What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please Look At This Post

28 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Wow it looks clean! How is your computer behaving? This infection obviously hides it's files in safe mode which is the direct opposite of what they normally do. They usually hide their files except when in safe mode so that people can't find them to delete them in normal mode.

I hope your computer is working now, please write back and tell me.

There are a few things you should do now to make sure you are completely clean:

1. I do not see any indication that you have an antivirus program running. This is essential when you are using the internet. Two are listed here, take your pick:

AVG Free AntiVirus

Avast anti virus free
Avast Free AntiVirus


2. You also do not appear to have a firewall running and there are a few available for free that have excellent reputations:

Zone ALarm Free Firewall
Kerio Free Firewall


3. Go to Start>Programs>Acccessories>System Tools> Disk Cleanup and put a check mark beside all the entries in the disk cleanup window that ask you what you want to clean. Clean all hard drives and all files. This will get rid of any malware that is hiding in the temporary folders.

4. Make sure that all Internet Temp files are gone, by checking the folders that the Temporary Internet Files and Temp files are stored in. To do so use Control Panel > Internet Options(or right click the IE icon on the desktop and choose Properties). Click Delete Files on the General Tab - place a check in the Delete all offline content box, then 'Clear History' and then press OK

5. Empty your Recycle Bin

6. Double Check the following folders to make sure they are empty:
C:\WINDOWS\Profiles\your account\Temporary Internet Files
Delete all the files in (and any subfolders of) the C:\Windows\Temp\ folder

7. I think you also may benefit from reading the article "How Did I Get Infected In The First Place" linked at the bottom of each of my posts, for information on how to secure your PC from spyware/adware/malware.There are several small free programs mentioned there that help with securing your PC against this type of problem.

8. Reinstall AdAware SE and turn on Ad-Watch


Good Luck!
Post #18
I am glad that we were able to help! I am closing this topic now, but if you need it reopened, please send an email to the following link(Click for address) with the Subject line of the email "Reopen".
To receive a response, please include in your email: the user name used in the post, details of why you need it reopened, and a valid link to the post.

Emails with bad links to the post, emails that are not from the original poster, and emails that do not have "ReOpen" as the subject line, will be deleted without being opening.

Please start a New Topic if this is not your thread. Thank-you for your co-operation.
Post #20
After When I went into IE for the first time all of the trouble started happening

Log file of HijackThis v1.98.2
Scan saved at 8:46:33 AM, on 12/20/04
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Wintab32.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$LACERTEDB\Binn\sqlservr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ntpx.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
C:\WINNT\system32\ZPOINT32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\xwebm.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\xwebm.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\accounting\Application Data\Mozilla\Profiles\default\zpqsrour.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {F5E678D4-39B4-DBD3-3D03-5CE4D3E7398A} - C:\WINNT\mfcsk.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ToolExe] C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [pdfFactory Dispatcher v1] C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINNT\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [ZPOINT32] C:\WINNT\system32\ZPOINT32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [mfcpt.exe] C:\WINNT\mfcpt.exe
O4 - HKLM\..\RunOnce: [dxcyx] C:\WINNT\Active Setup Log.BAK:dxcyx
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - (no file)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0F15679F-75AB-4B96-A08C-472B7DB1A0F2} (03PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {710B08F6-6CD1-48EA-BC2F-5D31741DC480} (03WebInstall) - https://www.lacertesoftware.com/my_account/…3webinstall.cab
O16 - DPF: {72109033-D398-49B6-8C11-A15619BEE0AF} (04WebInstall) - https://www.lacertesoftware.com/my_account/…4webinstall.cab
O16 - DPF: {76886F39-D4D8-4F00-A354-3CC1C364F363} - http://personal.fidelity.com/products/tool…lityToolbar.cab
O16 - DPF: {C17F4F67-8040-4E2D-86E3-EF8E4833A5C2} (02WebInstall) - https://www.lacertesoftware.com/my_account/…2webinstall.cab
O16 - DPF: {CD48759E-5CC9-43DC-A690-C999F9D1F73A} (04PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EBEC069-D5D7-47A8-BDF0-5D5EC2F8E49B}: NameServer = 167.206.3.171,167.206.3.170
O18 - Protocol hijack: ct - {774E529C-2458-48A2-8F57-3ED3105D8612}
O18 - Protocol: cw - {774E529C-2458-48A2-8F57-3ED3105D8612} - C:\Program Files\Total Engagement Office\cwproto.dll
Post #21
Hi Yanks
sorry for the delay and it does appear you are fully infected with about blank. As you will remember we have to go through all the steps again and hopefully this time be able to find the files and delete them.

Please remember that contact with the internet allows the bad files to contact their website and download more files to your computer so minimizing your contact with the internet is important. (we cannot avoid some contact before the fix). The ohter activity which causes the infection to reinstall is opening IE as you found out.

Step#1:

Please download an alternate browser Mozilla so that you can use it for downloading the files you will need for the fix Mozilla 1.73
Please click here to download and then install it to your computer. Using Internet Explorer will cause the infection to Reinstall making the fix more complicated.

Step#2:

We need to make sure all hidden files are showing so please:
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Step#3:

1. Please download Service Filter
2. Extract it to it's own folder.
3. Click on ServiceFilter.vbs
4. A text file called POST_THIS will be in the same folder
5. Please use Edit>Select all then Edit>Copy to obtain the contents
6. Please Post the contents into this thread using 'Add Reply'


Step#4:

If you still have getservice.zip that you downloaded last time then please use it to scan your hard drive again. If not, please do the following:

Please download the following file that will show us the bad service that has been added by the infection, from here:

Getservice.zip

1. Extract the file to the c:\ drive.

2. Then navigate to the c:\getservices and double-click on the getservices.bat file. A notepad will open up with the log.

3. Please paste the contents of that notepad as a reply to this post.
Post #22
First of all you have a file on your system that appears to be part of the hijack that our developers have been looking for. They need a copy of the file to identify it so that we can help you and others who have been attacked by the same hijacker, more effectively. (This is the way all spyware is identified and then placed into the current definitions for the appropriate application: anti-virus, anti-trojan, anti-spyware, so that they can be removed easily in the future)

Please Search for and Find
C:\Program Files\Total Engagement Office\cwproto.dll

Then make a Zip file with it and send it by email as an attachment to :
Click For Address including a link to your post in the body of the email

