Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Random generation of .exe files [CLOSED]


  • This topic is locked This topic is locked

#1
manjuari

manjuari

    New Member

  • Member
  • Pip
  • 2 posts
I think my problem is similar to that posted by Brandts a couple weeks ago. I, too, am a novice and hesitate to make changes based on what I read in those postings.

At startup, I get a bunch of messages saying that certain shortcuts can't be found. I was also getting a lot of pop-ups on the Internet, but I may have taken care of those with AdAware.

Thanks in advance for your help. Here goes...this is the copy of the HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 9:34:45 PM, on 4/12/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPHA1MON.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PMLDRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HP PHOTOSMART\P1100\EREG\REMIND32.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\HPHSTSC0.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presar...=search&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presa...onsumer&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presar...archbar&LC=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presar...archbar&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
F1 - win.ini: run=hpfsched
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRAM FILES\LYCOS\IEAGENT\CSIE.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [10UDF7OJ.EXE] C:\WINDOWS\10UDF7OJ.EXE /dk
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [HPHA1MON] C:\WINDOWS\SYSTEM\HPHA1MON.EXE
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [Digital Dashboard] C:\Program Files\Compaq\Digital Dashboard\DevGulp.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [AvconsoleEXE] C:\Program Files\Network Associates\McAfee VirusScan\avconsol.exe /minimize
O4 - HKLM\..\Run: [VsecomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSEcomR.EXE
O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ClrSchLoader] \Progra~1\Lycos\IEagent\Loader.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [msbb] c:\program files\n-case\msbb.exe
O4 - HKLM\..\Run: [ctehohwn] C:\WINDOWS\ctehohwn.exe
O4 - HKLM\..\Run: [XTRACTE] C:\WINDOWS\SYSTEM\XTRACTE.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Startup: Reminder-hpc40415.lnk = C:\Program Files\HP PhotoSmart\P1100\ereg\Remind32.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Adobe Gamma Loader.lnk = C:\cpqs\quicksr\PATCHES.EXE
O4 - Startup: Microtek Scanner Finder.lnk = C:\WINDOWS\Twain_32\ScanWiz5\SDII.exe
O4 - Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O4 - Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Global Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Global Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Global Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Global Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Global Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Global Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Global Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Global Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Global Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Global Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Global Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Global Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Global Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Global Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Global Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Global Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Global Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Global Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Global Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Global Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Global Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Global Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Global Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Global Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Global Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Global Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Global Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Global Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Global Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Global Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Global Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Global Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Global Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Global Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Global Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~5\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)
O9 - Extra 'Tools' menuitem: AV Home (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...B?1073623371260
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
  • 0

Advertisements


#2
admin

admin

    Founder Geek

  • Administrator
  • 24,501 posts
Welcome manjuari <_<

This is an Adtomi infection. Kinda difficult to remove. Did you have the latest reference file downloaded when you ran Ad-aware?

Using Ad-aware: Open Ad-Aware and use the Check for updates now link. Download and accept the latest reference file. When finished click the Start button. When done scanning, the Abort button will change to Next. Click the Next button. Right-click in the Scanning Results window and click "Select all objects". Then click the "Next" button and confirm that you want to delete the selected entries.
  • 0

#3
manjuari

manjuari

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Thanks for your suggestion. I just updated the AdAware and ran another scan. Here is the log of the HiJack This scan that I did right after that. Let me know what's next. I really appreciate your help.

