Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

problem [CLOSED]

Started by avensteph , Sep 17 2005 07:12 PM

  • This topic is locked This topic is locked

#16
don77
Posted 24 September 2005 - 09:59 AM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Could you post back a fresh HJT log please
  • 0

Advertisements

#17
avensteph
Posted 24 September 2005 - 10:16 AM

avensteph

    banned

  • Topic Starter
  • Banned
  • PipPip
  • 45 posts
Logfile of HijackThis v1.99.1
Scan saved at 10:15:13 AM, on 9/24/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\SYSTEM32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\carpserv.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Windows\System32\PackethSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
C:\Windows\System32\NMSSvc.exe
C:\Windows\spoollv.exe
C:\Windows\System32\svchost.exe
C:\Windows\wanmpsvc.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\Paulette Parchmont\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://store.presari...&c=2c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
N2 - Netscape 6: user_pref("browser.startup.homepage", "http://www.plnmfnxaj...Pirzn/BqY.html");\nuser_pref("browser.startup.page", 1); (C:\Documents and Settings\Paulette Parchmont\Application Data\Mozilla\Profiles\default\gf6vvesx.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AutoLogon] regedit.exe /s \appl.zip\WXPPUPTW\logon.reg
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe -z
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\Windows\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Backgammon - http://download.game...nts/y/at1_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt3_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by21fd.bay21....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1099534254108
O16 - DPF: {6E2D6932-3885-4FA2-8DD4-DB63FFE33797} (PhotoPickConvert Class) - http://appdirectory....ap/PhtPkCnv.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1126577497264
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O18 - Protocol: dynascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\Windows\System32\ImapiRox.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\Windows\system32\msCMTSrvc.exe (file missing)
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\Windows\System32\PackethSvc.exe
O23 - Service: spool - Unknown owner - C:\Windows\spoollv.exe
O23 - Service: SystemManager - Unknown owner - C:\Windows\sysmanager.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\Windows\wanmpsvc.exe
  • 0

#18
avensteph
Posted 24 September 2005 - 10:21 AM

avensteph

    banned

  • Topic Starter
  • Banned
  • PipPip
  • 45 posts
Um hey, i dont mean to b rude or anything but, u think u can try to find a solution soon, cause the problem is getting worse, first it was only during startup this happend now its happening every couple of mins and it closes all iexplorer windows i have open, and its annoying, if u think theres no solution and the only thing left is to reinstall win xp, let me know, thanx again.
  • 0

#19
don77
Posted 25 September 2005 - 07:58 AM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Run this please lop uninstaller

Next
Go to Start > Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the below services:

SystemManager

When you find it, double-click on it. In the next window that opens, under the General tab click the Stop button, then click the drop-down box to change the Startup Type to Disabled. Now hit Apply and then Ok.

Next
Please restart HJT put a check next to the following, close all open windows and click “Fix Checked”

N2 - Netscape 6: user_pref("browser.startup.homepage", "http://www.plnmfnxaj...Pirzn/BqY.html");\nuser_pref("browser.startup.page", 1); (C:\Documents and Settings\Paulette Parchmont\Application Data\Mozilla\Profiles\default\gf6vvesx.slt\prefs.js)

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: SystemManager - Unknown owner - C:\Windows\sysmanager.exe (file missing)

Next Reboot into SAFE MODE
Search for and delete the Folders/Files highlighted in Blue

C:\Program Files\Messenger Plus! 3\ <--Delete Folder

Restart your computer, Post back a fresh log please
  • 0

#20
avensteph
Posted 25 September 2005 - 07:55 PM

avensteph

    banned

  • Topic Starter
  • Banned
  • PipPip
  • 45 posts
Here is the fresh log, um i couldnt find the first and last file on the highjack log, they didnt show up on the list of objects to b fixed.