Thank-you for your assistance
Post #23
PsService v1.1 - local and remote services viewer/controller Copyright © 2001-2003 Mark Russinovich Sysinternals - www.sysinternals.com SERVICE_NAME: Alerter Notifies selected users and computers of administrative alerts. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Alerter DEPENDENCIES : LanmanWorkstation SERVICE_START_NAME: LocalSystem SERVICE_NAME: AppMgmt Provides software installation services such as Assign, Publish, and Remove. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Application Management DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: aspnet_state Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : ASP.NET State Service DEPENDENCIES : SERVICE_START_NAME: .\ASPNET SERVICE_NAME: BITS Transfers files in the background using idle network bandwidth. If the service is disabled, then any functions that depend on BITS, such as Windows Update or MSN Explorer will be unable to automatically download programs and other information. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k BITSgroup LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Background Intelligent Transfer Service DEPENDENCIES : LanmanWorkstation : Rpcss : SENS : Wmi SERVICE_START_NAME: LocalSystem SERVICE_NAME: Browser Maintains an up-to-date list of computers on your network and supplies the list to programs that request it. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Computer Browser DEPENDENCIES : LanmanWorkstation : LanmanServer SERVICE_START_NAME: LocalSystem SERVICE_NAME: cisvc (null) TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\cisvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Indexing Service DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: ClipSrv Supports ClipBook Viewer, which allows pages to be seen by remote ClipBooks. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\clipsrv.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : ClipBook DEPENDENCIES : NetDDE SERVICE_START_NAME: LocalSystem SERVICE_NAME: DefWatch (null) TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\Program Files\NavNT\defwatch.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : DefWatch DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: Dhcp Manages network configuration by registering and updating IP addresses and DNS names. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : DHCP Client DEPENDENCIES : Tcpip : Afd : NetBT SERVICE_START_NAME: LocalSystem SERVICE_NAME: dmadmin Administrative service for disk management requests TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\dmadmin.exe /com LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Logical Disk Manager Administrative Service DEPENDENCIES : RpcSs : PlugPlay : DmServer SERVICE_START_NAME: LocalSystem SERVICE_NAME: dmserver Logical Disk Manager Watchdog Service TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Logical Disk Manager DEPENDENCIES : RpcSs : PlugPlay SERVICE_START_NAME: LocalSystem SERVICE_NAME: Dnscache Resolves and caches Domain Name System (DNS) names. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : DNS Client DEPENDENCIES : Tcpip SERVICE_START_NAME: LocalSystem SERVICE_NAME: Eventlog Logs event messages issued by programs and Windows. Event Log reports contain information that can be useful in diagnosing problems. Reports are viewed in Event Viewer. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\services.exe LOAD_ORDER_GROUP : Event log TAG : 0 DISPLAY_NAME : Event Log DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: EventSystem Provides automatic distribution of events to subscribing COM components. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : Network TAG : 0 DISPLAY_NAME : COM+ Event System DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: Fax Helps you send and receive faxes TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\faxsvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Fax Service DEPENDENCIES : TapiSrv : RpcSs : PlugPlay : Spooler SERVICE_START_NAME: LocalSystem SERVICE_NAME: HidServ (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\hidserv.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : HID Input Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: lanmanserver Provides RPC support and file, print, and named pipe sharing. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Server DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: lanmanworkstation Provides network connections and communications. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : NetworkProvider TAG : 0 DISPLAY_NAME : Workstation DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: LexBceS (null) TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\LEXBCES.EXE LOAD_ORDER_GROUP : SpoolerGroup TAG : 0 DISPLAY_NAME : LexBce Server DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: LmHosts Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : TCP/IP NetBIOS Helper Service DEPENDENCIES : NetBT : Afd SERVICE_START_NAME: LocalSystem SERVICE_NAME: Messenger Sends and receives messages transmitted by administrators or by the Alerter service. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Messenger DEPENDENCIES : LanmanWorkstation : NetBIOS : RpcSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: mnmsrvc Allows authorized people to remotely access your Windows desktop using NetMeeting. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\mnmsrvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : NetMeeting Remote Desktop Sharing DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: MSDTC Coordinates transactions that are distributed across two or more databases, message queues, file systems, or other transaction protected resource managers. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\msdtc.exe LOAD_ORDER_GROUP : MS Transactions TAG : 0 DISPLAY_NAME : Distributed Transaction Coordinator DEPENDENCIES : RPCSS : SamSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: MSIServer (null) TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\msiexec.exe /V LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Installer DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: MSSQL$LACERTEDB (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\Microsoft SQL Server\MSSQL$LACERTEDB\Binn\sqlservr.exe -sLACERTEDB LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MSSQL$LACERTEDB DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: MSSQLServerADHelper (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MSSQLServerADHelper DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: NetDDE Provides network transport and security for dynamic data exchange (DDE). TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\netdde.exe LOAD_ORDER_GROUP : NetDDEGroup TAG : 0 DISPLAY_NAME : Network DDE DEPENDENCIES : NetDDEDSDM SERVICE_START_NAME: LocalSystem SERVICE_NAME: NetDDEdsdm Manages shared dynamic data exchange and is used by Network DDE TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\netdde.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Network DDE DSDM DEPENDENCIES : : EGrLocalSystem : Network DDE DSDM : etwork DDE : lSystem : MSSQLServerADHelper : L$LACERTEDB : ice : v :  SERVICE_START_NAME: LocalSystem SERVICE_NAME: Netlogon Supports pass-through authentication of account logon events for computers in a domain. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\lsass.exe LOAD_ORDER_GROUP : RemoteValidation TAG : 0 DISPLAY_NAME : Net Logon DEPENDENCIES : LanmanWorkstation SERVICE_START_NAME: LocalSystem SERVICE_NAME: Netman Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Network Connections DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: Norton AntiVirus Server (null) TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\Program Files\NavNT\rtvscan.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Norton AntiVirus Client DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: NtLmSsp Provides security to remote procedure call (RPC) programs that use transports other than named pipes. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\lsass.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : NT LM Security Support Provider DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: NtmsSvc Manages removable media, drives, and libraries. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Removable Storage DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: NVSvc Provides system and desktop level support to the NVIDIA display driver TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\nvsvc32.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : NVIDIA Display Driver Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: ose Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Office Source Engine DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: PlugPlay Manages device installation and configuration and notifies programs of device changes. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\services.exe LOAD_ORDER_GROUP : PlugPlay TAG : 0 DISPLAY_NAME : Plug and Play DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: PolicyAgent Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\lsass.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : IPSEC Policy Agent DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: ProtectedStorage Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Protected Storage DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: RasAuto Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Access Auto Connection Manager DEPENDENCIES : RasMan : Tapisrv SERVICE_START_NAME: LocalSystem SERVICE_NAME: RasMan Creates a network connection. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Access Connection Manager DEPENDENCIES : Tapisrv SERVICE_START_NAME: LocalSystem SERVICE_NAME: RemoteAccess Offers routing services to businesses in local area and wide area network environments. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 4 DISABLED ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Routing and Remote Access DEPENDENCIES : RpcSS : +NetBIOSGroup SERVICE_START_NAME: LocalSystem SERVICE_NAME: RemoteRegistry Allows remote registry manipulation. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\regsvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Registry Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem FAIL_RESET_PERIOD : 0 seconds FAILURE_ACTIONS : Restart DELAY: 1000 seconds SERVICE_NAME: rpcapd Allows to capture traffic on this machine from a remote machine. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Packet Capture Protocol v.0 (experimental) DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: RpcLocator Manages the RPC name service database. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\locator.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Procedure Call (RPC) Locator DEPENDENCIES : LanmanWorkstation SERVICE_START_NAME: LocalSystem SERVICE_NAME: RpcSs Provides the endpoint mapper and other miscellaneous RPC services. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\svchost -k rpcss LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Remote Procedure Call (RPC) DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: RSVP Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\rsvp.exe -s LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : QoS RSVP DEPENDENCIES : TcpIp : Afd SERVICE_START_NAME: LocalSystem SERVICE_NAME: SamSs Stores security information for local user accounts. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\lsass.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Security Accounts Manager DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: SCardDrv Provides support for legacy smart card readers attached to the computer. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\WINNT\System32\SCardSvr.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Smart Card Helper DEPENDENCIES : +Smart Card Reader SERVICE_START_NAME: LocalSystem SERVICE_NAME: SCardSvr Manages and controls access to a smart card inserted into a smart card reader attached to the computer. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\WINNT\System32\SCardSvr.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Smart Card DEPENDENCIES : PlugPlay SERVICE_START_NAME: LocalSystem SERVICE_NAME: Schedule Enables a program to run at a designated time. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\MSTask.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Task Scheduler DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: seclogon Enables starting processes under alternate credentials TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : RunAs Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: SENS Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : Network TAG : 0 DISPLAY_NAME : System Event Notification DEPENDENCIES : EventSystem SERVICE_START_NAME: LocalSystem SERVICE_NAME: SharedAccess Provides network address translation, addressing, and name resolution services for all computers on your home network through a dial-up connection. TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Internet Connection Sharing DEPENDENCIES : RasMan SERVICE_START_NAME: LocalSystem SERVICE_NAME: Spooler Loads files to memory for later printing. TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\spoolsv.exe LOAD_ORDER_GROUP : SpoolerGroup TAG : 0 DISPLAY_NAME : Print Spooler DEPENDENCIES : LexBceS : RPCSS SERVICE_START_NAME: LocalSystem SERVICE_NAME: SQLAgent$LACERTEDB (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\Microsoft SQL Server\MSSQL$LACERTEDB\Binn\sqlagent.EXE -i LACERTEDB LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : SQLAgent$LACERTEDB DEPENDENCIES : MSSQL$LACERTEDB SERVICE_START_NAME: LocalSystem SERVICE_NAME: StiSvc (null) TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\stisvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Still Image Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: SysmonLog Configures performance logs and alerts. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\smlogsvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Performance Logs and Alerts DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: TapiSrv Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Telephony DEPENDENCIES : PlugPlay : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: TlntSvr Allows a remote user to log on to the system and run console programs using the command line. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\tlntsvr.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Telnet DEPENDENCIES : RpcSs : TcpIp SERVICE_START_NAME: LocalSystem SERVICE_NAME: TrkWks Sends notifications of files moving between NTFS volumes in a network domain. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Distributed Link Tracking Client DEPENDENCIES : RpcSs SERVICE_START_NAME: LocalSystem SERVICE_NAME: UPS Manages an uninterruptible power supply (UPS) connected to the computer. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\ups.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Uninterruptible Power Supply DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: UtilMan Starts and configures accessibility tools from one window TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\UtilMan.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Utility Manager DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: W32Time Sets the computer clock. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Time DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: WinMgmt Provides system management information. TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\WINNT\System32\WBEM\WinMgmt.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Management Instrumentation DEPENDENCIES : RPCSS SERVICE_START_NAME: LocalSystem FAIL_RESET_PERIOD : 86400 seconds FAILURE_ACTIONS : Restart DELAY: 60000 seconds : Restart DELAY: 60000 seconds SERVICE_NAME: Wintab32 (null) TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\Wintab32.exe LOAD_ORDER_GROUP : Pointer Class TAG : 0 DISPLAY_NAME : Wintab32 DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: WMDM PMSP Service (null) TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\mspmspsv.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : WMDM PMSP Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: WmdmPmSN Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Portable Media Serial Number Service DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: Wmi Provides systems management information to and from drivers. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\Services.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Windows Management Instrumentation Driver Extensions DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: wuauserv Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\system32\svchost.exe -k wugroup LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Automatic Updates DEPENDENCIES : SERVICE_START_NAME: LocalSystem SERVICE_NAME: WZCSVC Provides authenticated network access control using IEEE 802.1x for wired and wireless Ethernet networks. TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\WINNT\System32\svchost.exe -k netsvcs LOAD_ORDER_GROUP : TDI TAG : 0 DISPLAY_NAME : Wireless Configuration DEPENDENCIES : RpcSs : Ndisuio : ProtectedStorage : WMI SERVICE_START_NAME: LocalSystem SERVICE_NAME: %AF夶À¨ (null) TYPE : 20 WIN32_SHARE_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\WINNT\system32\ntpx.exe /s LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Network Security Service (NSS) DEPENDENCIES : SERVICE_START_NAME: LocalSystem now the next file The script did not recognize the services listed below. This does not mean that they are a problem. To copy the entire contents of this document for posting: At the top of this window click "Edit" then "Select All" Next click "Edit" again then "Copy" Now right click in the forum post box then click "Paste" ######################################## ServiceFilter 1.1 by rand1038 Microsoft Windows 2000 Professional Version: 5.0.2195 Service Pack 4 Dec 21, 2004 8:33:08 AM —> Begin Service Listing <— Unknown Service # 1 Service Name: MSSQL$LACERTEDB Display Name: MSSQL$LACERTEDB Start Mode: Auto Start Name: LocalSystem Description: MSSQL$LACERTEDB… Service Type: Own Process Path: c:\program files\microsoft sql server\mssql$lacertedb\binn\sqlservr.exe -slacertedb State: Running Process ID: 700 Started: True Exit Code: 0 Accept Pause: True Accept Stop: True Unknown Service # 2 Service Name: MSSQLServerADHelper Display Name: MSSQLServerADHelper Start Mode: Manual Start Name: LocalSystem Description: MSSQLServerADHelper… Service Type: Own Process Path: c:\program files\microsoft sql server\80\tools\binn\sqladhlp.exe State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False Unknown Service # 3 Service Name: ose Display Name: Office Source Engine Start Mode: Manual Start Name: LocalSystem Description: Office Source … Service Type: Own Process Path: c:\program files\common files\microsoft shared\source engine\ose.exe State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False Unknown Service # 4 Service Name: SQLAgent$LACERTEDB Display Name: SQLAgent$LACERTEDB Start Mode: Manual Start Name: LocalSystem Description: SQLAgent$LACERTEDB… Service Type: Own Process Path: c:\program files\microsoft sql server\mssql$lacertedb\binn\sqlagent.exe -i lacertedb State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False Unknown Service # 5 Service Name: Wintab32 Display Name: Wintab32 Start Mode: Auto Start Name: LocalSystem Description: Wintab32… Service Type: Own Process Path: c:\winnt\system32\wintab32.exe State: Running Process ID: 364 Started: True Exit Code: 0 Accept Pause: True Accept Stop: True Unknown Service # 6 Service Name: %AF夶À¨ Display Name: Network Security Service (NSS) Start Mode: Auto Start Name: LocalSystem Description: Network Security Service … Service Type: Share Process Path: c:\winnt\system32\ntpx.exe /s State: Running Process ID: 1008 Started: True Exit Code: 0 Accept Pause: False Accept Stop: True —> End Service Listing <— There are 71 Win32 services on this machine. 6 were unrecognized. Script Execution Time: 5.078125 seconds.
Post #24
Step#1:

Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available. You must disconnect from the internet totally, as staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer closed throughout as opening it will reinstall the infection. Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.

Please continue with the next step and if you run into any problems with the current one, just keep going through the list step by step. Just be sure to let us know what the problem was when you finally reply.


Step#1:

Please download the following program called ADS SPY.
for use later. Please remove the check marks from Quick Scan and Ignore safe system info data streams


Step#2:

1.If you do not still have About Buster, Please download About:Buster from here: http://tools.zerosrealm.com/AboutBuster.zip.

2. Once it is downloaded extract it to c:\aboutbuster. Do NOT use it yet



Step#3:

If you do not have this please download Registrar Lite for use later: Please download Registrar Lite and install it to C:\Program Files\RegLite\ . This is a registry editor that is very easy to use.



Step#4:

Now Please disconnect from the Internet and unplug your modem for the duration of this fix

1. Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE

2. Click on start > control panel > administrative programs > services. Look for a service called Network Security Service (NSS). Double click on that service and click stop and then set the startup to disabled. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.



Step#5:

Press control-alt-delete to get into the task manager and end the following processes if they exist:

C:\WINNT\system32\ntpx.exe



Step#6:

I now need you to delete the following files:

C:\WINNT\system32\ntpx.exe
C:\WINNT\system32\xwebm.dll
C:\WINNT\mfcsk.dll
C:\WINNT\mfcpt.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.



Step#7:

1. Double click on ADS Spy to open the zip and then double click on the file inside. Make sure the check marks have been removed from the two entries noted above, then click Scan System For Alternate Data Streams

2. When the scan is finished look for this entry: C:\WINNT\Active Setup Log.BAK:dxcyx in the window and put a check mark beside it

3. With a check mark beside C:\WINNT\Active Setup Log.BAK:dxcyx choose Remove Selected Streams at the top right of the window

4. Close ADS SPY

Step#8:

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\xwebm.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\xwebm.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {F5E678D4-39B4-DBD3-3D03-5CE4D3E7398A} - C:\WINNT\mfcsk.dll
O4 - HKLM\..\Run: [mfcpt.exe] C:\WINNT\mfcpt.exe




Step#9:

In the next step we are going to remove a service that gets installed by this malware.

1. Open Registrar Lite and run it.

2. Copy and paste the bold text below into the address bar of Registrar Lite:(this is making a Registry backup for safety in case of error)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Go to File> Export and and save as (in the C:\Program Files\Registrar Lite (Reglite) folder):

1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)


3. Copy and paste the bold text below into the address bar of Reglite:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%AF夶À¨


4. Click Go

5. If %AF夶À¨
 exists it will be highlighted in the left pane , right click on it and choose delete from the menu.


6. Copy and Paste the bold text below into the address bar of Registrar Lite:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%AF夶À¨


7. Click Go

8. If LEGACY_%AF夶À¨
 exists then right click on it and choose delete from the menu.

9. If you have trouble deleting a key. Then click once on the key name to highlight it and on the top menu choose Security, then Edit Permissions. Then make sure you are an Administrator and give yourself Full Control of that key. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.

10. If you have had to change the permissions on the keys in Registrar Lite then they will have to be returned to the way they were . To do this please navigate to C:\ProgramFiles\Registrar Lite (Reglite) and double-click on Winkey.reg. It will ask if you want to merge this file with the registry, say Yes. Then double-click on Winkey.hiv and merge this file with the Registry. You have now returned the permissions to the way they were.


Step#10:

This is the step where we will use About:Buster that you had downloaded previously.

Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so. Post the log file in your next reply


When it has completed move on to step 11.


Step#11:

Copy the contents of the Quote Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
and Save it on the desktop

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]


Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.


Step#12:

1.Reboot your computer back to normal mode and Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.

2. Post both your log from About Buster and your HijackThis log here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.

Good Luck!
Post #25
I could not do #9 since I could't type or copy and paste the werid charicters in the lline

Logfile of HijackThis v1.98.2
Scan saved at 5:18:42 PM, on 12/21/04
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Wintab32.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$LACERTEDB\Binn\sqlservr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\MsgSys.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
C:\WINNT\system32\ZPOINT32.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\accounting\Application Data\Mozilla\Profiles\default\zpqsrour.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ToolExe] C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [pdfFactory Dispatcher v1] C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINNT\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [ZPOINT32] C:\WINNT\system32\ZPOINT32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [mfcpt.exe] C:\WINNT\mfcpt.exe
O4 - HKLM\..\RunOnce: [dxcyx] C:\WINNT\Active Setup Log.BAK:dxcyx
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - (no file)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0F15679F-75AB-4B96-A08C-472B7DB1A0F2} (03PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {710B08F6-6CD1-48EA-BC2F-5D31741DC480} (03WebInstall) - https://www.lacertesoftware.com/my_account/…3webinstall.cab
O16 - DPF: {72109033-D398-49B6-8C11-A15619BEE0AF} (04WebInstall) - https://www.lacertesoftware.com/my_account/…4webinstall.cab
O16 - DPF: {76886F39-D4D8-4F00-A354-3CC1C364F363} - http://personal.fidelity.com/products/tool…lityToolbar.cab
O16 - DPF: {C17F4F67-8040-4E2D-86E3-EF8E4833A5C2} (02WebInstall) - https://www.lacertesoftware.com/my_account/…2webinstall.cab
O16 - DPF: {CD48759E-5CC9-43DC-A690-C999F9D1F73A} (04PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EBEC069-D5D7-47A8-BDF0-5D5EC2F8E49B}: NameServer = 167.206.3.171,167.206.3.170
O18 - Protocol hijack: ct - {774E529C-2458-48A2-8F57-3ED3105D8612}
O18 - Protocol: cw - {774E529C-2458-48A2-8F57-3ED3105D8612} - C:\Program Files\Total Engagement Office\cwproto.dll




Scanned at: 5:07:22 PM on: 12/21/04


– Scan 1 —————————
About:Buster Version 4.0
Reference List : 16


Removed Data Streams:
C:\WINNT\sysiw.dll:ezifx
C:\WINNT\twunk_16.exe:itedo


Removed! : C:\WINNT\addcv.exe
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset… Done!

– Scan 2 —————————
About:Buster Version 4.0
Reference List : 16


Removed Data Streams:
C:\WINNT\sysiw.dll:ezifx
C:\WINNT\twunk_16.exe:itedo


Attempted Clean Of Temp folder.
Pages Reset… Done!
Post #26
I don't understand why you were unable to copy and paste those lines. If you copied the instructions to wordpad as instructed, then you would be able to copy what is in the wordpad window to Reglite. There is another way of removing the lines but it involves direct registry editing and unless the instructions are followed exactly as written using great caution, it can cause your PC to become unbootable. Please return to the start of the instructions, copy the instructions to wordpad, then repeat each of the steps originally posted. Once you have completed all of the steps, please repeat the scan with About Buster and post a new log for both About Buster and HijackThis.
Post #27
ok I was able to do all of the steps but the 2 fgiles in #9 that had the werid letters were not there to delete

here are the 2 logs

Scanned at: 5:07:22 PM on: 12/21/04


– Scan 1 —————————
About:Buster Version 4.0
Reference List : 16


Removed Data Streams:
C:\WINNT\sysiw.dll:ezifx
C:\WINNT\twunk_16.exe:itedo


Removed! : C:\WINNT\addcv.exe
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset… Done!

– Scan 2 —————————
About:Buster Version 4.0
Reference List : 16


Removed Data Streams:
C:\WINNT\sysiw.dll:ezifx
C:\WINNT\twunk_16.exe:itedo


Attempted Clean Of Temp folder.
Pages Reset… Done!






Scanned at: 12:18:13 PM on: 12/22/04


– Scan 1 —————————
About:Buster Version 4.0
Reference List : 16

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset… Done!

– Scan 2 —————————
About:Buster Version 4.0
Reference List : 16

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset… Done!






Scanned at: 1:06:50 PM on: 12/22/04


– Scan 1 —————————
About:Buster Version 4.0
Reference List : 16

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset… Done!

– Scan 2 —————————
About:Buster Version 4.0
Reference List : 16

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset… Done!






Logfile of HijackThis v1.98.2
Scan saved at 1:07:12 PM, on 12/22/04
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Wintab32.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$LACERTEDB\Binn\sqlservr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
C:\WINNT\system32\ZPOINT32.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\accounting\Application Data\Mozilla\Profiles\default\zpqsrour.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ToolExe] C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [pdfFactory Dispatcher v1] C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINNT\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [ZPOINT32] C:\WINNT\system32\ZPOINT32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [mfcpt.exe] C:\WINNT\mfcpt.exe
O4 - HKLM\..\RunOnce: [dxcyx] C:\WINNT\Active Setup Log.BAK:dxcyx
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - (no file)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0F15679F-75AB-4B96-A08C-472B7DB1A0F2} (03PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {710B08F6-6CD1-48EA-BC2F-5D31741DC480} (03WebInstall) - https://www.lacertesoftware.com/my_account/…3webinstall.cab
O16 - DPF: {72109033-D398-49B6-8C11-A15619BEE0AF} (04WebInstall) - https://www.lacertesoftware.com/my_account/…4webinstall.cab
O16 - DPF: {76886F39-D4D8-4F00-A354-3CC1C364F363} - http://personal.fidelity.com/products/tool…lityToolbar.cab
O16 - DPF: {C17F4F67-8040-4E2D-86E3-EF8E4833A5C2} (02WebInstall) - https://www.lacertesoftware.com/my_account/…2webinstall.cab
O16 - DPF: {CD48759E-5CC9-43DC-A690-C999F9D1F73A} (04PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EBEC069-D5D7-47A8-BDF0-5D5EC2F8E49B}: NameServer = 167.206.3.171,167.206.3.170
O18 - Protocol hijack: ct - {774E529C-2458-48A2-8F57-3ED3105D8612}
O18 - Protocol: cw - {774E529C-2458-48A2-8F57-3ED3105D8612} - C:\Program Files\Total Engagement Office\cwproto.dll
Post #28
Hi there

Could you try something for me. Click here to download cwsuninst.zip. Extract cwsuninst.reg from the zip file and save it to the desktop. When done, double-click the cwsuninst.reg and when asked to merge say yes.

