Spyware / Malware / Virus Removal

[Resolved] popup window

11 min read

Looking for the outcome? Ask AI

sosotiit Topic Starter

Post #1February 16, 2009, 1:10 AM UTC last edited February 16, 2009, 1:11 AM UTC

One of our pc has windows popping up (party poker…) ,

I have run my usual suite of stuff on it
-Symantec anti-virus
-Adaware (free version)
-Spybot (free version
-Avg (free version)
-trojan Hunter

and the problem is still there

two lines in msconfig - startup surprised me
[Itch ford four knob] C:\Documents and Settings\All Users\Application Data\third lies itch ford\bone one.exe
[toolplatform] C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits\UpOnce.exe

some of this seems to be related to lop according to what I have read, what is the best way to remove this problem

Note: if it can help, it a 12 year old kid, she is exploring the web . mostly game site

HJT below
TIA, soso

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:43:45, on 15-02-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data\third lies itch ford\bone one.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [toolplatform] C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits\UpOnce.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Shortcut to speedfan.exe.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2108E348-A0C0-1563-D327-730450CF5E34} (CPlayFirstDDComcastControl Object) - http://www.shockwave.com/content/dinerdash…st.1.0.0.39.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1233428773312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1204771691765
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.shockwave.com/content/burgersho…esPlayer_v5.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.32.21/ttinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

–
End of file - 13542 bytes

CatByte

Post #2February 16, 2009, 1:46 AM UTC

Hello and welcome to

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your HJT log now, I will post back shortly with instructions.

sosotiit

Post #3February 16, 2009, 2:47 AM UTC last edited February 16, 2009, 2:48 AM UTC

thanks Catbyte, looking fwd to work this with you.

I was not to familiar with Hijackthis, so I had not looked at the log to much. Now that I give a llok at it, another point of concern on top of the two I mentionned above is the presence of

O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.32.21/ttinst.cab

In the past, she had gone on that site and I had problems that time as well.

thks, soso

CatByte

Post #4February 16, 2009, 3:34 AM UTC

Hello sosotiit

I see you have two antivirus programs installed. Having two anti-virus programs can cause instability in your computer as they may conflict with one another, ultimately providing less protection - not more. I strongly suggest you uninstall one of the anti-virus programs. If you have paid for the Symantec Antivirus and you have a while left on your subscription, then keep that program, if your subscription has, or is about to expire, then uninstall it and keep AVG as it is very important to be able to update to the latest virus definitions.

NEXT

Disable resident protections (Antivirus / security programs) - you'll re-enable them after the scan

Download Lop S&D >>here<<

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

NEXT

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

In your next reply I need

Lop S&D log
DDS logs

Also please describe how your computer is behaving at the moment, listing any symptoms and problems that you are experiencing.

sosotiit

Post #5February 16, 2009, 8:51 PM UTC

Behavior is normal , except the windows popping up.

Not sure if I should post these or attach them? so I will go with the post, sorry if that was not the good aproach

*********************** lopR.txt *******************

——————–\\ Lop S&D; 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron™ Processor 3400+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Gabrielle ( Administrator )
BOOT : Normal boot
Antivirus : Symantec AntiVirus Corporate Edition 10.1.5.5001 (Not Activated)
Firewall : Symantec Client Firewall 8.7.4.101 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:106 Go (Free:41 Go)
D:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 16-02-09|15:26 )

——————–\\ Listing folders in APPLIC~1

[12-10-08|09:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[25-12-08|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[09-03-06|17:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Acronis
[09-03-06|17:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[25-12-08|08:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[25-12-08|08:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[04-02-09|16:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
[12-03-08|16:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BigFishGamesCache
[17-12-08|17:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Brother
[14-02-09|09:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fugazo
[06-09-08|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GoBit Games
[15-09-06|15:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[02-07-07|16:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[21-10-07|16:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
[24-01-08|19:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar2
[12-10-08|09:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[09-03-06|18:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[12-10-08|09:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[05-11-08|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Musicnotes
[11-10-08|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
[27-08-06|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Realshowpilegrid
[17-06-06|09:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
[24-09-07|18:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sibelius Software
[10-10-08|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiComponents
[06-03-08|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[09-02-07|09:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[15-02-09|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[12-02-09|21:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\third lies itch ford
[17-06-06|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
[13-02-08|17:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Valusoft
[08-03-06|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[24-02-08|12:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[17-06-06|09:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[08-03-06|21:59] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[09-10-08|16:34] C:\DOCUME~1\GABRIE~1\APPLIC~1\Adobe
[22-10-07|17:42] C:\DOCUME~1\GABRIE~1\APPLIC~1\AdobeUM
[01-09-08|15:50] C:\DOCUME~1\GABRIE~1\APPLIC~1\Apple Computer
[20-10-07|12:49] C:\DOCUME~1\GABRIE~1\APPLIC~1\Big Fish Games
[27-08-06|12:10] C:\DOCUME~1\GABRIE~1\APPLIC~1\BinSectFile
[22-04-06|12:06] C:\DOCUME~1\GABRIE~1\APPLIC~1\Corel
[12-03-08|16:34] C:\DOCUME~1\GABRIE~1\APPLIC~1\Gamelab
[16-10-06|17:43] C:\DOCUME~1\GABRIE~1\APPLIC~1\Google
[03-07-07|09:14] C:\DOCUME~1\GABRIE~1\APPLIC~1\Grisoft
[04-01-09|12:51] C:\DOCUME~1\GABRIE~1\APPLIC~1\gtk-2.0
[01-03-07|20:38] C:\DOCUME~1\GABRIE~1\APPLIC~1\Help
[10-08-06|08:55] C:\DOCUME~1\GABRIE~1\APPLIC~1\Hulabee
[17-06-06|09:44] C:\DOCUME~1\GABRIE~1\APPLIC~1\Identities
[09-03-06|17:40] C:\DOCUME~1\GABRIE~1\APPLIC~1\InterVideo
[06-03-08|19:23] C:\DOCUME~1\GABRIE~1\APPLIC~1\Lavasoft
[10-03-06|16:12] C:\DOCUME~1\GABRIE~1\APPLIC~1\Macromedia
[12-02-09|21:10] C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits
[03-08-07|10:39] C:\DOCUME~1\GABRIE~1\APPLIC~1\Microsoft
[14-02-09|10:57] C:\DOCUME~1\GABRIE~1\APPLIC~1\PC Tools
[11-10-08|15:44] C:\DOCUME~1\GABRIE~1\APPLIC~1\PlayFirst
[09-06-07|18:27] C:\DOCUME~1\GABRIE~1\APPLIC~1\Screenshot Sender
[24-09-07|18:34] C:\DOCUME~1\GABRIE~1\APPLIC~1\Sibelius Software
[11-10-07|19:24] C:\DOCUME~1\GABRIE~1\APPLIC~1\Sun
[06-12-06|17:06] C:\DOCUME~1\GABRIE~1\APPLIC~1\Symantec
[12-10-08|16:29] C:\DOCUME~1\GABRIE~1\APPLIC~1\TrojanHunter
[06-10-08|19:37] C:\DOCUME~1\GABRIE~1\APPLIC~1\U3
[13-02-08|17:25] C:\DOCUME~1\GABRIE~1\APPLIC~1\Valusoft
[19-07-06|13:22] C:\DOCUME~1\GABRIE~1\APPLIC~1\Webroot
[17-06-06|09:44] C:\DOCUME~1\GABRIE~1\APPLIC~1\Zylom

[12-10-08|09:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[07-12-06|18:53] C:\DOCUME~1\LOCALS~1\APPLIC~1\Symantec
[09-03-06|17:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot

[12-10-08|09:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[08-05-06|12:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[15-02-09 20:00][–ah—–] C:\WINDOWS\tasks\B6E8DF139187473B.job
[05-02-09 20:33][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[16-02-09 15:23][–ah—–] C:\WINDOWS\tasks\SA.DAT
[23-08-01 07:00][-r-h—–] C:\WINDOWS\tasks\desktop.ini

( B6E8DF139187473B.job )=( c:\docume~1\gabrie~1\applic~1\mfcdbits\ListInternetBold.exe )

——————–\\ Listing Folders in C:\Program Files

[12-10-08|12:44] C:\Program Files\3D Flying Easter Eggs Screen Saver 2.4
[09-03-06|17:25] C:\Program Files\Acronis
[09-03-06|17:33] C:\Program Files\Adobe
[01-05-08|19:24] C:\Program Files\Alice Greenfingers
[08-03-06|23:28] C:\Program Files\AMD
[25-12-08|08:20] C:\Program Files\Apple Software Update
[12-10-08|09:45] C:\Program Files\AVG
[14-09-07|18:32] C:\Program Files\AvRack
[14-02-09|13:04] C:\Program Files\Azada
[31-07-08|12:18] C:\Program Files\Barbie
[30-06-07|15:03] C:\Program Files\Barbie® Aventures questres
[31-01-09|14:51] C:\Program Files\Barbie™
[01-05-07|15:23] C:\Program Files\Belle`s Beauty Boutique
[01-05-07|15:07] C:\Program Files\BFG
[14-02-09|09:07] C:\Program Files\bfgclient
[22-01-09|20:35] C:\Program Files\Bonjour
[14-02-09|13:04] C:\Program Files\Buildalot
[26-11-08|17:57] C:\Program Files\Chocolatier 2
[12-02-09|21:09] C:\Program Files\Circle Dvelopement
[31-01-09|14:51] C:\Program Files\Common Files
[08-03-06|21:56] C:\Program Files\ComPlus Applications
[26-04-08|18:32] C:\Program Files\Cooking Academy
[15-02-09|08:54] C:\Program Files\Cooking Academy 2 - World Cuisine
[22-04-06|12:03] C:\Program Files\Corel
[22-04-06|12:05] C:\Program Files\Corel® Painter™ IX.5 TBYB EN
[09-03-06|17:34] C:\Program Files\Creative
[22-05-07|09:25] C:\Program Files\DAEMON Tools
[12-04-08|20:29] C:\Program Files\Diner Dash
[12-04-08|18:03] C:\Program Files\Disney
[22-04-06|11:53] C:\Program Files\Druide
[01-09-08|16:04] C:\Program Files\EA GAMES
[01-02-08|09:12] C:\Program Files\Electronic Arts
[15-03-08|12:16] C:\Program Files\EVEREST.Ultimate.Edition.2005.v2.20.405.Incl.Keygen-SSG
[09-03-06|16:55] C:\Program Files\ewido
[13-01-08|18:31] C:\Program Files\GIMP-2.0
[17-01-09|16:24] C:\Program Files\Google
[23-10-07|16:39] C:\Program Files\Hamsterball
[12-04-08|11:09] C:\Program Files\Hot Dish
[26-12-07|12:59] C:\Program Files\IJsfontein
[01-08-08|11:15] C:\Program Files\InstallShield Installation Information
[09-03-06|17:34] C:\Program Files\InterActual
[31-01-09|14:34] C:\Program Files\Internet Explorer
[09-03-06|17:34] C:\Program Files\InterVideo
[25-12-08|08:23] C:\Program Files\iPod
[25-12-08|08:24] C:\Program Files\iTunes
[12-02-09|21:14] C:\Program Files\Java
[01-04-06|08:45] C:\Program Files\JavaSoft
[09-03-06|17:22] C:\Program Files\jv16 PowerTools 2005
[22-03-06|10:39] C:\Program Files\Karasoft
[21-10-08|17:16] C:\Program Files\Kitty Luv
[23-01-08|20:56] C:\Program Files\Kiwee Toolbar2
[15-03-08|12:14] C:\Program Files\Lavalys
[12-10-08|09:23] C:\Program Files\Lavasoft
[09-03-06|12:22] C:\Program Files\Logitech
[03-09-08|17:32] C:\Program Files\Messenger
[12-02-09|21:09] C:\Program Files\Messenger Plus! Live
[27-08-06|13:36] C:\Program Files\MessengerPlus! 3
[12-02-09|21:09] C:\Program Files\mfcdbits
[06-03-08|19:04] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[08-03-06|21:59] C:\Program Files\microsoft frontpage
[22-03-06|08:46] C:\Program Files\Microsoft Office
[12-11-08|15:54] C:\Program Files\Microsoft Silverlight
[22-03-06|08:44] C:\Program Files\Microsoft.NET
[25-01-07|17:02] C:\Program Files\Mindscape
[12-03-08|16:34] C:\Program Files\Miss Management
[09-05-08|19:25] C:\Program Files\Movie Maker
[09-02-07|11:33] C:\Program Files\MSBuild
[09-03-06|13:03] C:\Program Files\MSN
[17-06-06|10:19] C:\Program Files\MSN Games
[08-03-06|21:55] C:\Program Files\MSN Gaming Zone
[03-08-07|20:19] C:\Program Files\MSXML 6.0
[09-12-06|11:05] C:\Program Files\Mystery Case Files - Prime Suspects
[09-05-08|19:21] C:\Program Files\NetMeeting
[12-10-08|17:00] C:\Program Files\Norton Security Scan
[10-08-06|09:18] C:\Program Files\Oberon Media
[04-08-07|16:38] C:\Program Files\Off Road Arena
[22-03-06|10:33] C:\Program Files\OfficeUpdate11
[08-03-06|21:57] C:\Program Files\Online Services
[09-05-08|19:21] C:\Program Files\Outlook Express
[13-01-07|14:48] C:\Program Files\Pixel Chix Desktop
[25-09-08|16:06] C:\Program Files\Puppy Luv
[25-12-08|08:22] C:\Program Files\QuickTime
[14-09-07|18:32] C:\Program Files\Realtek AC97
[08-03-06|23:05] C:\Program Files\Realtek Sound Manager
[09-02-07|11:30] C:\Program Files\Reference Assemblies
[01-07-07|09:43] C:\Program Files\ReflexiveArcade
[09-03-06|20:13] C:\Program Files\Rockstar Games
[16-07-08|18:43] C:\Program Files\Roller Rush
[08-07-07|13:00] C:\Program Files\Saints & Sinners Bowling
[01-08-08|11:15] C:\Program Files\Samsung
[18-05-06|08:33] C:\Program Files\ScreenSaver-Samantha
[27-03-08|16:03] C:\Program Files\Seagrand
[24-09-07|18:27] C:\Program Files\Sibelius Software
[15-04-06|11:21] C:\Program Files\Sims2Pack Clean Installer
[14-02-09|13:04] C:\Program Files\Snapshot Adventures
[16-02-09|15:24] C:\Program Files\SpeedFan
[14-02-09|09:57] C:\Program Files\Spybot - Search & Destroy
[14-02-09|11:01] C:\Program Files\Spyware Doctor
[31-07-08|09:09] C:\Program Files\Sun
[22-12-07|18:19] C:\Program Files\Super-Sokoban
[09-03-06|18:39] C:\Program Files\Superstar Chefs
[09-02-07|09:48] C:\Program Files\Symantec
[09-02-07|09:33] C:\Program Files\Symantec Client Security
[15-02-09|19:43] C:\Program Files\Trend Micro
[19-07-06|13:31] C:\Program Files\TrojanHunter 4.5
[10-01-09|12:43] C:\Program Files\Truffle Tray
[08-03-06|22:07] C:\Program Files\Uninstall Information
[08-03-06|23:45] C:\Program Files\VIA
[21-02-08|16:28] C:\Program Files\Virtools
[14-02-09|21:50] C:\Program Files\Webroot
[14-02-09|13:04] C:\Program Files\Wedding Dash
[24-02-08|12:03] C:\Program Files\Windows Live
[10-12-06|13:59] C:\Program Files\Windows Media Connect 2
[09-05-08|19:21] C:\Program Files\Windows Media Player
[09-05-08|19:21] C:\Program Files\Windows NT
[08-03-06|21:57] C:\Program Files\WindowsUpdate
[01-03-07|20:38] C:\Program Files\WinRAR
[08-03-06|21:59] C:\Program Files\xerox
[12-02-07|13:42] C:\Program Files\X-Projects
[10-10-08|10:43] C:\Program Files\YouTUBE ™ movie downloader
[10-10-08|10:35] C:\Program Files\YouTube Downloader
[17-06-06|10:18] C:\Program Files\Zylom Games