Logfile of HijackThis v1.99.1
Scan saved at 7:53:42 PM, on 9/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\SYSTEM32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\carpserv.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\PackethSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
C:\Windows\System32\svchost.exe
C:\Windows\wanmpsvc.exe
c:\Program Files\Microsoft Money\System\urlmap.exe
C:\Windows\System32\wuauclt.exe
C:\Documents and Settings\Paulette Parchmont\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://store.presari...&c=2c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AutoLogon] regedit.exe /s \appl.zip\WXPPUPTW\logon.reg
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe -z
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\Windows\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Backgammon - http://download.game...nts/y/at1_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt3_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by21fd.bay21....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1099534254108
O16 - DPF: {6E2D6932-3885-4FA2-8DD4-DB63FFE33797} (PhotoPickConvert Class) - http://appdirectory....ap/PhtPkCnv.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1126577497264
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O18 - Protocol: dynascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\Windows\System32\ImapiRox.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\Windows\system32\msCMTSrvc.exe (file missing)
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\Windows\System32\PackethSvc.exe
O23 - Service: spool - Unknown owner - C:\Windows\spoollv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\Windows\wanmpsvc.exe
  • 0

#21
don77
Posted 25 September 2005 - 08:27 PM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Nice job your log is clean !
How is it running ?
Please use the following suggestion to help prevent reinfection

First Off,
*Be sure and reset your hidden Files and Folders*

Download the following program, For keeping crap off your system to begin with
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests. Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox. Restrict the actions of potentially dangerous sites in Internet Explorer.
Download Spyware Blaster

Keep AD-Aware. and Spybot 1.3 handy, Check them for updates prior to running and run them weekly
Same with your Anti Virus,

For an added check run an online virus scan, you can use one of the 2 below,
TrendMicro's HouseCall
ActiveScan

Be sure and give the Temp folders a cleaning out now and then as well, Make sure after you clean your Temp files to empty out your Recycle bin as well.
Click Start | Run | type in cleanmgr | OK

Let it scan your system for files to remove.

Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.

Press OK to remove them.


Remeber to Check Windows for updates

Probably a good time to create a new restore point See Here for XP

See Here for ME Name it clean or something like that,
  • 0

#22
avensteph
Posted 26 September 2005 - 09:00 PM

avensteph

    banned

  • Topic Starter
  • Banned
  • PipPip
  • 45 posts
the problem with the MS-DOS prompt box is gone, but im still being redirected to the following site http://217.170.4.137..._bin/index.html

Edited by avensteph, 26 September 2005 - 10:36 PM.

  • 0

#23
don77
Posted 27 September 2005 - 07:57 PM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Please download ewido security suite it is a trial version of the program.
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Once the updates are installed do the following:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • While the scan is in progress you will be prompted to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Now close ewido security suite.


Post back the Report.txt and a fresh HJT log please
  • 0

#24
avensteph
Posted 27 September 2005 - 10:35 PM

avensteph

    banned

  • Topic Starter
  • Banned
  • PipPip
  • 45 posts
report text, also when the files were being removed i assume, i kept getting messages saying the file could not b removed because it was embedded into another archive and if to remove the entire folder, some i clicked yes, but others i clicked no, cause i wasnt sure if it would affect my OS or not

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:30:38 PM, 9/27/2005
+ Report-Checksum: C3A67352

+ Scan result:

