Deleted Member
Topic Starter
hi guys and thanks for looking. this is a replacement, used, cpu and i am beginning to think the OS may have been re-installed over an un-resolved infection.
Symptoms include: random freezes, incomplete desktop loads, random scrolling, drive activity
when there really shouldn't be any -> (no updates running, no interactive use, sometimes even when idle)
printer conflict when Open Office installed - OO not yet un-installed - but no conflict prior to the install
highlighted items are not controllable via keyboard - rt mouse menu only - no delete, backspace or typeover capabilities
Yahoo mail was compromised and a new password established
Freecycle acct was spammed and disabled
have recently received emails from myself, sent to my yahoo address (not initiated by me) selling some canadien sex supplements ~~ also receiving notice from contacts that they are receiving same or similar emails
When surfing a local news site, the page back color changes but returns to white with a refresh.
System is a Dell Optiplex280 w/pentium 4/1gig RAM. Is running XP Pro Sp3 (which is new to me / had XP Home) and since i'm unfamiliar with the OS, i'm hoping you'll give it a once over.
A friend suggested RegSeeker to clean up the registry and it did the job a few times over, but then a MalwareBytes scan identified it as a 'trojan' and removed it. The RegSeeker program didn't
trigger anything on previous scans … and, it originated from these forums, so i doubt it was really a trojan but it was subsequently removed.
Zone Alarm Security Suite is the active AV/Spyware/Firewall. The following have been run and produced clean results … ZA deep scan, MalwareBytes, ATF cleaner and CCleaner.
After snooping in the main directories, i noticed the following entries that seem odd or foreign to me and would appreciate your input and assistance. Many (like 80% of'em) indicate some infection of one kind or another when googled. Some provide no info at all and others i simply wonder why they exist. Listed first is an entry identified as 'vundo'-related when googled … which prompted this posting.
C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
the remaining just caught my eye for one reason or another and there seems to be a plethora of 'temp' files. not sure how to deal with these or if any are necessary for XP Pro functionality. Please advise.
C:\Documents and Settings\Administrator\Application Data\setup_ldm.iss
C:\Documents and Settings\Administrator\Application Data\Leadertech\PowerRegister
C:\Documents and Settings\Administrator\Application Data\Leadertech\PowerRegister\PowerReg.dat
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\1033
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\1033\StructuredQuerySchema.bin
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0\5RA8NCCY.ZG3
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0\5RA8NCCY.ZG3\GXR5KKVQ.66P
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0\5RA8NCCY.ZG3\GXR5KKVQ.66P\manifests
C:\Documents and Settings\Administrator\Local Settings\Temp\AdobeARM.log
C:\Documents and Settings\Administrator\Local Settings\Temp\AUCHECK_CORE.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\AUCHECK_PARSER.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\config.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\en-us
C:\Documents and Settings\Administrator\Local Settings\Temp\hpqddusr.log
C:\Documents and Settings\Administrator\Local Settings\Temp\hsperfdata_Administrator
C:\Documents and Settings\Administrator\Local Settings\Temp\IMT40C.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IMT40D.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IMT40E.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp
C:\Documents and Settings\Administrator\Local Settings\Temp\isw_acc_80100000
C:\Documents and Settings\Administrator\Local Settings\Temp\jq9146.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\jusched.log
C:\Documents and Settings\Administrator\Local Settings\Temp\le1140.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\li9142.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\manifest.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR5.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR6.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR7.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR8.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARB.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARC.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARD.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARE.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\plugtmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ps9148.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\qv914A.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\raa153.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\RedboxLog.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\resource.h
C:\Documents and Settings\Administrator\Local Settings\Temp\setup0000.log
C:\Documents and Settings\Administrator\Local Settings\Temp\so9145.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\sve8f.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\sve8g.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\svkke.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\t4u154.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ub2155.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ur9147.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\v69150.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\WPDNSE
C:\Documents and Settings\Administrator\Local Settings\Temp\_add_ds.log
C:\Documents and Settings\Administrator\Local Settings\Temp\_remove_ds.log
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1079.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1E51.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF3144.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF4BDC.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFB4A1.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFEC2B.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\en-us\strings.en-us.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\DwlRun
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\isw_acc_10100000
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\PA
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\WH
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\AK_DLL.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\CPLic.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\FFApi.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWAK.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWDMP.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWFRAME.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWFWMON.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWGUI.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWMENUS.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWSHEX.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWSPYSCAN.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWSTATS.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUILIB.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUL.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUL_MIN.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUPD.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWVEXT.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaDownload.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaDownload.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaExtensions.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaExtensions.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\SiteChecker.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\Trustchecker.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\Trustchecker.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\TrustcheckerIEPlugin.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\TrustcheckerMozillaPlugin.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\TrustcheckerMozillaPlugin.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\PA\2f7fb469b38f8ae1e9c72c2b0e209141
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\WH\0
C:\Documents and Settings\Administrator\Local Settings\Temp\sve8g.tmp\sve8h.tmp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2D2NO2RI\mgou[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2D2NO2RI\SearchBandUI[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4FO4HEHV\alert[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4FO4HEHV\sbtnbk[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4FO4HEHV\SEARCHBANDUI[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AKZ6ICJE\dog[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AKZ6ICJE\mgou[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AKZ6ICJE\SearchBandUI[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IT3R1QG7\elipses_normal[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IT3R1QG7\WDS_logo5[1]
Erunt was run, HijackThis follows and lines marked by –> are HJT items that are also attention getting.