——————–\\ Listing Folders in C:\Program Files\Common Files

[09-03-06|17:25] C:\Program Files\Common Files\Acronis
[09-03-06|20:34] C:\Program Files\Common Files\Adobe
[25-12-08|08:23] C:\Program Files\Common Files\Apple
[25-09-08|16:18] C:\Program Files\Common Files\Barbie
[22-03-06|08:48] C:\Program Files\Common Files\DESIGNER
[10-10-08|10:53] C:\Program Files\Common Files\DVDVideoSoft
[08-03-06|23:16] C:\Program Files\Common Files\InstallShield
[09-03-06|17:35] C:\Program Files\Common Files\InterVideo
[11-10-07|19:23] C:\Program Files\Common Files\Java
[31-01-09|14:51] C:\Program Files\Common Files\Knowledge Adventure
[09-03-06|12:22] C:\Program Files\Common Files\Logitech
[12-10-08|09:45] C:\Program Files\Common Files\Microsoft Shared
[08-03-06|21:57] C:\Program Files\Common Files\MSSoap
[10-08-06|08:54] C:\Program Files\Common Files\Oberon Media
[08-03-06|16:40] C:\Program Files\Common Files\ODBC
[08-03-06|21:57] C:\Program Files\Common Files\Services
[08-03-06|16:40] C:\Program Files\Common Files\SpeechEngines
[28-02-08|16:56] C:\Program Files\Common Files\SWF Studio
[14-02-09|11:05] C:\Program Files\Common Files\Symantec Shared
[09-05-08|19:21] C:\Program Files\Common Files\System
[28-12-06|12:39] C:\Program Files\Common Files\Vivendi Universal Games
[09-03-06|16:49] C:\Program Files\Common Files\Webroot Shared
[24-02-08|12:04] C:\Program Files\Common Files\WindowsLiveInstaller
[12-10-08|09:22] C:\Program Files\Common Files\Wise Installation Wizard

——————–\\ Process

( 67 Processes )

IEXPLORE.EXE ~ [PID:2252]
IEXPLORE.EXE ~ [PID:2580]

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

C:\DOCUME~1\ALLUSE~1\APPLIC~1\third lies itch ford
C:\DOCUME~1\ALLUSE~1\APPLIC~1\third lies itch ford\bone one.dat
C:\DOCUME~1\ALLUSE~1\APPLIC~1\third lies itch ford\bone one.exe
C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits
C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits\dhxiagpn.exe
C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits\List Internet Bold.exe
C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits\ThatMixDentAtom.exe
C:\DOCUME~1\GABRIE~1\APPLIC~1\mfcdbits\UpOnce.exe
C:\Program Files\mfcdbits
C:\DOCUME~1\GABRIE~1\LOCALS~1\Temp\msgpl_1c22.tmp
C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@partypoker[1].txt
C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@partypoker[2].txt
C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@32vegas[2].txt
C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@banner.32vegas[2].txt
C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@www.32vegas[1].txt
C:\WINDOWS\Tasks\B6E8DF139187473B.job

——————–\\ Searching within the Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"toolplatform"="C:\\DOCUME~1\\GABRIE~1\\APPLIC~1\\mfcdbits\\UpOnce.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Itch ford four knob"="C:\\Documents and Settings\\All Users\\Application Data\\third lies itch ford\\bone one.exe"

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-16 15:27:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
C:\DOCUME~1\GABRIE~1\LOCALS~1\APPLIC~1\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : [removed] 1087 bytes hidden from API
scan completed successfully
hidden processes: 0
hidden files: 6

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\N\Neil Diamond - Cracklin Rose.kar
C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\Programme et backup\Karawin 1.9.0 - Full Version\KaraWin 1.9.0 - Full Version\keygen.exe
C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\Z\Zap\Cracklin' Rose (Neil Diamond).kar

[F:28][D:54]-> C:\DOCUME~1\GABRIE~1\LOCALS~1\Temp
[F:668][D:0]-> C:\DOCUME~1\GABRIE~1\Cookies
[F:17423][D:36]-> C:\DOCUME~1\GABRIE~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 16-02-09|14:52 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 16-02-09|15:31 - Option : [1]

——————–\\ Scan completed at 15:31:38

*****************************************************

*********************** Attach.txt *******************

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-02-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 08-03-06 22:01:28
System Uptime: 16-02-09 15:22:02 (0 hours ago)

Motherboard: | | K8M800-M2
Processor: AMD Sempron™ Processor 3400+ | Socket 940 | 999/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 107 GiB total, 41,961 GiB free.
D: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP646: 17-11-08 18:25:55 - System Checkpoint
RP647: 18-11-08 18:43:26 - System Checkpoint
RP648: 19-11-08 18:52:18 - System Checkpoint
RP649: 20-11-08 21:22:25 - System Checkpoint
RP650: 21-11-08 22:10:58 - System Checkpoint
RP651: 23-11-08 19:17:17 - System Checkpoint
RP652: 25-11-08 18:44:17 - System Checkpoint
RP653: 26-11-08 20:53:47 - System Checkpoint
RP654: 27-11-08 08:51:32 - Avg8 Update
RP655: 28-11-08 18:16:18 - System Checkpoint
RP656: 29-11-08 19:14:59 - System Checkpoint
RP657: 01-12-08 21:16:37 - System Checkpoint
RP658: 03-12-08 18:19:21 - System Checkpoint
RP659: 04-12-08 18:24:20 - System Checkpoint
RP660: 05-12-08 19:14:53 - System Checkpoint
RP661: 07-12-08 17:50:15 - System Checkpoint
RP662: 08-12-08 20:06:47 - System Checkpoint
RP663: 09-12-08 20:52:05 - System Checkpoint
RP664: 12-12-08 16:06:52 - Avg8 Update
RP665: 14-12-08 18:37:34 - System Checkpoint
RP666: 15-12-08 21:21:54 - System Checkpoint
RP667: 17-12-08 18:14:41 - System Checkpoint
RP668: 18-12-08 19:09:09 - System Checkpoint
RP669: 19-12-08 19:48:56 - System Checkpoint
RP670: 21-12-08 14:33:23 - System Checkpoint
RP671: 22-12-08 20:08:16 - System Checkpoint
RP672: 23-12-08 12:24:54 - Shockwave Player
RP673: 24-12-08 17:22:58 - System Checkpoint
RP674: 25-12-08 08:23:09 - Installé iTunes
RP675: 26-12-08 15:10:25 - System Checkpoint
RP676: 27-12-08 19:26:29 - System Checkpoint
RP677: 29-12-08 13:30:37 - System Checkpoint
RP678: 30-12-08 17:47:01 - System Checkpoint
RP679: 01-01-09 16:51:35 - System Checkpoint
RP680: 02-01-09 17:05:52 - System Checkpoint
RP681: 03-01-09 17:52:32 - System Checkpoint
RP682: 04-01-09 20:06:07 - System Checkpoint
RP683: 06-01-09 17:33:55 - System Checkpoint
RP684: 07-01-09 17:54:32 - System Checkpoint
RP685: 08-01-09 18:20:21 - System Checkpoint
RP686: 09-01-09 18:41:42 - System Checkpoint
RP687: 10-01-09 19:20:55 - System Checkpoint
RP688: 12-01-09 16:24:44 - System Checkpoint
RP689: 14-01-09 17:51:35 - System Checkpoint
RP690: 15-01-09 18:07:36 - System Checkpoint
RP691: 16-01-09 21:32:45 - System Checkpoint
RP692: 18-01-09 19:51:53 - System Checkpoint
RP693: 21-01-09 17:54:50 - System Checkpoint
RP694: 22-01-09 18:02:27 - System Checkpoint
RP695: 23-01-09 18:28:52 - System Checkpoint
RP696: 25-01-09 12:59:45 - System Checkpoint
RP697: 26-01-09 17:14:22 - System Checkpoint
RP698: 27-01-09 20:52:21 - System Checkpoint
RP699: 29-01-09 18:15:18 - System Checkpoint
RP700: 30-01-09 18:32:05 - System Checkpoint
RP701: 31-01-09 14:14:49 - Software Distribution Service 3.0
RP702: 01-02-09 18:46:42 - System Checkpoint
RP703: 02-02-09 19:26:57 - System Checkpoint
RP704: 03-02-09 16:23:17 - Avg8 Update
RP705: 04-02-09 16:03:15 - Avg8 Update
RP706: 04-02-09 16:07:05 - Avg8 Update
RP707: 07-02-09 13:40:03 - System Checkpoint
RP708: 08-02-09 13:57:39 - System Checkpoint
RP709: 09-02-09 18:21:41 - System Checkpoint
RP710: 10-02-09 16:10:44 - Avg8 Update
RP711: 12-02-09 16:36:15 - Avg8 Update
RP712: 12-02-09 21:14:25 - Installé Java™ 6 Update 11
RP713: 14-02-09 15:05:03 - System Checkpoint
RP714: 14-02-09 21:14:12 - System Checkpoint
RP715: 14-02-09 21:26:23 - 14 fev 09

==== Installed Programs ======================

3D Flying Easter Eggs Saver 2.4
Acronis True Image
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Reader 6.0.1
Adobe Shockwave Player 11
Alice Greenfingers
Antidote
Apple Mobile Device Support
Apple Software Update
Athlon 64 Processor Driver
AVG Free 8.0
Azada
Barbie Salon de Beauté
Barbie® Aventures Équestres
Barbie™ Agent Secret
Barbie™ dans Coeur de Princesse
Barbie™ Princesse Raiponce
Belle`s Beauty Boutique (remove only)
Big Fish Games Client
Bonjour
Buildalot
C-Media WDM Audio Driver
Cake Mania
Carmen Sandiego V.2
CEP - Color Enable Package
Chocolatier 2
Cooking Academy 1.0
Cooking Academy 2: World Cuisine
Corel Painter IX
Creative DVD Audio Plugin for Audigy Series
Digimax Master
Diner Dash
Disney's Toontown Online
eMedia Je joue de la Guitare 2
EVEREST Ultimate Edition v4.50
Free YouTube Download 1.2
GIMP 2.4.2
Google Earth
Google Earth Pro
Google Toolbar for Internet Explorer
Grand Theft Auto Vice City
GTA San Andreas
hairspray_screensaver
Hamsterball
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Icy Tower v1.3.1
InterActual Player
InterVideo WinDVD 6
iTunes
Java Runtime Environment 1.1
Java™ 6 Update 11
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
jv16 PowerTools 2005
KaraWin
Kitty Luv
Les Secrets de la Pyramide
Les Sims 2
Les Sims 2 : Nuits de Folie
Les Sims 2 Fun en Famille Kit
Les Sims™ 2 Animaux & Cie
Les Sims™ 2 H&M;® Fashion Kit
Les Sims™ 2 IKEA® Home Design Kit
Les Sims™ 2 Jour de fête ! Kit
Les Sims™ 2 Kit design Cuisine et Salle de bain
Les Sims™ 2 Kit Glamour
Les Sims™ 2 La Vie en Appartement
Les Sims™ 2 Quartier Libre
Les Sims™ 2 Tout pour les ados Kit
Les Sims™ Histoires d'animaux
Les Sims™ Histoires de naufragés
Les Sims™ Histoires de vie
Les Sims™ 2 Au fil des saisons
Les Sims™ 2 Bon Voyage
LiveUpdate 3.1 (Symantec Corporation)
Logiciel QuickCam de Logitech
Logitech iTouch Software
Mahjong Jr.
Mer des Tropiques 3D
Messenger Plus! 3
Messenger Plus! Live & Sponsor (CiD)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Miss Management
MSN
MSXML 6.0 Parser (KB933579)
Mystery Case Files - Prime Suspects (remove only)
Norton Security Scan
NVIDIA Drivers
Off Road Arena
OpenOffice.org Installer 1.0
Pixel Chix Desktop 1.0
Pixia 3.3b
Platform
Powerpuff Girls - Fast and Flurrious
Programme de gestion Camera de Logitech®
Puppy Luv
QuickTime
Realtek AC'97 Audio
Roller Rush
Saint-Valentin
Saints & Sinners Bowling
Samsung USB Driver
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Sibelius 5
Sibelius Demo
Sims2Pack Clean Installer
Snapshot Adventures
SpeedFan (remove only)
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
Spyware Doctor 6.0
StuffPlug-NG (Messenger Plus! Plugins)
Super-Sokoban
Superstar Chefs
Symantec Client Security
The Simpsons Movie Screen Saver
The Sims 2 University
Tonka Search and Rescue
TrojanHunter 4.5
Truffle Tray
Uninstall 1.0.0.0
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
VIA Le gestionnaire du dispositif de plate-forme
VIA Rhine-Family Fast Ethernet Adapter
Virtools 3D Life Player
WebFldrs XP
Wedding Dash
Window Washer 5
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Presentation Foundation
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows XP Service Pack 3
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
Xtreme Boot Maker
YouTUBE ™ movie downloader

==== Event Viewer Messages From Past Week ========

12-02-09 16:40:08, error: Service Control Manager [7000] - The LiveUpdate service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12-02-09 16:40:07, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the LiveUpdate service to connect.
12-02-09 16:40:04, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service LiveUpdate with arguments "" in order to run the server: {03E0E6C2-363B-11D3-B536-00902771A435}
14-02-09 11:03:04, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s).
14-02-09 15:27:02, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000009A' while processing the file 'TMP44.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
14-02-09 15:59:39, error: DCOM [10005] - DCOM got error "%1450" attempting to start the service gusvc with arguments "" in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8}
14-02-09 21:13:23, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000009A' while processing the file 'SNDSYS.log' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
14-02-09 21:14:12, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000009A' while processing the file '82564326-8 .. 26EC75.sfs' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
14-02-09 21:50:31, error: Service Control Manager [7034] - The Webroot Spy Sweeper Engine service terminated unexpectedly. It has done this 1 time(s).
16-02-09 14:55:28, error: Service Control Manager [7016] - The BrSplService service has reported an invalid current state 0.

==== End Of File ===========================

*****************************************************

*********************** DDS.txt *******************

DDS (Ver_09-02-01.01) - NTFSx86
Run by [removed] at 15:38:50,75 on 16-02-09
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1252.2.1033.18.1023.280 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
FW: Symantec Client Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Gabrielle\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://fr.youtube.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.google.com/ie
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google; Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot
uRun: [Gestionnaire Antidote.exe] c:\progra~1\druide\antidote\antidote\Gestionnaire Antidote.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [toolplatform] c:\docume~1\gabrie~1\applic~1\mfcdbits\UpOnce.exe
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe
mRun: [zBrowser Launcher] c:\program files\logitech\itouch\iTouch.exe
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimage\TrueImageMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\symant~2\VPTray.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Itch ford four knob] c:\documents and settings\all users\application data\third lies itch ford\bone one.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\shortc~1.lnk - c:\program files\speedfan\speedfan.exe
IE: E&xporter; vers Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {2108E348-A0C0-1563-D327-730450CF5E34} - hxxp://www.shockwave.com/content/dinerdash/sis/DDComcast.1.0.0.39.cab
DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} - hxxp://musicmix.messenger.msn.com/Medialogic.CAB
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - hxxp://cdnimg.piczo.com/images/uploader/piczo_new_fast_uploader.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233428773312
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1204771691765
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} - hxxp://www.shockwave.com/content/burgershop/sis/EggoKitchen/GoBitGamesPlayer_v5.cab
DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} - hxxp://a.download.toontown.com/sv1.0.32.21/ttinst.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
Notify: WRNotifier - WRLogonNTF.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 relog_ap

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-12 325128]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-10-12 27656]
R1 SAVRT;SAVRT;c:\program files\symantec client security\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec client security\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2006-7-19 202400]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec client security\symantec antivirus\Rtvscan.exe [2006-10-24 1813184]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-5 99376]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090213.003\naveng.sys [2009-2-14 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090213.003\navex15.sys [2009-2-14 876112]
S3 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-4 298264]
S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-2-14 40840]
S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-2-14 66952]
S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-2-14 81288]
S3 SavRoam;SAVRoam;c:\program files\symantec client security\symantec antivirus\SavRoam.exe [2006-10-24 116416]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-2-14 356920]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-2-14 1079176]

=============== Created Last 30 ================

2009-02-16 14:44 –d—– C:\Lop SD
2009-02-15 19:43 –d—– c:\program files\Trend Micro
2009-02-14 10:58 81,288 a——- c:\windows\system32\drivers\iksyssec.sys
2009-02-14 10:58 66,952 a——- c:\windows\system32\drivers\iksysflt.sys
2009-02-14 10:58 40,840 a——- c:\windows\system32\drivers\ikfilesec.sys
2009-02-14 10:58 29,576 a——- c:\windows\system32\drivers\kcom.sys
2009-02-14 10:57 –d—– c:\program files\Spyware Doctor
2009-02-14 10:57 –d—– c:\docume~1\gabrie~1\applic~1\PC Tools
2009-02-14 09:09 –d—– c:\program files\Cooking Academy 2 - World Cuisine
2009-02-12 21:15 410,984 a——- c:\windows\system32\deploytk.dll
2009-02-12 21:10 –d—– c:\docume~1\alluse~1\applic~1\third lies itch ford
2009-02-12 21:09 –d—– c:\program files\mfcdbits
2009-02-12 21:09 –d—– c:\docume~1\gabrie~1\applic~1\mfcdbits
2009-02-12 21:09 –d—– c:\program files\Circle Dvelopement
2009-02-04 16:06 10,520 a——- c:\windows\system32\avgrsstx.dll
2009-01-31 14:52 1,409 a——- c:\windows\system32\tmp86661.FOT
2009-01-31 14:51 –d—– c:\program files\common files\Knowledge Adventure
2009-01-31 14:25 –d—– C:\a8ac8ae09a2e2333bc
2009-01-31 14:25 –d—– c:\windows\SxsCaPendDel
2009-01-31 14:07 23,576 a——- c:\windows\system32\wuapi.dll.mui
2009-01-22 20:35 –d—– c:\program files\Bonjour

==================== Find3M ====================

2009-02-04 17:22 1,682 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-02-04 16:06 325,128 a——- c:\windows\system32\drivers\avgldx86.sys
2008-12-12 11:18 87,336 a——- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a——- c:\windows\system32\dnssd.dll
2008-03-12 16:33 0 a——- c:\program files\temp01
2007-09-24 18:32 604 a—h— c:\program files\STLL Notifier
2006-04-22 12:06 88 —shr– c:\windows\system32\B07B2C4A82.sys
2008-05-09 19:40 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008050920080510\index.dat

============= FINISH: 15:39:25,62 ===============

*****************************************************

CatByte

Post #6February 17, 2009, 1:07 AM UTC

Hi sosotiit

Looks like the offending program may have been unknowingly installed when Messenger Plus was installed…it typically comes bundled with unwanted adware. It is for that reason I strongly recommend uninstalling it.

Before we fix with LOP S&D, first you need to do this:

Go to Start>Control Panel >Add/Remove Programs

A list of installed programs will populate.

Locate and choose REMOVE for the following programs. (if found)

Messenger Plus! Live & Sponsor

Messenger Plus! Live

Messenger Plus! 3

You will be given the choice of uninstalling the sponsor only or everything altogether.

Choose to uninstall everything.

NEXT

Restart Lop S&D

This time choose Option 3 (Fix - Hosts)
Don't close the window during suppression!

Post the log which is created: (%SystemDrive%\lopR.txt)

Also post a fresh HJT log and advise how your computer is running now.

sosotiit

Post #7February 17, 2009, 1:47 AM UTC last edited February 17, 2009, 1:55 AM UTC

All seems back to normal

, except a 12 year old who insist that life with Msg Live alone is not worthed.
I guess I am on my own for that one

1) should I remove the remaining cookie (highlighted in red below)?
2) can I remove the Toontown activeX installer? is that in the registry (highlighted in blue)?

Huge thks, soso

*************** LopR log**********************

——————–\\ Lop S&D; 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron™ Processor 3400+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Gabrielle ( Administrator )
BOOT : Normal boot
Antivirus : Symantec AntiVirus Corporate Edition 10.1.5.5001 (Activated)
Firewall : Symantec Client Firewall 8.7.4.101 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:106 Go (Free:41 Go)
D:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [3] ( 16-02-09|20:17 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ FIX

Deleted! - C:\DOCUME~1\GABRIE~1\LOCALS~1\Temp\msgpl_1c22.tmp
Deleted! - C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@partypoker[2].txt
Deleted! - C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@32vegas[2].txt
Deleted! - C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@banner.32vegas[2].txt
Deleted! - C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@www.32vegas[1].txt
Deleted! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\third lies itch ford

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

——————–\\ Listing folders in APPLIC~1

[12-10-08|09:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[25-12-08|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[09-03-06|17:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Acronis
[09-03-06|17:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[25-12-08|08:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[25-12-08|08:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[04-02-09|16:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
[12-03-08|16:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BigFishGamesCache
[17-12-08|17:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Brother
[14-02-09|09:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fugazo
[06-09-08|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GoBit Games
[15-09-06|15:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[02-07-07|16:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[21-10-07|16:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
[24-01-08|19:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kiwee Toolbar2
[12-10-08|09:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[16-02-09|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[12-10-08|09:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[05-11-08|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Musicnotes
[11-10-08|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
[27-08-06|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Realshowpilegrid
[17-06-06|09:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
[24-09-07|18:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sibelius Software
[10-10-08|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiComponents
[06-03-08|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[09-02-07|09:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[15-02-09|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[17-06-06|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
[13-02-08|17:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Valusoft
[08-03-06|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[24-02-08|12:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[17-06-06|09:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[08-03-06|21:59] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[09-10-08|16:34] C:\DOCUME~1\GABRIE~1\APPLIC~1\Adobe
[22-10-07|17:42] C:\DOCUME~1\GABRIE~1\APPLIC~1\AdobeUM
[01-09-08|15:50] C:\DOCUME~1\GABRIE~1\APPLIC~1\Apple Computer
[20-10-07|12:49] C:\DOCUME~1\GABRIE~1\APPLIC~1\Big Fish Games
[27-08-06|12:10] C:\DOCUME~1\GABRIE~1\APPLIC~1\BinSectFile
[22-04-06|12:06] C:\DOCUME~1\GABRIE~1\APPLIC~1\Corel
[12-03-08|16:34] C:\DOCUME~1\GABRIE~1\APPLIC~1\Gamelab
[16-10-06|17:43] C:\DOCUME~1\GABRIE~1\APPLIC~1\Google
[03-07-07|09:14] C:\DOCUME~1\GABRIE~1\APPLIC~1\Grisoft
[04-01-09|12:51] C:\DOCUME~1\GABRIE~1\APPLIC~1\gtk-2.0
[01-03-07|20:38] C:\DOCUME~1\GABRIE~1\APPLIC~1\Help
[10-08-06|08:55] C:\DOCUME~1\GABRIE~1\APPLIC~1\Hulabee
[17-06-06|09:44] C:\DOCUME~1\GABRIE~1\APPLIC~1\Identities
[09-03-06|17:40] C:\DOCUME~1\GABRIE~1\APPLIC~1\InterVideo
[06-03-08|19:23] C:\DOCUME~1\GABRIE~1\APPLIC~1\Lavasoft
[10-03-06|16:12] C:\DOCUME~1\GABRIE~1\APPLIC~1\Macromedia
[03-08-07|10:39] C:\DOCUME~1\GABRIE~1\APPLIC~1\Microsoft
[14-02-09|10:57] C:\DOCUME~1\GABRIE~1\APPLIC~1\PC Tools
[11-10-08|15:44] C:\DOCUME~1\GABRIE~1\APPLIC~1\PlayFirst
[09-06-07|18:27] C:\DOCUME~1\GABRIE~1\APPLIC~1\Screenshot Sender
[24-09-07|18:34] C:\DOCUME~1\GABRIE~1\APPLIC~1\Sibelius Software
[11-10-07|19:24] C:\DOCUME~1\GABRIE~1\APPLIC~1\Sun
[06-12-06|17:06] C:\DOCUME~1\GABRIE~1\APPLIC~1\Symantec
[12-10-08|16:29] C:\DOCUME~1\GABRIE~1\APPLIC~1\TrojanHunter
[06-10-08|19:37] C:\DOCUME~1\GABRIE~1\APPLIC~1\U3
[13-02-08|17:25] C:\DOCUME~1\GABRIE~1\APPLIC~1\Valusoft
[19-07-06|13:22] C:\DOCUME~1\GABRIE~1\APPLIC~1\Webroot
[17-06-06|09:44] C:\DOCUME~1\GABRIE~1\APPLIC~1\Zylom

[12-10-08|09:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[07-12-06|18:53] C:\DOCUME~1\LOCALS~1\APPLIC~1\Symantec
[09-03-06|17:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot

[12-10-08|09:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[08-05-06|12:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[05-02-09 20:33][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[16-02-09 16:24][–ah—–] C:\WINDOWS\tasks\SA.DAT
[23-08-01 07:00][-r-h—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[12-10-08|12:44] C:\Program Files\3D Flying Easter Eggs Screen Saver 2.4
[09-03-06|17:25] C:\Program Files\Acronis
[09-03-06|17:33] C:\Program Files\Adobe
[01-05-08|19:24] C:\Program Files\Alice Greenfingers
[08-03-06|23:28] C:\Program Files\AMD
[25-12-08|08:20] C:\Program Files\Apple Software Update
[12-10-08|09:45] C:\Program Files\AVG
[14-09-07|18:32] C:\Program Files\AvRack
[14-02-09|13:04] C:\Program Files\Azada
[31-07-08|12:18] C:\Program Files\Barbie
[30-06-07|15:03] C:\Program Files\Barbie® Aventures questres
[31-01-09|14:51] C:\Program Files\Barbie™
[01-05-07|15:23] C:\Program Files\Belle`s Beauty Boutique
[01-05-07|15:07] C:\Program Files\BFG
[14-02-09|09:07] C:\Program Files\bfgclient
[22-01-09|20:35] C:\Program Files\Bonjour
[14-02-09|13:04] C:\Program Files\Buildalot
[26-11-08|17:57] C:\Program Files\Chocolatier 2
[31-01-09|14:51] C:\Program Files\Common Files
[08-03-06|21:56] C:\Program Files\ComPlus Applications
[26-04-08|18:32] C:\Program Files\Cooking Academy
[15-02-09|08:54] C:\Program Files\Cooking Academy 2 - World Cuisine
[22-04-06|12:03] C:\Program Files\Corel
[22-04-06|12:05] C:\Program Files\Corel® Painter™ IX.5 TBYB EN
[09-03-06|17:34] C:\Program Files\Creative
[22-05-07|09:25] C:\Program Files\DAEMON Tools
[12-04-08|20:29] C:\Program Files\Diner Dash
[12-04-08|18:03] C:\Program Files\Disney
[22-04-06|11:53] C:\Program Files\Druide
[01-09-08|16:04] C:\Program Files\EA GAMES
[01-02-08|09:12] C:\Program Files\Electronic Arts
[15-03-08|12:16] C:\Program Files\EVEREST.Ultimate.Edition.2005.v2.20.405.Incl.Keygen-SSG
[09-03-06|16:55] C:\Program Files\ewido
[13-01-08|18:31] C:\Program Files\GIMP-2.0
[17-01-09|16:24] C:\Program Files\Google
[23-10-07|16:39] C:\Program Files\Hamsterball
[12-04-08|11:09] C:\Program Files\Hot Dish
[26-12-07|12:59] C:\Program Files\IJsfontein
[01-08-08|11:15] C:\Program Files\InstallShield Installation Information
[09-03-06|17:34] C:\Program Files\InterActual
[31-01-09|14:34] C:\Program Files\Internet Explorer
[09-03-06|17:34] C:\Program Files\InterVideo
[25-12-08|08:23] C:\Program Files\iPod
[25-12-08|08:24] C:\Program Files\iTunes
[12-02-09|21:14] C:\Program Files\Java
[01-04-06|08:45] C:\Program Files\JavaSoft
[09-03-06|17:22] C:\Program Files\jv16 PowerTools 2005
[22-03-06|10:39] C:\Program Files\Karasoft
[21-10-08|17:16] C:\Program Files\Kitty Luv
[23-01-08|20:56] C:\Program Files\Kiwee Toolbar2
[15-03-08|12:14] C:\Program Files\Lavalys
[12-10-08|09:23] C:\Program Files\Lavasoft
[09-03-06|12:22] C:\Program Files\Logitech
[03-09-08|17:32] C:\Program Files\Messenger
[16-02-09|20:16] C:\Program Files\Messenger Plus! Live
[27-08-06|13:36] C:\Program Files\MessengerPlus! 3
[06-03-08|19:04] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[08-03-06|21:59] C:\Program Files\microsoft frontpage
[22-03-06|08:46] C:\Program Files\Microsoft Office
[12-11-08|15:54] C:\Program Files\Microsoft Silverlight
[22-03-06|08:44] C:\Program Files\Microsoft.NET
[25-01-07|17:02] C:\Program Files\Mindscape
[12-03-08|16:34] C:\Program Files\Miss Management
[09-05-08|19:25] C:\Program Files\Movie Maker
[09-02-07|11:33] C:\Program Files\MSBuild
[09-03-06|13:03] C:\Program Files\MSN
[17-06-06|10:19] C:\Program Files\MSN Games
[08-03-06|21:55] C:\Program Files\MSN Gaming Zone
[03-08-07|20:19] C:\Program Files\MSXML 6.0
[09-12-06|11:05] C:\Program Files\Mystery Case Files - Prime Suspects
[09-05-08|19:21] C:\Program Files\NetMeeting
[12-10-08|17:00] C:\Program Files\Norton Security Scan
[10-08-06|09:18] C:\Program Files\Oberon Media
[04-08-07|16:38] C:\Program Files\Off Road Arena
[22-03-06|10:33] C:\Program Files\OfficeUpdate11
[08-03-06|21:57] C:\Program Files\Online Services
[09-05-08|19:21] C:\Program Files\Outlook Express
[13-01-07|14:48] C:\Program Files\Pixel Chix Desktop
[25-09-08|16:06] C:\Program Files\Puppy Luv
[25-12-08|08:22] C:\Program Files\QuickTime
[14-09-07|18:32] C:\Program Files\Realtek AC97
[08-03-06|23:05] C:\Program Files\Realtek Sound Manager
[09-02-07|11:30] C:\Program Files\Reference Assemblies
[01-07-07|09:43] C:\Program Files\ReflexiveArcade
[09-03-06|20:13] C:\Program Files\Rockstar Games
[16-07-08|18:43] C:\Program Files\Roller Rush
[08-07-07|13:00] C:\Program Files\Saints & Sinners Bowling
[01-08-08|11:15] C:\Program Files\Samsung
[18-05-06|08:33] C:\Program Files\ScreenSaver-Samantha
[27-03-08|16:03] C:\Program Files\Seagrand
[24-09-07|18:27] C:\Program Files\Sibelius Software
[15-04-06|11:21] C:\Program Files\Sims2Pack Clean Installer
[14-02-09|13:04] C:\Program Files\Snapshot Adventures
[16-02-09|16:25] C:\Program Files\SpeedFan
[14-02-09|09:57] C:\Program Files\Spybot - Search & Destroy
[14-02-09|11:01] C:\Program Files\Spyware Doctor
[31-07-08|09:09] C:\Program Files\Sun
[22-12-07|18:19] C:\Program Files\Super-Sokoban
[09-03-06|18:39] C:\Program Files\Superstar Chefs
[09-02-07|09:48] C:\Program Files\Symantec
[09-02-07|09:33] C:\Program Files\Symantec Client Security
[15-02-09|19:43] C:\Program Files\Trend Micro
[19-07-06|13:31] C:\Program Files\TrojanHunter 4.5
[10-01-09|12:43] C:\Program Files\Truffle Tray
[08-03-06|22:07] C:\Program Files\Uninstall Information
[08-03-06|23:45] C:\Program Files\VIA
[21-02-08|16:28] C:\Program Files\Virtools
[14-02-09|21:50] C:\Program Files\Webroot
[14-02-09|13:04] C:\Program Files\Wedding Dash
[24-02-08|12:03] C:\Program Files\Windows Live
[10-12-06|13:59] C:\Program Files\Windows Media Connect 2
[09-05-08|19:21] C:\Program Files\Windows Media Player
[09-05-08|19:21] C:\Program Files\Windows NT
[08-03-06|21:57] C:\Program Files\WindowsUpdate
[01-03-07|20:38] C:\Program Files\WinRAR
[08-03-06|21:59] C:\Program Files\xerox
[12-02-07|13:42] C:\Program Files\X-Projects
[10-10-08|10:43] C:\Program Files\YouTUBE ™ movie downloader
[10-10-08|10:35] C:\Program Files\YouTube Downloader
[17-06-06|10:18] C:\Program Files\Zylom Games