HKLM\SOFTWARE\Classes\WinStatX.Installer\CLSID\\ -> Spyware.WinFavorites : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/axload.dll\\.Owner -> TrojanDownloader.AXLoad : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/axload.dll\\{00000000-7777-0704-0B53-2C8830E9FAEC} -> TrojanDownloader.AXLoad : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/HDPlugin1101.dll\\.Owner -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/HDPlugin1101.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.2/HDPlugin1101.dll\\.Owner -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.2/HDPlugin1101.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.3/HDPlugin1101.dll\\.Owner -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.3/HDPlugin1101.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> Spyware.Gator : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/WinAdToolsX.dll\\.Owner -> Spyware.WinFavorites : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/WinAdToolsX.dll\\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/WinStatX.dll\\.Owner -> Spyware.WinFavorites : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/WinStatX.dll\\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0HUVS5IN\ibar[1].js -> TrojanDownloader.IstBar.ad : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0HUVS5IN\prompt[1].htm -> TrojanDownloader.IstBar.j : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\EHIN8L4X\y[1].exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJ8FYNOD\m11[1].jpg/y.bat -> Trojan.Zapchast : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJ8FYNOD\prompt[1].htm -> TrojanDownloader.IstBar.j : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJ8FYNOD\ysb_prompt[1].htm -> TrojanDownloader.IstBar.j : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\VW918F42\ysb_prompt[1].htm -> TrojanDownloader.IstBar.j : Cleaned with backup
C:\Documents and Settings\Paulette Parchmont\Cookies\paulette parchmont@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\Documents and Settings\Paulette Parchmont\Cookies\paulette parchmont@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
C:\Documents and Settings\Paulette Parchmont\Local Settings\Temp\Cookies\paulette parchmont@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Paulette Parchmont\Local Settings\Temp\Cookies\paulette parchmont@paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Paulette Parchmont\Local Settings\Temp\Temporary Internet Files\Content.IE5\CFMRWP8D\ibar[1].js -> TrojanDownloader.IstBar.ad : Cleaned with backup
C:\Documents and Settings\Paulette Parchmont\Local Settings\Temp\Temporary Internet Files\Content.IE5\WT7GDU8E\ysb_prompt[1].htm -> TrojanDownloader.IstBar.j : Cleaned with backup
C:\gbh.exe/y.bat -> Trojan.Zapchast : Cleaned with backup
C:\gfhbh.exe/y.bat -> Trojan.Zapchast : Cleaned with backup
C:\gr.exe/y.bat -> Trojan.Zapchast : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\1C3BCC32-6264-4D37-A021-04FDD1\D20F422A-8AA5-4BBF-A413-AFC9A4/C:/Windows/System32/msbe.dll -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\1C3BCC32-6264-4D37-A021-04FDD1\D20F422A-8AA5-4BBF-A413-AFC9A4/C:/Program Files/BullsEye Network/bin/bargains.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\1C3BCC32-6264-4D37-A021-04FDD1\D20F422A-8AA5-4BBF-A413-AFC9A4/C:/Program Files/BullsEye Network/bin/adv.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\1C3BCC32-6264-4D37-A021-04FDD1\D20F422A-8AA5-4BBF-A413-AFC9A4/C:/Program Files/BullsEye Network/bin/adx.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\24180A63-DB2D-414E-988F-3BA92D\61BE656B-2C6C-4B8B-AEE6-658EE3 -> Spyware.AdTools : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\24DA059B-897F-4FE7-B1D2-A44F43\EB438616-9C68-404D-93DD-31C225 -> Spyware.Relevance : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\28F8220E-3A3A-4629-804D-276DA3\AE7C0963-AEFF-4BC4-AE44-72EE33 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\30FCDE4A-1339-47C4-AF57-7B6190\B4839B78-7446-476A-BB1A-8EBA3E -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\48A7F52A-4701-44F9-AA73-68EC09\D1195FA1-FE41-48EA-86CC-277B23 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\64103750-4BB1-414C-BA8B-D16197\4C41F630-08A4-4ADE-B88B-F0FF3E/C:/Windows/System32/msbe.dll -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\64103750-4BB1-414C-BA8B-D16197\4C41F630-08A4-4ADE-B88B-F0FF3E/C:/Program Files/BullsEye Network/bin/bargains.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\64103750-4BB1-414C-BA8B-D16197\4C41F630-08A4-4ADE-B88B-F0FF3E/C:/Program Files/BullsEye Network/bin/adv.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\64103750-4BB1-414C-BA8B-D16197\4C41F630-08A4-4ADE-B88B-F0FF3E/C:/Program Files/BullsEye Network/bin/adx.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\6C459381-6B9D-42C8-8EEA-41C15A\70FEFC42-3C13-4C65-BA23-CA0C09 -> Adware.SAHA : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\6C4B5850-8DDC-4847-83D3-A6AB7F\39465ED0-87CD-493F-91B1-867C38/C:/Windows/System32/msbe.dll -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\6C4B5850-8DDC-4847-83D3-A6AB7F\39465ED0-87CD-493F-91B1-867C38/C:/Program Files/BullsEye Network/bin/bargains.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\6C4B5850-8DDC-4847-83D3-A6AB7F\39465ED0-87CD-493F-91B1-867C38/C:/Program Files/BullsEye Network/bin/adv.exe -> Spyware.BargainBuddy : Error during cleaning
-> : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\70925796-02ED-4D9E-B744-9FA411\62480DDF-7691-406E-9386-BDD89F/C:/Windows/System32/msbe.dll -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\70925796-02ED-4D9E-B744-9FA411\62480DDF-7691-406E-9386-BDD89F/C:/Program Files/BullsEye Network/bin/bargains.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\70925796-02ED-4D9E-B744-9FA411\62480DDF-7691-406E-9386-BDD89F/C:/Program Files/BullsEye Network/bin/adv.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\70925796-02ED-4D9E-B744-9FA411\62480DDF-7691-406E-9386-BDD89F/C:/Program Files/BullsEye Network/bin/adx.exe -> Spyware.BargainBuddy : Error during cleaning
C:\Program Files\Microsoft AntiSpyware\Quarantine\9CCAC5D9-8DE7-458F-8A3D-668495\08B44690-1718-4DBF-88A9-0B5CB6 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\A0AEAB9E-676A-4DFE-ADFF-66F1BB\C451B357-B274-4538-8A27-34CA5F -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\C65DB2B7-1B56-42FB-9406-7D2DA1\36DAAE51-A8FB-4BE6-A648-1FC638 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CB95CFDB-957B-411A-8CCE-399E19\5A125641-EF02-40D7-BA54-F3CD44 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\11E22EB3-C092-49B9-B846-4D81D2 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\160C9E6F-66E1-4F30-95A9-DFED3E -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\4F3FFD63-8A28-4C6F-B290-8A2C14 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\A505975A-DBBA-4C04-922F-97E092 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\DE244595-069B-432F-B9F9-F98534 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\E002F302-A73D-4537-8EA3-D3530C -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\E19FCD2A-0A5F-4E95-9C2B-7AEAAF -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\E3D8B802-9A2A-4797-9691-FF377E -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\CF0E06FB-5CD2-4732-8B52-DB634D\EE4ED5AF-D521-41BD-9E06-9ECB99 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\EA047176-1A1A-43F3-9DBB-4A35F6\89F98432-3186-4351-B569-3D04E8 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\EA047176-1A1A-43F3-9DBB-4A35F6\B2AA07D3-E854-4B92-8FB1-B831C5 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\EF28E285-9046-4725-B7A2-0941EB\6C9C117F-2C67-45E2-9A3C-14022A -> Spyware.AdTools : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\F0F32369-AEAC-496F-A6D9-3B6697\F6733752-6F36-4EFA-AF6E-BC8776 -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\F75E3AE8-B3B9-4C7D-9289-104764\C14E8DBB-6F63-4FAA-A46F-341B92 -> Spyware.Relevance : Cleaned with backup