Your advice and guidance is greatly appreciated.
GrannyMouse
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:58:23 PM, on 9/17/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
–> C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Logitech Vid\Vid.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Ontrack\Internet Cleanup\onictask.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
–> O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
–> O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files\Logitech\Logitech Vid\Vid.exe" -bootmode
–> O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Startup: Cleanup.lnk = C:\Program Files\Ontrack\Internet Cleanup\onictask.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
–> O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
–> O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1263746924101
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1280809430140
–> O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
–> O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ZoneAlarm ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
–> O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
–
End of file - 9446 bytes
Symptoms include: random freezes, incomplete desktop loads, random scrolling, drive activity
when there really shouldn't be any -> (no updates running, no interactive use, sometimes even when idle)
printer conflict when Open Office installed - OO not yet un-installed - but no conflict prior to the install
highlighted items are not controllable via keyboard - rt mouse menu only - no delete, backspace or typeover capabilities
Yahoo mail was compromised and a new password established
Freecycle acct was spammed and disabled
have recently received emails from myself, sent to my yahoo address (not initiated by me) selling some canadien sex supplements ~~ also receiving notice from contacts that they are receiving same or similar emails
When surfing a local news site, the page back color changes but returns to white with a refresh.
System is a Dell Optiplex280 w/pentium 4/1gig RAM. Is running XP Pro Sp3 (which is new to me / had XP Home) and since i'm unfamiliar with the OS, i'm hoping you'll give it a once over.
A friend suggested RegSeeker to clean up the registry and it did the job a few times over, but then a MalwareBytes scan identified it as a 'trojan' and removed it. The RegSeeker program didn't
trigger anything on previous scans … and, it originated from these forums, so i doubt it was really a trojan but it was subsequently removed.
Zone Alarm Security Suite is the active AV/Spyware/Firewall. The following have been run and produced clean results … ZA deep scan, MalwareBytes, ATF cleaner and CCleaner.
After snooping in the main directories, i noticed the following entries that seem odd or foreign to me and would appreciate your input and assistance. Many (like 80% of'em) indicate some infection of one kind or another when googled. Some provide no info at all and others i simply wonder why they exist. Listed first is an entry identified as 'vundo'-related when googled … which prompted this posting.
C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
the remaining just caught my eye for one reason or another and there seems to be a plethora of 'temp' files. not sure how to deal with these or if any are necessary for XP Pro functionality. Please advise.
C:\Documents and Settings\Administrator\Application Data\setup_ldm.iss
C:\Documents and Settings\Administrator\Application Data\Leadertech\PowerRegister
C:\Documents and Settings\Administrator\Application Data\Leadertech\PowerRegister\PowerReg.dat
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\1033
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\1033\StructuredQuerySchema.bin
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0\5RA8NCCY.ZG3
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0\5RA8NCCY.ZG3\GXR5KKVQ.66P
C:\Documents and Settings\Administrator\Local Settings\Apps\2.0\5RA8NCCY.ZG3\GXR5KKVQ.66P\manifests
C:\Documents and Settings\Administrator\Local Settings\Temp\AdobeARM.log
C:\Documents and Settings\Administrator\Local Settings\Temp\AUCHECK_CORE.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\AUCHECK_PARSER.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\config.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\en-us
C:\Documents and Settings\Administrator\Local Settings\Temp\hpqddusr.log
C:\Documents and Settings\Administrator\Local Settings\Temp\hsperfdata_Administrator
C:\Documents and Settings\Administrator\Local Settings\Temp\IMT40C.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IMT40D.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IMT40E.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp
C:\Documents and Settings\Administrator\Local Settings\Temp\isw_acc_80100000
C:\Documents and Settings\Administrator\Local Settings\Temp\jq9146.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\jusched.log
C:\Documents and Settings\Administrator\Local Settings\Temp\le1140.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\li9142.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\manifest.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR5.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR6.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR7.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MAR8.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARB.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARC.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARD.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\MARE.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\plugtmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ps9148.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\qv914A.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\raa153.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\RedboxLog.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\resource.h
C:\Documents and Settings\Administrator\Local Settings\Temp\setup0000.log
C:\Documents and Settings\Administrator\Local Settings\Temp\so9145.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\sve8f.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\sve8g.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\svkke.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\t4u154.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ub2155.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\ur9147.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\v69150.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\WPDNSE
C:\Documents and Settings\Administrator\Local Settings\Temp\_add_ds.log
C:\Documents and Settings\Administrator\Local Settings\Temp\_remove_ds.log
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1079.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1E51.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF3144.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF4BDC.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFB4A1.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFEC2B.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\en-us\strings.en-us.xml
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\DwlRun
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\isw_acc_10100000
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\PA
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\WH
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\AK_DLL.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\CPLic.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\FFApi.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWAK.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWDMP.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWFRAME.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWFWMON.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWGUI.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWMENUS.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWSHEX.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWSPYSCAN.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWSTATS.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUILIB.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUL.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUL_MIN.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWUPD.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\ISWVEXT.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaDownload.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaDownload.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaExtensions.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\MozillaExtensions.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\SiteChecker.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\Trustchecker.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\Trustchecker.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\TrustcheckerIEPlugin.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\TrustcheckerMozillaPlugin.swl
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\Logs\TrustcheckerMozillaPlugin.swl.old
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\PA\2f7fb469b38f8ae1e9c72c2b0e209141
C:\Documents and Settings\Administrator\Local Settings\Temp\IswTmp\WH\0
C:\Documents and Settings\Administrator\Local Settings\Temp\sve8g.tmp\sve8h.tmp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2D2NO2RI\mgou[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2D2NO2RI\SearchBandUI[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4FO4HEHV\alert[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4FO4HEHV\sbtnbk[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4FO4HEHV\SEARCHBANDUI[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AKZ6ICJE\dog[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AKZ6ICJE\mgou[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\AKZ6ICJE\SearchBandUI[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IT3R1QG7\elipses_normal[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IT3R1QG7\WDS_logo5[1]
Erunt was run, HijackThis follows and lines marked by –> are HJT items that are also attention getting.
