Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Random generation of .exe files [CLOSED]

Started by manjuari , Apr 12 2004 09:20 PM

This topic is locked

#1
manjuari

Posted 12 April 2004 - 09:20 PM

New Member

Member
2 posts

I think my problem is similar to that posted by Brandts a couple weeks ago. I, too, am a novice and hesitate to make changes based on what I read in those postings.

At startup, I get a bunch of messages saying that certain shortcuts can't be found. I was also getting a lot of pop-ups on the Internet, but I may have taken care of those with AdAware.

Thanks in advance for your help. Here goes...this is the copy of the HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 9:34:45 PM, on 4/12/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPHA1MON.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PMLDRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HP PHOTOSMART\P1100\EREG\REMIND32.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\HPHSTSC0.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presar...=search&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presa...onsumer&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presar...archbar&LC=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presar...archbar&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
F1 - win.ini: run=hpfsched
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRAM FILES\LYCOS\IEAGENT\CSIE.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [10UDF7OJ.EXE] C:\WINDOWS\10UDF7OJ.EXE /dk
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [HPHA1MON] C:\WINDOWS\SYSTEM\HPHA1MON.EXE
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [Digital Dashboard] C:\Program Files\Compaq\Digital Dashboard\DevGulp.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [AvconsoleEXE] C:\Program Files\Network Associates\McAfee VirusScan\avconsol.exe /minimize
O4 - HKLM\..\Run: [VsecomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSEcomR.EXE
O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ClrSchLoader] \Progra~1\Lycos\IEagent\Loader.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [msbb] c:\program files\n-case\msbb.exe
O4 - HKLM\..\Run: [ctehohwn] C:\WINDOWS\ctehohwn.exe
O4 - HKLM\..\Run: [XTRACTE] C:\WINDOWS\SYSTEM\XTRACTE.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Startup: Reminder-hpc40415.lnk = C:\Program Files\HP PhotoSmart\P1100\ereg\Remind32.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Adobe Gamma Loader.lnk = C:\cpqs\quicksr\PATCHES.EXE
O4 - Startup: Microtek Scanner Finder.lnk = C:\WINDOWS\Twain_32\ScanWiz5\SDII.exe
O4 - Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O4 - Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Global Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Global Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Global Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Global Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Global Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Global Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Global Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Global Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Global Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Global Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Global Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Global Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Global Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Global Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Global Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Global Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Global Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Global Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Global Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Global Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Global Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Global Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Global Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Global Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Global Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Global Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Global Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Global Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Global Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Global Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Global Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Global Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Global Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Global Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Global Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~5\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)
O9 - Extra 'Tools' menuitem: AV Home (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...B?1073623371260
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab

#2
admin

Posted 12 April 2004 - 10:09 PM

Founder Geek

Community Leader
24,639 posts

Welcome manjuari <_<

This is an Adtomi infection. Kinda difficult to remove. Did you have the latest reference file downloaded when you ran Ad-aware?

Using Ad-aware: Open Ad-Aware and use the Check for updates now link. Download and accept the latest reference file. When finished click the Start button. When done scanning, the Abort button will change to Next. Click the Next button. Right-click in the Scanning Results window and click "Select all objects". Then click the "Next" button and confirm that you want to delete the selected entries.

#3
manjuari

Posted 19 April 2004 - 07:29 PM

New Member

Topic Starter
Member
2 posts

Thanks for your suggestion. I just updated the AdAware and ran another scan. Here is the log of the HiJack This scan that I did right after that. Let me know what's next. I really appreciate your help.

Logfile of HijackThis v1.97.7
Scan saved at 8:17:31 PM, on 4/19/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPHA1MON.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\MONEY EXPRESS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\PMLDRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HP PHOTOSMART\P1100\EREG\REMIND32.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.aol.com/n...rosoft.ie4.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presar...=search&LC=0409
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presa...onsumer&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presar...archbar&LC=0409
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...B_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presar...archbar&LC=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aol.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>
R3 - Default URLSearchHook is missing
F1 - win.ini: run=hpfsched
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [10UDF7OJ.EXE] C:\WINDOWS\10UDF7OJ.EXE /dk
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [HPHA1MON] C:\WINDOWS\SYSTEM\HPHA1MON.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [Digital Dashboard] C:\Program Files\Compaq\Digital Dashboard\DevGulp.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [AvconsoleEXE] C:\Program Files\Network Associates\McAfee VirusScan\avconsol.exe /minimize
O4 - HKLM\..\Run: [VsecomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSEcomR.EXE
O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ClrSchLoader] \Progra~1\Lycos\IEagent\Loader.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [msbb] c:\program files\n-case\msbb.exe
O4 - HKLM\..\Run: [ctehohwn] C:\WINDOWS\ctehohwn.exe
O4 - HKLM\..\Run: [XTRACTE] C:\WINDOWS\SYSTEM\XTRACTE.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Startup: Reminder-hpc40415.lnk = C:\Program Files\HP PhotoSmart\P1100\ereg\Remind32.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Adobe Gamma Loader.lnk = C:\cpqs\quicksr\PATCHES.EXE
O4 - Startup: Microtek Scanner Finder.lnk = C:\WINDOWS\Twain_32\ScanWiz5\SDII.exe
O4 - Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O4 - Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Global Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Global Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Global Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Global Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Global Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Global Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Global Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Global Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Global Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Global Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Global Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Global Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Global Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Global Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Global Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Global Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Global Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Global Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Global Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Global Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Global Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Global Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Global Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Global Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Global Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Global Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Global Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Global Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Global Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Global Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Global Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Global Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Global Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Global Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Global Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~5\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)
O9 - Extra 'Tools' menuitem: AV Home (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...B?1073623371260
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab

#4
Kat

Posted 03 September 2005 - 12:43 AM

Retired

Retired Staff
19,711 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.