C:\Program Files\MyEmoticons\VVSNI_S3_MYEM_Inst.exe -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Netscape\Netscape 6\Plugins\npwthost.dll -> Spyware.WildTangent : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP202\A0072368.ini:acrjo -> Backdoor.Small.dc : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP203\A0072489.exe -> TrojanDownloader.IstBar.lu : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097213.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097291.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097292.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097293.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097305.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097475.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097476.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097512.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097666.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097667.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0097684.dll -> Spyware.Comet : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098493.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098505.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098506.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098507.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098524.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098538.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098539.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098563.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098564.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098565.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098578.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098579.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098594.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098595.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098596.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098612.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0098613.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099612.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099613.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099637.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099652.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099653.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099654.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099686.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099691.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099692.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099712.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099713.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099725.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099726.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0099727.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0101615.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0101624.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP260\A0101625.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101667.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101671.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101672.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101691.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101692.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101718.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101719.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101784.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101785.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101786.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101802.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101818.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101819.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101820.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101834.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101835.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101836.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0101837.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0102833.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0102846.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0102847.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP262\A0102848.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0102853.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0102854.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0102859.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103846.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103862.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103863.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103864.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103865.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103891.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103892.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103893.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP263\A0103894.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103937.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103939.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103940.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103964.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103965.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103966.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103967.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103985.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103987.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP264\A0103988.bat -> Trojan.Zapchast : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0104000.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0104001.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0104014.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0104018.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0105096.reg -> Trojan.WinREG.LowZones.f : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0105097.reg -> Trojan.WinREG.LowZones.f : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0105112.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0105122.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP265\A0105125.exe/y.bat -> Trojan.Zapchast : Error during cleaning
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP266\A0106122.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\System Volume Information\_restore{B22743D3-F062-426E-B1F6-9338BC116202}\RP266\A0106137.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1101.dll -> Adware.Gator : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\HDPlugin1101.dll -> Adware.Gator : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\HDPlugin1101.dll -> Adware.Gator : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\HDPlugin1101.dll -> Adware.Gator : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
C:\WINDOWS\iis6.log:jfhif -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\psis80ex.ax/C:/Windows/System32/mscb.dll -> Spyware.BargainBuddy : Error during cleaning
C:\WINDOWS\system32\psis80ex.ax/C:/Program Files/CashBack/bin/cashback.exe -> Spyware.BargainBuddy : Error during cleaning
C:\WINDOWS\system32\psis80ex.ax/C:/Program Files/CashBack/bin/cb.exe -> Spyware.BargainBuddy : Error during cleaning
C:\WINDOWS\system32\psis80ex.ax/C:/Program Files/CashBack/bin/flash.exe -> Spyware.BargainBuddy : Error during cleaning
C:\WINDOWS\system32\remon.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\WINDOWS\system32\shell32.exe -> Spyware.WinAD : Cleaned with backup
C:\WINDOWS\system32\spoolv.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup
C:\WINDOWS\taskman(2).exe:ibyeu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\taskman.exe:ibyeu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\TW561a(2).ini:acrjo -> Backdoor.Small.dc : Cleaned with backup
C:\WINDOWS\wmsetup10.log:sztkf -> TrojanDownloader.Small.ajr : Cleaned with backup
C:\WINDOWS\y.bat -> Trojan.Zapchast : Cleaned with backup