Logfile of HijackThis v1.97.7
Scan saved at 8:17:31 PM, on 4/19/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPHA1MON.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\MONEY EXPRESS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\PMLDRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HP PHOTOSMART\P1100\EREG\REMIND32.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.aol.com/n...rosoft.ie4.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presar...=search&LC=0409
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presa...onsumer&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presar...archbar&LC=0409
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...B_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presar...archbar&LC=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aol.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>
R3 - Default URLSearchHook is missing
F1 - win.ini: run=hpfsched
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [10UDF7OJ.EXE] C:\WINDOWS\10UDF7OJ.EXE /dk
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [HPHA1MON] C:\WINDOWS\SYSTEM\HPHA1MON.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [Digital Dashboard] C:\Program Files\Compaq\Digital Dashboard\DevGulp.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [AvconsoleEXE] C:\Program Files\Network Associates\McAfee VirusScan\avconsol.exe /minimize
O4 - HKLM\..\Run: [VsecomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSEcomR.EXE
O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ClrSchLoader] \Progra~1\Lycos\IEagent\Loader.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [msbb] c:\program files\n-case\msbb.exe
O4 - HKLM\..\Run: [ctehohwn] C:\WINDOWS\ctehohwn.exe
O4 - HKLM\..\Run: [XTRACTE] C:\WINDOWS\SYSTEM\XTRACTE.exe
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [3N6GZQJB.EXE] C:\WINDOWS\3N6GZQJB.EXE /dk
O4 - Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Startup: Reminder-hpc40415.lnk = C:\Program Files\HP PhotoSmart\P1100\ereg\Remind32.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Adobe Gamma Loader.lnk = C:\cpqs\quicksr\PATCHES.EXE
O4 - Startup: Microtek Scanner Finder.lnk = C:\WINDOWS\Twain_32\ScanWiz5\SDII.exe
O4 - Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O4 - Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: E6304JYK.lnk = C:\WINDOWS\e6304jyk.exe
O4 - Global Startup: W18TZN9H.lnk = C:\WINDOWS\w18tzn9h.exe
O4 - Global Startup: Y8LMVO44.lnk = C:\WINDOWS\y8lmvo44.exe
O4 - Global Startup: HJJ20BCK.lnk = C:\WINDOWS\hjj20bck.exe
O4 - Global Startup: 10UDF7OJ.lnk = C:\WINDOWS\10udf7oj.exe
O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Global Startup: UURN92R6.lnk = C:\WINDOWS\uurn92r6.exe
O4 - Global Startup: 2QBUBBA1.lnk = C:\WINDOWS\2qbubba1.exe
O4 - Global Startup: WP9NY7MT.lnk = C:\WINDOWS\wp9ny7mt.exe
O4 - Global Startup: 980TA4AQ.lnk = C:\WINDOWS\980ta4aq.exe
O4 - Global Startup: X9KANMKO.lnk = C:\WINDOWS\x9kanmko.exe
O4 - Global Startup: 9DTJUXKW.lnk = C:\WINDOWS\9dtjuxkw.exe
O4 - Global Startup: 1RKAMAXR.lnk = C:\WINDOWS\1rkamaxr.exe
O4 - Global Startup: FAKE5UZH.lnk = C:\WINDOWS\fake5uzh.exe
O4 - Global Startup: 28Q6GCAJ.lnk = C:\WINDOWS\28q6gcaj.exe
O4 - Global Startup: J0L2LBE0.lnk = C:\WINDOWS\j0l2lbe0.exe
O4 - Global Startup: 1UWVP4JY.lnk = C:\WINDOWS\1uwvp4jy.exe
O4 - Global Startup: YVIU15H3.lnk = C:\WINDOWS\yviu15h3.exe
O4 - Global Startup: 5Q9AGHFI.lnk = C:\WINDOWS\5q9aghfi.exe
O4 - Global Startup: OPJMF9IZ.lnk = C:\WINDOWS\opjmf9iz.exe
O4 - Global Startup: QE3VQ5V3.lnk = C:\WINDOWS\qe3vq5v3.exe
O4 - Global Startup: 3N6GZQJB.lnk = C:\WINDOWS\3n6gzqjb.exe
O4 - Global Startup: YP3H97H9.lnk = C:\WINDOWS\yp3h97h9.exe
O4 - Global Startup: URPX0M4F.lnk = C:\WINDOWS\urpx0m4f.exe
O4 - Global Startup: 1K175MJ0.lnk = C:\WINDOWS\1k175mj0.exe
O4 - Global Startup: NFL8JDPW.lnk = C:\WINDOWS\nfl8jdpw.exe
O4 - Global Startup: XT07Q8AM.lnk = C:\WINDOWS\xt07q8am.exe
O4 - Global Startup: O5CTUDYD.lnk = C:\WINDOWS\o5ctudyd.exe
O4 - Global Startup: 8PNKFXEX.lnk = C:\WINDOWS\8pnkfxex.exe
O4 - Global Startup: 500O0VWF.lnk = C:\WINDOWS\500o0vwf.exe
O4 - Global Startup: 5VREDHZ3.lnk = C:\WINDOWS\5vredhz3.exe
O4 - Global Startup: XDPPTBYK.lnk = C:\WINDOWS\xdpptbyk.exe
O4 - Global Startup: WVFRZ5DB.lnk = C:\WINDOWS\wvfrz5db.exe
O4 - Global Startup: 24M9VE36.lnk = C:\WINDOWS\24m9ve36.exe
O4 - Global Startup: DOXICOX1.lnk = C:\WINDOWS\doxicox1.exe
O4 - Global Startup: R7A21068.lnk = C:\WINDOWS\r7a21068.exe
O4 - Global Startup: JU2GUTKB.lnk = C:\WINDOWS\ju2gutkb.exe
O4 - Global Startup: 9JXPQBJ1.lnk = C:\WINDOWS\9jxpqbj1.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~5\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)
O9 - Extra 'Tools' menuitem: AV Home (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...B?1073623371260
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
  • 0

#4
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP