HiJackThis log:
Logfile of HijackThis v1.99.1
Scan saved at 9:12:24 PM, on 9/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\Qctray.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\system32\IMWEBSTA.EXE
C:\Program Files\SealedMedia\sealmon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\CMU\KClient\bin32\kstatus.exe
C:\Program Files\eFax Messenger 3.5\J2GDllCmd.exe
C:\Program Files\eFax Messenger 3.5\J2GTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
d:\Documents and Settings\starosky\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by G Money
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r6.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r6.attbi.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\system32\ddcax.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [QCTRAY] C:\PROGRA~1\ThinkPad\CONNEC~1\Qctray.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [dla] ;C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe
O4 - HKLM\..\Run: [IMWEBSTA.EXE] IMWEBSTA.EXE START
O4 - HKLM\..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [SAClient] "C:\Program Files\Comcast\BBClient\Programs\RegCon.exe" /admincheck
O4 - HKLM\..\Run: [SAUpdate] "C:\Program Files\Comcast\BBClient\Programs\SAUpdate.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TempRemove] "C:\Program Files\Crystal Ball\CB Predictor\terminator.exe"
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: KClient.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: eFax DllCmd 3.5.lnk = C:\Program Files\eFax Messenger 3.5\J2GDllCmd.exe
O4 - Global Startup: eFax Tray Menu 3.5.lnk = C:\Program Files\eFax Messenger 3.5\J2GTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {04786233-6598-4841-900A-30613ADC8303} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Support - {4E20CA35-E891-45E8-A4D5-C9CD56D908A3} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {E106CCDB-09FC-451B-9726-ABF3667A5028} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: Yahoo! Chat - http://cs6.chat.sc5....m/c381/chat.cab
O16 - DPF: Yahoo! NFL GameChannel StatTracker - http://aud5.sports.s...lgcst1010_x.cab
O16 - DPF: {0DD4833D-DFFA-11D3-94D7-0050DAC353B6} (DndCtrl Class) - http://www.ofoto.com/OfotoDND.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {1CAF87A2-D9D7-4F97-832F-C88F89CA1A49} (kwebqa Class) - http://webdist.andre...les/kwebax2.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://cs6.chat.sc5....v43/yacscom.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1125531783420
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com..._1/axofupld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://www.gircheck...tivexviewer.cab
O20 - Winlogon Notify: ddcax - C:\WINDOWS\system32\ddcax.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: CWShredder Service - InterMute, Inc. - d:\Documents and Settings\starosky\Desktop\Adware\cwshredder-1.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: QCONSVC - Unknown owner - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe
Ewido report:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 7:08:25 PM, 9/26/2005
+ Report-Checksum: BC4E0182
+ Scan result:
HKLM\SOFTWARE\DelFin -> Spyware.Delfin : Cleaned with backup
HKLM\SOFTWARE\DelFin\PromulGate -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-1041330119-1840346433-1801089185-1018\Software\DelFin -> Spyware.Delfin : Cleaned with backup
HKU\S-1-5-21-1041330119-1840346433-1801089185-1018\Software\DelFin\PromulGate -> Spyware.Delfin : Cleaned with backup
C:\Documents and Settings\jb92\Cookies\administrator@com[1].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\System Volume Information\_restore{D3DAF0EE-BE21-47ED-A1B9-342D79792CEC}\RP627\A0069843.exe -> Spyware.NewDotNet : Cleaned with backup
C:\System Volume Information\_restore{D3DAF0EE-BE21-47ED-A1B9-342D79792CEC}\RP627\A0069844.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\system\appdl.exe -> Trojan.VB.el : Cleaned with backup
C:\WINDOWS\system32\awtuu.dll -> Trojan.Crypt.o : Cleaned with backup
C:\WINDOWS\system32\chktrust.exe -> Spyware.BargainBuddy : Cleaned with backup
C:\WINDOWS\system32\ddcax.dll -> Trojan.Crypt.o : Cleaned with backup
C:\WINDOWS\system32\fcccb.dll -> Trojan.Crypt.o : Cleaned with backup
C:\WINDOWS\system32\ljjhh.dll -> Trojan.Crypt.o : Cleaned with backup
:mozilla.15:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.17:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.19:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.21:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.22:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.6:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.7:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.8:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.9:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.10:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.11:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.12:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.15:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.16:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.17:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.28:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.35:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.36:D:\Documents and Settings\starosky\Application Data\Mozilla\Profiles\starosky\9c4le3ij.slt-new\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.7:D:\Documents and Settings\starosky\Application Data\Mozilla\Firefox\Profiles\w83lzkq7.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.8:D:\Documents and Settings\starosky\Application Data\Mozilla\Firefox\Profiles\w83lzkq7.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.9:D:\Documents and Settings\starosky\Application Data\Mozilla\Firefox\Profiles\w83lzkq7.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.10:D:\Documents and Settings\starosky\Application Data\Mozilla\Firefox\Profiles\w83lzkq7.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
D:\Documents and Settings\starosky\Desktop\Prgms\NDNuninstall4_50.exe -> Spyware.NewDotNet : Cleaned with backup
D:\Documents and Settings\starosky\Desktop\Prgms\NDNuninstall4_80.exe -> Spyware.NewDotNet : Cleaned with backup
::Report End