Your advice and guidance is greatly appreciated.
GrannyMouse
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:58:23 PM, on 9/17/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
–> C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Logitech Vid\Vid.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Ontrack\Internet Cleanup\onictask.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
–> O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
–> O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files\Logitech\Logitech Vid\Vid.exe" -bootmode
–> O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Startup: Cleanup.lnk = C:\Program Files\Ontrack\Internet Cleanup\onictask.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
–> O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
–> O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1263746924101
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1280809430140
–> O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
–> O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ZoneAlarm ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
–> O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
–
End of file - 9446 bytes
I will try to run DDS from the .scr link again and who knows, maybe i'll get lucky this time. Please recommend an alternate tool as i have serious doubts it will work.
thanks,
GM
Before i got to your reply, i re-booted the machine and tried the DDS.scr again and got results. Soooo, here's what you asked for and should i run the 'alternate' tool also ??
DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 20:18:28.43 on Fri 09/24/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.572 [GMT -4:00]
AV: ZoneAlarm Extreme Security Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Extreme Security Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Logitech Vid\Vid.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Ontrack\Internet Cleanup\onictask.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Administrator\Desktop\dds2.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride =
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Logitech Vid] "c:\program files\logitech\logitech vid\Vid.exe" -bootmode
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide
mRun: [REGSHAVE] c:\program files\regshave\REGSHAVE.EXE /AUTORUN
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\cleanup.lnk - c:\program files\ontrack\internet cleanup\onictask.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\apcups~1.lnk - c:\program files\apc\apc powerchute personal edition\Display.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263746924101
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1280809430140
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\epo9pjyc.default\
FF - prefs.js: network.proxy.type - 1
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\MozillaDownload.dll
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\MozillaExtensions.dll
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\TrustCheckerMozillaPlugin.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\epo9pjyc.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\program files\google\google updater\2.4.1808.5272\npCIDetect14.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R0 kl1;kl1;c:\windows\system32\drivers\kl1.sys [2010-8-2 128016]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-8-2 317072]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-8-2 528128]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2010-6-15 26352]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2010-6-15 493032]
R3 icsak;icsak;c:\program files\checkpoint\zaforcefield\ak\icsak.sys [2010-6-15 35568]
S0 cerc6;cerc6; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 133104]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2008-4-13 14336]
=============== Created Last 30 ================
2010-09-18 03:57:02 0 d—–w- c:\docume~1\admini~1\applic~1\#ISW.FS#
2010-09-06 08:01:09 117760 —-a-w- c:\windows\system32\hpzll64X.dll
2010-09-03 04:24:29 23113 —-a-w- c:\windows\hpqins15.dat
2010-09-02 05:55:50 69 —-a-w- c:\windows\NeroDigital.ini
==================== Find3M ====================
2010-09-24 21:07:56 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-08-17 13:17:06 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-04 17:15:57 201476 —-a-w- c:\windows\hpoins40.dat
2010-08-03 03:03:30 121278 —-a-w- c:\windows\HPHins15.dat
2010-08-02 17:58:37 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2010-08-02 17:58:24 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2010-08-02 17:58:22 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-07-22 15:49:15 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57:20 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-21 01:22:56 72704 —-a-w- c:\windows\zllsputility.exe
2010-07-21 01:22:46 1238528 —-a-w- c:\windows\system32\zpeng25.dll
2010-07-17 09:00:04 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-06-30 12:31:35 149504 —-a-w- c:\windows\system32\schannel.dll
============= FINISH: 20:19:06.84 ===============
If you do not assist with these removals, i understand, but would you please direct me to the correct forum for assistance? I truly have no clue. Actually, this is my first adventure with XP Pro … there is probably stuff here that i still have yet to discover.