——————–\\ Listing Folders in C:\Program Files\Common Files

[09-03-06|17:25] C:\Program Files\Common Files\Acronis
[09-03-06|20:34] C:\Program Files\Common Files\Adobe
[25-12-08|08:23] C:\Program Files\Common Files\Apple
[25-09-08|16:18] C:\Program Files\Common Files\Barbie
[22-03-06|08:48] C:\Program Files\Common Files\DESIGNER
[10-10-08|10:53] C:\Program Files\Common Files\DVDVideoSoft
[08-03-06|23:16] C:\Program Files\Common Files\InstallShield
[09-03-06|17:35] C:\Program Files\Common Files\InterVideo
[11-10-07|19:23] C:\Program Files\Common Files\Java
[31-01-09|14:51] C:\Program Files\Common Files\Knowledge Adventure
[09-03-06|12:22] C:\Program Files\Common Files\Logitech
[12-10-08|09:45] C:\Program Files\Common Files\Microsoft Shared
[08-03-06|21:57] C:\Program Files\Common Files\MSSoap
[10-08-06|08:54] C:\Program Files\Common Files\Oberon Media
[08-03-06|16:40] C:\Program Files\Common Files\ODBC
[08-03-06|21:57] C:\Program Files\Common Files\Services
[08-03-06|16:40] C:\Program Files\Common Files\SpeechEngines
[28-02-08|16:56] C:\Program Files\Common Files\SWF Studio
[14-02-09|11:05] C:\Program Files\Common Files\Symantec Shared
[09-05-08|19:21] C:\Program Files\Common Files\System
[28-12-06|12:39] C:\Program Files\Common Files\Vivendi Universal Games
[09-03-06|16:49] C:\Program Files\Common Files\Webroot Shared
[24-02-08|12:04] C:\Program Files\Common Files\WindowsLiveInstaller
[12-10-08|09:22] C:\Program Files\Common Files\Wise Installation Wizard

——————–\\ Process

( 60 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

C:\DOCUME~1\GABRIE~1\Cookies\gabrielle@partypoker[3].txt

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-16 20:19:16
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …

C:\DOCUME~1\GABRIE~1\LOCALS~1\APPLIC~1\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les

Sims™ 2 : [removed] 1087 bytes hidden from API
scan completed successfully
hidden processes: 0
hidden files: 6

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\N\Neil Diamond - Cracklin Rose.kar
C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\Programme et backup\Karawin 1.9.0 - Full Version\KaraWin 1.9.0 - Full

Version\keygen.exe
C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\Z\Zap\Cracklin' Rose (Neil Diamond).kar

[F:41][D:53]-> C:\DOCUME~1\GABRIE~1\LOCALS~1\Temp
[F:667][D:0]-> C:\DOCUME~1\GABRIE~1\Cookies
[F:17965][D:36]-> C:\DOCUME~1\GABRIE~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 16-02-09|14:52 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 16-02-09|15:31 - Option : [1]
3 - "C:\Lop SD\LopR_3.txt" - 16-02-09|20:23 - Option : [3]

——————–\\ Scan completed at 20:23:36

***********************************************

*************** HjT log**********************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:33:47, on 16-02-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DoScan.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google; Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Shortcut to speedfan.exe.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: E&xporter; vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2108E348-A0C0-1563-D327-730450CF5E34} (CPlayFirstDDComcastControl Object) - http://www.shockwave.com/content/dinerdash…st.1.0.0.39.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1233428773312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1204771691765
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.shockwave.com/content/burgersho…esPlayer_v5.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.32.21/ttinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

–
End of file - 13264 bytes

***********************************************

CatByte

Post #8February 17, 2009, 2:56 AM UTC

Hi sosotiit

1) should I remove the remaining cookie (highlighted in red below)?
2) can I remove the Toontown activeX installer? is that in the registry (highlighted in blue)?

Please don't remove anything unless instructed

Please download the OTMoveIt3 by OldTimer.