::Report End

Highjacklog file

Logfile of HijackThis v1.99.1
Scan saved at 10:32:10 PM, on 9/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\SYSTEM32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\carpserv.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Windows\System32\PackethSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
C:\Windows\System32\NMSSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\wanmpsvc.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\securitysuite.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Windows\system32\NOTEPAD.EXE
c:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\Paulette Parchmont\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://store.presari...&c=2c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AutoLogon] regedit.exe /s \appl.zip\WXPPUPTW\logon.reg
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe -z
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\Windows\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Backgammon - http://download.game...nts/y/at1_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt3_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by21fd.bay21....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1099534254108
O16 - DPF: {6E2D6932-3885-4FA2-8DD4-DB63FFE33797} (PhotoPickConvert Class) - http://appdirectory....ap/PhtPkCnv.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1126577497264
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O18 - Protocol: dynascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\Windows\System32\ImapiRox.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\Windows\system32\msCMTSrvc.exe (file missing)
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\Windows\System32\PackethSvc.exe
O23 - Service: spool - Unknown owner - C:\Windows\spoollv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\Windows\wanmpsvc.exe
  • 0

#25
don77
Posted 30 September 2005 - 07:45 AM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Sorry was away for a few days

Please download and install AD-Aware.
Check Here on how setup and use it - please make sure you update it first.


Next
Dowload the latest version of Spybot 1.4. Please check it for updates, Run the program and have it fix anything it finds in Red.


Restart your computer,

Let me know if you are still getting redirected
  • 0

Advertisements

#26
don77
Posted 03 October 2005 - 05:22 PM

don77

    Malware Expert

  • Retired Staff
  • 18,526 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP