntelMeM"="C:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1102811785\\EE\\AOLHostManager.exe"
"grosVI.exe"="C:\\documents and settings\\tammy\\local settings\\temp\\grosVI.exe"
"DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"CookiePatrol"="C:\\PROGRA~1\\PESTPA~1\\CookiePatrol.exe"
"AZ7M2Ozhd.exe"="C:\\documents and settings\\tammy\\local settings\\temp\\AZ7M2Ozhd.exe"
"AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"
"AOL Spyware Protection"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
And the log from VX2Finder......
Log for VX2.BetterInternet File Finder (msg126)
Files Found---
Additional Files---
Keys Under Notify---
App Management
crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
wlballoon
Guardian Key--- is called:
User Agent String---
{F2217E10-EE42-4C5E-871C-BD3C7B8B26FE}
And DllCompare...
* DLLCompare Log version(1.0.0.97)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________
C:\WINDOWS\SYSTEM32\dbmasf.dll Sun Dec 12 2004 7:55:06a ..S.R 223,017 217.79 K
C:\WINDOWS\SYSTEM32\ddcompos.dll Thu Dec 16 2004 1:45:42a ..S.R 225,881 220.59 K
C:\WINDOWS\SYSTEM32\dnro01~1.dll Thu Dec 16 2004 3:17:30a ..S.R 225,285 220.00 K
C:\WINDOWS\SYSTEM32\dxwave.dll Thu Dec 16 2004 2:18:46a ..S.R 224,424 219.16 K
C:\WINDOWS\SYSTEM32\e6020g~1.dll Sun Dec 19 2004 2:37:38a ..S.R 223,924 218.68 K
C:\WINDOWS\SYSTEM32\enn2l1~1.dll Sat Dec 11 2004 7:44:58p ..S.R 222,833 217.61 K
C:\WINDOWS\SYSTEM32\f00o0a~1.dll Sun Dec 19 2004 2:04:00p ..S.R 226,087 220.79 K
C:\WINDOWS\SYSTEM32\f82m0i~1.dll Sun Dec 19 2004 5:56:08p ..S.R 225,915 220.62 K
C:\WINDOWS\SYSTEM32\fpn203~1.dll Sat Dec 18 2004 5:05:56p ..S.R 224,177 218.92 K
C:\WINDOWS\SYSTEM32\gp68l3~1.dll Sat Dec 18 2004 5:39:36p ..S.R 225,787 220.49 K
C:\WINDOWS\SYSTEM32\hrr005~1.dll Sat Dec 11 2004 12:44:36a ..S.R 223,327 218.09 K
C:\WINDOWS\SYSTEM32\i2lolc~1.dll Fri Dec 17 2004 12:48:02a ..S.R 224,557 219.29 K
C:\WINDOWS\SYSTEM32\i660lg~1.dll Fri Dec 17 2004 1:46:58p ..S.R 223,046 217.82 K
C:\WINDOWS\SYSTEM32\ieagehlp.dll Thu Dec 16 2004 2:09:36a ..S.R 225,285 220.00 K
C:\WINDOWS\SYSTEM32\ihwphbk.dll Fri Dec 17 2004 1:48:24p ..S.R 224,983 219.71 K
C:\WINDOWS\SYSTEM32\ii32_32.dll Thu Dec 16 2004 2:06:18a ..S.R 224,424 219.16 K
C:\WINDOWS\SYSTEM32\iuetpp.dll Thu Dec 16 2004 1:20:28a ..S.R 223,222 217.99 K
C:\WINDOWS\SYSTEM32\j8l40i~1.dll Sat Dec 11 2004 12:14:52p ..S.R 224,359 219.10 K
C:\WINDOWS\SYSTEM32\jt2m07~1.dll Sun Dec 19 2004 5:42:16p ..S.R 225,914 220.62 K
C:\WINDOWS\SYSTEM32\lv0409~1.dll Sun Dec 19 2004 1:54:10p ..S.R 226,196 220.89 K
C:\WINDOWS\SYSTEM32\lvp009~1.dll Mon Dec 13 2004 1:59:26a ..S.R 226,050 220.75 K
C:\WINDOWS\SYSTEM32\mansspc.dll Fri Dec 17 2004 8:35:06a ..S.R 224,635 219.37 K
C:\WINDOWS\SYSTEM32\mpbsync.dll Sat Dec 11 2004 10:43:06p ..S.R 223,017 217.79 K
C:\WINDOWS\SYSTEM32\mwwstr10.dll Fri Dec 17 2004 10:23:38a ..S.R 224,983 219.71 K
C:\WINDOWS\SYSTEM32\mzrclr40.dll Thu Dec 16 2004 8:51:50a ..S.R 224,424 219.16 K
C:\WINDOWS\SYSTEM32\ngmsmgr.dll Sat Dec 11 2004 7:44:58p ..S.R 226,158 220.86 K
C:\WINDOWS\SYSTEM32\okeacc.dll Fri Dec 17 2004 2:04:26p ..S.R 224,983 219.71 K
C:\WINDOWS\SYSTEM32\oue2.dll Sun Dec 19 2004 5:56:10p ..S.R 225,787 220.49 K
C:\WINDOWS\SYSTEM32\p6p60g~1.dll Fri Dec 17 2004 9:03:06a ..S.R 224,635 219.37 K
C:\WINDOWS\SYSTEM32\rgvpsp.dll Sat Dec 11 2004 10:07:36p ..S.R 224,612 219.35 K
C:\WINDOWS\SYSTEM32\slprv.dll Fri Dec 17 2004 12:48:02a ..S.R 223,225 217.99 K
C:\WINDOWS\SYSTEM32\snrmdll.dll Fri Dec 17 2004 8:10:52a ..S.R 223,225 217.99 K