Save it to your desktop.
Please click OTMoveIt3 and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[-HKEY_CLASSES_ROOT\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C02226EB-A5D7-4B1F-BD7E-635E46C2288D}]
[-HKEY_CLASSES_ROOT\CLSID\{C02226EB-A5D7-4B1F-BD7E-635E46C2288D}]

:Files
c:\program files\mfcdbits
c:\docume~1\gabrie~1\applic~1\mfcdbits
c:\program files\Circle Dvelopement
c:\windows\system32\tmp86661.FOT
C:\a8ac8ae09a2e2333bc
C:\Program Files\STLL Notifier
c:\program files\temp01
c:\windows\system32\B07B2C4A82.sys
C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\Programme et backup\Karawin 1.9.0 - Full Version\KaraWin 1.9.0 - Full Version\keygen.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot

Return to OTMoveIt3, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

In your next post I need

OTMI3 log
Fresh HJT log

Also advise how your computer is running now.

sosotiit

Post #9February 18, 2009, 1:02 AM UTC

Computer seems to be running fine

huge thks,
soso

*******************OTM log *********************************

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\\ deleted successfully.
Registry key HKEY_CLASSES_ROOT\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C02226EB-A5D7-4B1F-BD7E-635E46C2288D}\\ deleted successfully.
Registry key HKEY_CLASSES_ROOT\CLSID\{C02226EB-A5D7-4B1F-BD7E-635E46C2288D}\\ deleted successfully.
========== FILES ==========
File/Folder c:\program files\mfcdbits not found.
File/Folder c:\docume~1\gabrie~1\applic~1\mfcdbits not found.
File/Folder c:\program files\Circle Dvelopement not found.
c:\windows\system32\tmp86661.FOT moved successfully.
C:\a8ac8ae09a2e2333bc\i386 moved successfully.
C:\a8ac8ae09a2e2333bc\amd64 moved successfully.
C:\a8ac8ae09a2e2333bc moved successfully.
C:\Program Files\STLL Notifier moved successfully.
c:\program files\temp01 moved successfully.
c:\windows\system32\B07B2C4A82.sys moved successfully.
C:\DOCUME~1\ALLUSE~1\Documents\Karaoke\Programme et backup\Karawin 1.9.0 - Full Version\KaraWin 1.9.0 - Full Version\keygen.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\GABRIE~1\LOCALS~1\Temp\Perflib_Perfdata_be8.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_748.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02172009_193613

Files moved on Reboot…
File C:\DOCUME~1\GABRIE~1\LOCALS~1\Temp\Perflib_Perfdata_be8.dat not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_748.dat not found!

**********************************************

********************HJT log********************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:16, on 17-02-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Shortcut to speedfan.exe.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2108E348-A0C0-1563-D327-730450CF5E34} (CPlayFirstDDComcastControl Object) - http://www.shockwave.com/content/dinerdash…st.1.0.0.39.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1233428773312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1204771691765
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.shockwave.com/content/burgersho…esPlayer_v5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

–
End of file - 12890 bytes

************************************************

CatByte

Post #10February 18, 2009, 2:04 AM UTC

Hi sosotiit,

Things are looking much better….

Lets run a couple more scans to make sure there is nothing lingering on your system,

FIRST

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

NEXT

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

In your next reply I need

MBAM log
Kaspersky log
Fresh HJT log

Also advise if there are any other issues with your computer.

sosotiit

Post #11February 19, 2009, 2:37 AM UTC

All seems to function great,

Here are the logs

thks, soso

***********MBAM log **************

Malwarebytes' Anti-Malware 1.34
Database version: 1775
Windows 5.1.2600 Service Pack 3

18-02-09 18:00:04
mbam-log-2009-02-18 (18-00-04).txt

Scan type: Full Scan (C:\|)
Objects scanned: 254498
Time elapsed: 1 hour(s), 33 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\RECYCLER\S-1-5-21-776561741-725345543-839522115-1004\Dc4\patch.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

*************************************

***********Kaspersky log **************

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, February 18, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, February 18, 2009 23:24:15
Records in database: 1812855
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
F:\

Scan statistics:
Files scanned: 169254
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 02:38:45

No malware has been detected. The scan area is clean.

The selected area was scanned.

*************************************

***********HJT log **************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:31:46, on 18-02-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wscntfy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Shortcut to speedfan.exe.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2108E348-A0C0-1563-D327-730450CF5E34} (CPlayFirstDDComcastControl Object) - http://www.shockwave.com/content/dinerdash…st.1.0.0.39.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1233428773312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1204771691765
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.shockwave.com/content/burgersho…esPlayer_v5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

–
End of file - 12920 bytes

*************************************

CatByte

Post #12February 19, 2009, 5:00 AM UTC

Hi sosotiit,

Things are looking much better, however I still see indicators of two antivirus programs installed - trust me when I tell you this is LESS protection, not more.

If you have actually uninstalled the Symantec program, often times there are leftovers that the uninstallation leaves behind.

If this is the case then Norton has a tool that will remove all of its products from failed uninstalls.

Download the Norton Remover tool for your product.

Next double click Norton Removal Tool to run the tool.

Follow the on-screen instructions.

Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.

Please post a fresh HJT log after you have removed one of the AV programs.

Then please stay with me as there is more clean up to do.

Thank-you.

CB

sosotiit

Post #13February 19, 2009, 7:16 PM UTC last edited February 19, 2009, 7:27 PM UTC

Hi Catbyte

In fact Symantec Client security Corporate is my main AV / FW tool.

I also have AVG free that I use for scanning only, I do not use the resident shield. I had removed that app from the startup, as well as put the service in manual mode ( I was activating it only in order to scan) as per image below.

I just found avg usefull as a scanner as it seem to find some items others did not. If you feel it like this is not adequate, I really have no prob uninstalling avg completely.

When I leave the avg service in manual mode but stopped, this is what I get

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:22:20, on 19-02-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Shortcut to speedfan.exe.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2108E348-A0C0-1563-D327-730450CF5E34} (CPlayFirstDDComcastControl Object) - http://www.shockwave.com/content/dinerdash…st.1.0.0.39.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi…st_uploader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1233428773312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1204771691765
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.shockwave.com/content/burgersho…esPlayer_v5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

–
End of file - 12857 bytes

thanks, soso

Attachments:

📎image.png

CatByte

Post #14February 20, 2009, 2:29 AM UTC

Hi sosotiit,

I just found avg usefull as a scanner

Keeping it for that purpose is perfectly fine - no need to uninstall if that's how you are using it

Now the good News - your logs are clean

Now we just have a little clean up to do.

You have a few outdated java versions left on your system, this will leave your system vulnerable to java exploits so lets get rid of them. (you will only have to do this once as now the newest java's will now overwrite the old.)

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
Download and install the latest Java Runtime Environment (JRE) version for your computer. (JRE version 6 update 12)

NEXT

Clean up with OTMoveIt3:

Double-click OTMoveIt3.exe to start the program.
Close all other programs apart from OTMoveIt3 as this step will require a reboot
On the OTMoveIt3 main screen, press the [external image: Posted Image] button
Say Yes to the prompt and then allow the program to reboot your computer.

NEXT

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points
We need to set a new system restore point:

Click Start > Run > copy and paste the following into the run box:

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next.
Name it (something you'll remember) and click Create,
when the confirmation screen shows the restore point has been created click Close.

Now remove all previous Restore Points:

Click Start > Run > copy and paste the following into the run box:

cleanmgr

At the top, click on More Options tab. Click the Clean up button in the System Restore box.
Click on the Yes button.
When finished, click on Cancel button to exit.

Below I have included a number of recommendations for how to protect your computer against malware infections.

Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here
If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
- McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
Please read the guide by Rorschach112 on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

sosotiit

Post #15February 21, 2009, 12:41 AM UTC last edited February 21, 2009, 12:55 AM UTC

all done, well almost, the mozilla part was not popular with the operator of that unit

so I will leave it at IE Also I must admit that I was getting lost between all these tools (AVG, Trojanhunter, adaware, spybot, spyware doctor…), reading the reference you have provided and some of the info around this site, I will stick with the AV / FW I have and get "Malwarebytes' Anti-Malware" which seems to be very well rated. The rest I may keep some to scan as needed, and some I will just get rid thks again, soso

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] popup window

✨ Ask AI

Ask AI