King5
Topic Starter
Hi,
Could someone take a look at this? AVG keeps saying I have 5 infected files.
It keeps saying I have a Trojan Horse virus called Downloader.Istbar.4.AE!
Here is the log file of the AVG results. And below that is the HiJack This logfile results. Please Help!!!!
Results of AVG Complete Test, date and time 9/28/2004 16:30:15 :
Testing C:\ volume PROGRAMS serial 68AD-5C6E
C:\Avery Wizard\AVERYWIZ.WIZ Contains macros
C:\Linksys Firmaware Upgrades & Instructions\Linksys Firmware V.1.39\befsr_fw_1.39.zip:\Upgrade.doc Found some macros
C:\Linksys Firmaware Upgrades & Instructions\Linksys Firmware v1.45.7\befsr_fw_1457.zip:\Upgrade.doc Found some macros
C:\Pest Patrol Corporate 4.0\FILE2.ZIP:\crack.exe Trojan horse Downloader.Istbar.4.AE
Testing D:\ serial 40F9-24BF
D:\HIBERFIL.SYS Cannot open; not checked!
D:\Documents and Settings\LocalService\NTUSER.DAT Cannot open; not checked!
D:\Documents and Settings\LocalService\ntuser.dat.LOG Cannot open; not checked!
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
D:\Documents and Settings\NetworkService\NTUSER.DAT Cannot open; not checked!
D:\Documents and Settings\NetworkService\ntuser.dat.LOG Cannot open; not checked!
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
D:\Documents and Settings\SONNY\NTUSER.DAT Cannot open; not checked!
D:\Documents and Settings\SONNY\ntuser.dat.LOG Cannot open; not checked!
D:\Documents and Settings\SONNY\Application Data\Microsoft\Templates\NORMAL.DOT Contains macros
D:\Documents and Settings\SONNY\Application Data\Microsoft\Templates\AVERY\Avery Wizard.wiz Contains macros
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\Documents.dfd Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\Documents.did Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\Documents.dsd Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KDB Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KDL Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KIB Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KPF Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KSB Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\9YYA6R25\file2[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\MB8A8756\file10[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\MB8A8756\file2[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\MB8A8756\file4[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\My Documents\MISC\T-N-T\TNTAD1.DOC Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A299.WPS Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A303.WPS Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A328.WPS Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A338.WPS Found some macros
D:\Linksys Firmware V.1.39\befsr_fw_1.39.zip:\Upgrade.doc Found some macros
D:\Linksys Firmware V.1.39\UPGRADE.DOC Found some macros
D:\Linksys Firmware v1.45.7\befsr_fw_1457.zip:\Upgrade.doc Found some macros
D:\Linksys Firmware v1.45.7\Upgrade Instructions.doc Found some macros
D:\Program Files\Microsoft Office\OFFICE10\WEBPAGE.WIZ Contains macros
D:\Program Files\Microsoft Office\OFFICE10\1033\EXPTOOWS.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\EUROTOOL.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\HTML.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\LOOKUP.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\SUMIF.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\ANALYSIS\ATPVBAEN.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\ANALYSIS\FUNCRES.XLA Found some macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\ANALYSIS\PROCDB.XLA Found some macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\SOLVER\SOLVER.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\MACROS\SUPPORT.DOT Contains macros
D:\Program Files\Microsoft Office\OFFICE10\SAMPLES\NorthwindCS.adp Contains macros
D:\Program Files\Microsoft Office\OFFICE10\SAMPLES\SAMPLES.XLS Contains macros
D:\Program Files\Microsoft Office\OFFICE10\SAMPLES\SOLVSAMP.XLS Found some macros
D:\Program Files\Microsoft Office\OFFICE10\STARTUP\A20MSW10.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Agenda Wizard.Wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Batch Conversion Wizard.Wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\BROCHURE.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Calendar Wizard.Wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Fax.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Letter.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Memo.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Report.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Resume.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\CONTMADR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\CONTMFAX.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\CONTMLTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Directory.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Fax.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Letter.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Memo.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Report.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Resume.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ELEGMADR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ELEGMFAX.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ELEGMLTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Employee Orientation.pot Found some macros
D:\Program Files\Microsoft Office\Templates\1033\Envelope Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ExpenseStatement.xlt Found some macros
D:\Program Files\Microsoft Office\Templates\1033\Fax Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\LABEL.WIZ Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Letter Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\MANUAL.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Memo Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\MERGELTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Pleading Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PLEADSUB.WIZ Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Fax.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Letter.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Report.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Resume.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PROFMADR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PROFMFAX.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PROFMLTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Resume Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Sales Invoice.xlt Found some macros
D:\Program Files\Microsoft Office\Templates\1033\THESIS.DOT Contains macros
D:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Cannot open; not checked!
Testing E:\ volume Misc serial 846E-7A6F
Testing F:\ volume Music Drive serial 8CB2-8081
Testing I:\ volume MP3s Drive serial 84A4-DBFE
Test finished, duration 00:48:20.9 s
44810 objects tested, 5 found infected
HERE IS MY HIJACK THIS LOGFILE!!!!!
Logfile of HijackThis v1.97.7
Scan saved at 6:50:50 PM, on 9/28/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Sygate Personal Firewall\smc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG6\avgserv.exe
D:\PROGRA~1\Iomega\System32\AppServices.exe
D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\Program Files\Iomega\AutoDisk\ADService.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
D:\PROGRA~1\VISION~1\ONETOU~2.EXE
D:\WINDOWS\System32\qttask.exe
D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
D:\WINDOWS\System32\devldr32.exe
D:\Program Files\Iomega\AutoDisk\ADUserMon.exe
D:\Program Files\Iomega\DriveIcons\ImgIcon.exe
D:\Program Files\Grisoft\AVG6\avgcc32.exe
D:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
D:\Total Recorder v4.4\TotRecSched.exe
D:\program files\quickidrive tools1.1\quickidrive.exe
D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PPMemCheck.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PESTPA~1\PESTPA~1\PPControl.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Registry Clean Expert\RCScheduler.exe
D:\Program Files\Plaxo\2.0.3.16\InstallStub.exe
D:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\Spyware Guard\SpywareGuard\sgmain.exe
D:\WINDOWS\System32\wuauclt.exe
D:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
D:\Spyware Guard\SpywareGuard\sgbhp.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\HiJack This\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2843DAC1-05EF-11D2-95BA-0060083493D6} - D:\WINDOWS\Speech\Dragon\web_ie.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Spyware Guard\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\FLASHG~1.40\FLASHG~1.40\jccatch.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\windows\downloaded program files\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\FLASHG~1.40\FLASHG~1.40\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\windows\downloaded program files\googletoolbar1.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] D:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OneTouch Monitor] D:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] D:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ADUserMon] D:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] D:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] D:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [AVG_CC] D:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [mmtask] D:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SmcService] D:\SYGATE~1\smc.exe -startgui
O4 - HKLM\..\Run: [TotalRecorderScheduler] "D:\Total Recorder v4.4\TotRecSched.exe"
O4 - HKLM\..\Run: [QuickiDriv] d:\program files\quickidrive tools1.1\quickidrive.exe sys_auto_run D:\Program Files\QuickiDrive Tools1.1
O4 - HKLM\..\Run: [PPMemCheck] D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PestPatrol Control Center] D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PESTPA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [RealTray] D:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] D:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [RegClean Expert Scheduler] "D:\Registry Clean Expert\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [PlaxoUpdate] D:\Program Files\Plaxo\2.0.3.16\InstallStub.exe -a
O4 - HKCU\..\Run: [Copernic Desktop Search] "D:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe" /tray
O4 - HKCU\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: SpywareGuard.lnk = D:\Spyware Guard\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Front Page 2000\Office\OSA9.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\FlashGet 1.40\FlashGet 1.40\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\FlashGet 1.40\FlashGet 1.40\jc_link.htm
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: MUSICMATCH Radio (HKLM)
O9 - Extra button: SpellChecker (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: Yahoo! Checkers - http://download.games.yahoo.com/games/clients/y/kt4_x.cab
O16 - DPF: Yahoo! Chinese Checkers - http://download.games.yahoo.com/games/clients/y/cct0_x.cab
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…s/yinst0401.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {4169B5A0-9048-11D6-BDFF-00C0F024AF20} (ActiveXTester.TesterControl) - http://www.jasons-toolbox.com/BrowserSecur…tiveXTester.ocx
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003012…all/xscan53.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50188/QDow_AS2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/…7626.7373263889
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BFE8EE3-6FB4-4A46-A321-8EFAE0CF5B92}: NameServer = 12.17.161.3,12.150.88.9
Thanks In Advance,
King5
Could someone take a look at this? AVG keeps saying I have 5 infected files.
It keeps saying I have a Trojan Horse virus called Downloader.Istbar.4.AE!
Here is the log file of the AVG results. And below that is the HiJack This logfile results. Please Help!!!!
Results of AVG Complete Test, date and time 9/28/2004 16:30:15 :
Testing C:\ volume PROGRAMS serial 68AD-5C6E
C:\Avery Wizard\AVERYWIZ.WIZ Contains macros
C:\Linksys Firmaware Upgrades & Instructions\Linksys Firmware V.1.39\befsr_fw_1.39.zip:\Upgrade.doc Found some macros
C:\Linksys Firmaware Upgrades & Instructions\Linksys Firmware v1.45.7\befsr_fw_1457.zip:\Upgrade.doc Found some macros
C:\Pest Patrol Corporate 4.0\FILE2.ZIP:\crack.exe Trojan horse Downloader.Istbar.4.AE
Testing D:\ serial 40F9-24BF
D:\HIBERFIL.SYS Cannot open; not checked!
D:\Documents and Settings\LocalService\NTUSER.DAT Cannot open; not checked!
D:\Documents and Settings\LocalService\ntuser.dat.LOG Cannot open; not checked!
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
D:\Documents and Settings\NetworkService\NTUSER.DAT Cannot open; not checked!
D:\Documents and Settings\NetworkService\ntuser.dat.LOG Cannot open; not checked!
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
D:\Documents and Settings\SONNY\NTUSER.DAT Cannot open; not checked!
D:\Documents and Settings\SONNY\ntuser.dat.LOG Cannot open; not checked!
D:\Documents and Settings\SONNY\Application Data\Microsoft\Templates\NORMAL.DOT Contains macros
D:\Documents and Settings\SONNY\Application Data\Microsoft\Templates\AVERY\Avery Wizard.wiz Contains macros
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\Documents.dfd Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\Documents.did Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\Documents.dsd Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KDB Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KDL Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KIB Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KPF Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\COPERNIC\DesktopSearch\INDEX\MainChunk\KEYWORDS.KSB Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\9YYA6R25\file2[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\MB8A8756\file10[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\MB8A8756\file2[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\Local Settings\Temporary Internet Files\CONTENT.IE5\MB8A8756\file4[1].zip:\crack.exe Trojan horse Downloader.Istbar.4.AE
D:\Documents and Settings\SONNY\My Documents\MISC\T-N-T\TNTAD1.DOC Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A299.WPS Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A303.WPS Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A328.WPS Found some macros
D:\Documents and Settings\SONNY\My Documents\My Lyric Files\Songs To Be Sorted\LYRICS1\A338.WPS Found some macros
D:\Linksys Firmware V.1.39\befsr_fw_1.39.zip:\Upgrade.doc Found some macros
D:\Linksys Firmware V.1.39\UPGRADE.DOC Found some macros
D:\Linksys Firmware v1.45.7\befsr_fw_1457.zip:\Upgrade.doc Found some macros
D:\Linksys Firmware v1.45.7\Upgrade Instructions.doc Found some macros
D:\Program Files\Microsoft Office\OFFICE10\WEBPAGE.WIZ Contains macros
D:\Program Files\Microsoft Office\OFFICE10\1033\EXPTOOWS.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\EUROTOOL.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\HTML.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\LOOKUP.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\SUMIF.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\ANALYSIS\ATPVBAEN.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\ANALYSIS\FUNCRES.XLA Found some macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\ANALYSIS\PROCDB.XLA Found some macros
D:\Program Files\Microsoft Office\OFFICE10\LIBRARY\SOLVER\SOLVER.XLA Contains macros
D:\Program Files\Microsoft Office\OFFICE10\MACROS\SUPPORT.DOT Contains macros
D:\Program Files\Microsoft Office\OFFICE10\SAMPLES\NorthwindCS.adp Contains macros
D:\Program Files\Microsoft Office\OFFICE10\SAMPLES\SAMPLES.XLS Contains macros
D:\Program Files\Microsoft Office\OFFICE10\SAMPLES\SOLVSAMP.XLS Found some macros
D:\Program Files\Microsoft Office\OFFICE10\STARTUP\A20MSW10.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Agenda Wizard.Wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Batch Conversion Wizard.Wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\BROCHURE.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Calendar Wizard.Wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Fax.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Letter.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Memo.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Report.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Contemporary Resume.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\CONTMADR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\CONTMFAX.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\CONTMLTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Directory.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Fax.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Letter.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Memo.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Report.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Elegant Resume.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ELEGMADR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ELEGMFAX.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ELEGMLTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Employee Orientation.pot Found some macros
D:\Program Files\Microsoft Office\Templates\1033\Envelope Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\ExpenseStatement.xlt Found some macros
D:\Program Files\Microsoft Office\Templates\1033\Fax Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\LABEL.WIZ Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Letter Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\MANUAL.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Memo Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\MERGELTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Pleading Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PLEADSUB.WIZ Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Fax.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Letter.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Report.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Professional Resume.dot Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PROFMADR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PROFMFAX.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\PROFMLTR.DOT Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Resume Wizard.wiz Contains macros
D:\Program Files\Microsoft Office\Templates\1033\Sales Invoice.xlt Found some macros
D:\Program Files\Microsoft Office\Templates\1033\THESIS.DOT Contains macros
D:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Cannot open; not checked!
Testing E:\ volume Misc serial 846E-7A6F
Testing F:\ volume Music Drive serial 8CB2-8081
Testing I:\ volume MP3s Drive serial 84A4-DBFE
Test finished, duration 00:48:20.9 s
44810 objects tested, 5 found infected
HERE IS MY HIJACK THIS LOGFILE!!!!!
Logfile of HijackThis v1.97.7
Scan saved at 6:50:50 PM, on 9/28/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Sygate Personal Firewall\smc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG6\avgserv.exe
D:\PROGRA~1\Iomega\System32\AppServices.exe
D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\Program Files\Iomega\AutoDisk\ADService.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
D:\PROGRA~1\VISION~1\ONETOU~2.EXE
D:\WINDOWS\System32\qttask.exe
D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
D:\WINDOWS\System32\devldr32.exe
D:\Program Files\Iomega\AutoDisk\ADUserMon.exe
D:\Program Files\Iomega\DriveIcons\ImgIcon.exe
D:\Program Files\Grisoft\AVG6\avgcc32.exe
D:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
D:\Total Recorder v4.4\TotRecSched.exe
D:\program files\quickidrive tools1.1\quickidrive.exe
D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PPMemCheck.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PESTPA~1\PESTPA~1\PPControl.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Registry Clean Expert\RCScheduler.exe
D:\Program Files\Plaxo\2.0.3.16\InstallStub.exe
D:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\Spyware Guard\SpywareGuard\sgmain.exe
D:\WINDOWS\System32\wuauclt.exe
D:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
D:\Spyware Guard\SpywareGuard\sgbhp.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\HiJack This\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2843DAC1-05EF-11D2-95BA-0060083493D6} - D:\WINDOWS\Speech\Dragon\web_ie.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Spyware Guard\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\FLASHG~1.40\FLASHG~1.40\jccatch.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\windows\downloaded program files\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\FLASHG~1.40\FLASHG~1.40\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\windows\downloaded program files\googletoolbar1.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] D:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OneTouch Monitor] D:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] D:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ADUserMon] D:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] D:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] D:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [AVG_CC] D:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [mmtask] D:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SmcService] D:\SYGATE~1\smc.exe -startgui
O4 - HKLM\..\Run: [TotalRecorderScheduler] "D:\Total Recorder v4.4\TotRecSched.exe"
O4 - HKLM\..\Run: [QuickiDriv] d:\program files\quickidrive tools1.1\quickidrive.exe sys_auto_run D:\Program Files\QuickiDrive Tools1.1
O4 - HKLM\..\Run: [PPMemCheck] D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PestPatrol Control Center] D:\PESTPA~1.0\PESTPA~1.0\PESTPA~1\PESTPA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [RealTray] D:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] D:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [RegClean Expert Scheduler] "D:\Registry Clean Expert\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [PlaxoUpdate] D:\Program Files\Plaxo\2.0.3.16\InstallStub.exe -a
O4 - HKCU\..\Run: [Copernic Desktop Search] "D:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe" /tray
O4 - HKCU\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: SpywareGuard.lnk = D:\Spyware Guard\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Front Page 2000\Office\OSA9.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\FlashGet 1.40\FlashGet 1.40\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\FlashGet 1.40\FlashGet 1.40\jc_link.htm
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: MUSICMATCH Radio (HKLM)
O9 - Extra button: SpellChecker (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: Yahoo! Checkers - http://download.games.yahoo.com/games/clients/y/kt4_x.cab
O16 - DPF: Yahoo! Chinese Checkers - http://download.games.yahoo.com/games/clients/y/cct0_x.cab
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…s/yinst0401.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {4169B5A0-9048-11D6-BDFF-00C0F024AF20} (ActiveXTester.TesterControl) - http://www.jasons-toolbox.com/BrowserSecur…tiveXTester.ocx
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1…n/GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003012…all/xscan53.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50188/QDow_AS2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/…7626.7373263889
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BFE8EE3-6FB4-4A46-A321-8EFAE0CF5B92}: NameServer = 12.17.161.3,12.150.88.9
Thanks In Advance,
King5