C:\WINDOWS\SYSTEM32\swssetup.dll Thu Dec 16 2004 10:05:56a ..S.R 225,098 219.82 K
C:\WINDOWS\SYSTEM32\wccdlg.dll Sat Dec 11 2004 9:49:30p ..S.R 223,017 217.79 K
C:\WINDOWS\SYSTEM32\whbhits.dll Sat Dec 11 2004 8:18:18p ..S.R 226,158 220.86 K
C:\WINDOWS\SYSTEM32\witdecod.dll Fri Dec 17 2004 1:39:58p ..S.R 223,046 217.82 K
C:\WINDOWS\SYSTEM32\wt2topl.dll Thu Dec 16 2004 3:01:36p ..S.R 224,424 219.16 K
C:\WINDOWS\SYSTEM32\wzn87em.dll Sat Dec 11 2004 12:16:02p ..S.R 226,158 220.86 K
________________________________________________
1,301 items found: 1,301 files (38 H/S), 0 directories.
Total of file sizes: 268,170,595 bytes 255.75 M
Administrator Account = True
--------------------End log---------------------
And finally....my hijack this log. Incidentally, an error message appears when I open HijackThis, telling me it "appears to have been opened from a temporary folder, etc."....but it's not a temporary. I tried pasting into another, but still get the same message.
Logfile of HijackThis v1.99.0
Scan saved at 2:40:54 AM, on 12/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TivoBeacon.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\documents and settings\tammy\local settings\temp\AZ7M2Ozhd.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\System32\??chost.exe
C:\PROGRA~1\COMMON~1\AOL\110281~1\EE\AOLHOS~1.EXE
C:\Program Files\TiVo\Desktop\TiVoServer.exe
C:\PROGRA~1\COMMON~1\AOL\110281~1\EE\AOLServiceHost.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\America Online 9.0d\waol.exe
C:\Program Files\America Online 9.0d\shellmon.exe
C:\Documents and Settings\Tammy\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\zuyhd.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\zuyhd.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Tammy\Local Settings\Temp\aHXn52s3U.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ueUiaK.exe] C:\documents and settings\tammy\local settings\temp\ueUiaK.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pvbDp.exe] C:\documents and settings\tammy\local settings\temp\pvbDp.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PJQ.exe] C:\documents and settings\tammy\local settings\temp\PJQ.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [javaba32.exe] C:\WINDOWS\javaba32.exe
O4 - HKLM\..\Run: [Iomega Automatic Backup 1.0.1] C:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1102811785\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [grosVI.exe] C:\documents and settings\tammy\local settings\temp\grosVI.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [AZ7M2Ozhd.exe] C:\documents and settings\tammy\local settings\temp\AZ7M2Ozhd.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [Iomega Automatic Backup] C:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
O4 - HKCU\..\Run: [Yvaz] C:\WINDOWS\System32\??chost.exe
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /auto:TivoServer
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0d\AOL.EXE" -b
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{45CA330F-30C2-47FC-B2FA-5527179FC356}: NameServer = 205.188.146.146
O23 - Service: AOL Connectivity Service - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service - Unknown - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVSvc - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TiVo Beacon - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TivoBeacon.exe
O23 - Service: WANMiniportService - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\winxq.exe (file missing)
Sign In
Create Account