Open HJT>Config>Misc Tools> Update to v1.99

Click here to download mwavscan. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply together with a new HJT log and a ServiceFilter log.
Post #29
Thanks for all the help, Happy Holidays

Logfile of HijackThis v1.99.0
Scan saved at 7:50:41 AM, on 12/24/04
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Wintab32.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$LACERTEDB\Binn\sqlservr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
C:\WINNT\system32\ZPOINT32.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\Program Files\Microsoft Money 2005\MNYCoreFiles\mnybbsvc.exe
C:\PROGRA~1\WMRECO~2\WMVCR.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\accounting\Application Data\Mozilla\Profiles\default\zpqsrour.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ToolExe] C:\PROGRAM FILES\DELL\TRAYTOOL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [pdfFactory Dispatcher v1] C:\WINNT\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINNT\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [ZPOINT32] C:\WINNT\system32\ZPOINT32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [mfcpt.exe] C:\WINNT\mfcpt.exe
O4 - HKLM\..\RunOnce: [dxcyx] C:\WINNT\Active Setup Log.BAK:dxcyx
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - C:\WINNT\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 - {BDD75188-2FC0-4099-909F-AA8D432BE037} - C:\WINNT\System32\shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0F15679F-75AB-4B96-A08C-472B7DB1A0F2} (03PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {710B08F6-6CD1-48EA-BC2F-5D31741DC480} (03WebInstall) - https://www.lacertesoftware.com/my_account/…3webinstall.cab
O16 - DPF: {72109033-D398-49B6-8C11-A15619BEE0AF} (04WebInstall) - https://www.lacertesoftware.com/my_account/…4webinstall.cab
O16 - DPF: {76886F39-D4D8-4F00-A354-3CC1C364F363} - http://personal.fidelity.com/products/tool…lityToolbar.cab
O16 - DPF: {C17F4F67-8040-4E2D-86E3-EF8E4833A5C2} (02WebInstall) - https://www.lacertesoftware.com/my_account/…2webinstall.cab
O16 - DPF: {CD48759E-5CC9-43DC-A690-C999F9D1F73A} (04PrepInstall) - https://www.lacertesoftware.com/my_account/…prepinstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EBEC069-D5D7-47A8-BDF0-5D5EC2F8E49B}: NameServer = 167.206.3.171,167.206.3.170
O18 - Protocol hijack: ct - {774E529C-2458-48A2-8F57-3ED3105D8612}
O18 - Protocol: cw - {774E529C-2458-48A2-8F57-3ED3105D8612} - C:\Program Files\Total Engagement Office\cwproto.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) - Unknown - %ProgramFiles%\WinPcap\rpcapd.exe (file missing)
O23 - Service: Wintab32 - Unknown - C:\WINNT\system32\Wintab32.exe

The script did not recognize the services listed below.
This does not mean that they are a problem.

To copy the entire contents of this document for posting:
At the top of this window click "Edit" then "Select All"
Next click "Edit" again then "Copy"
Now right click in the forum post box then click "Paste"

########################################

ServiceFilter 1.1
by rand1038

Microsoft Windows 2000 Professional
Version: 5.0.2195 Service Pack 4
Dec 24, 2004 7:49:49 AM


—> Begin Service Listing <—

Unknown Service # 1
Service Name: MSSQL$LACERTEDB
Display Name: MSSQL$LACERTEDB
Start Mode: Auto
Start Name: LocalSystem
Description: MSSQL$LACERTEDB…
Service Type: Own Process
Path: c:\program files\microsoft sql server\mssql$lacertedb\binn\sqlservr.exe -slacertedb
State: Running
Process ID: 656
Started: True
Exit Code: 0
Accept Pause: True
Accept Stop: True

Unknown Service # 2
Service Name: MSSQLServerADHelper
Display Name: MSSQLServerADHelper
Start Mode: Manual
Start Name: LocalSystem
Description: MSSQLServerADHelper…
Service Type: Own Process
Path: c:\program files\microsoft sql server\80\tools\binn\sqladhlp.exe
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Unknown Service # 3
Service Name: ose
Display Name: Office Source Engine
Start Mode: Manual
Start Name: LocalSystem
Description: Office Source …
Service Type: Own Process
Path: c:\program files\common files\microsoft shared\source engine\ose.exe
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Unknown Service # 4
Service Name: SQLAgent$LACERTEDB
Display Name: SQLAgent$LACERTEDB
Start Mode: Manual
Start Name: LocalSystem
Description: SQLAgent$LACERTEDB…
Service Type: Own Process
Path: c:\program files\microsoft sql server\mssql$lacertedb\binn\sqlagent.exe -i lacertedb
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Unknown Service # 5
Service Name: Wintab32
Display Name: Wintab32
Start Mode: Auto
Start Name: LocalSystem
Description: Wintab32…
Service Type: Own Process
Path: c:\winnt\system32\wintab32.exe
State: Running
Process ID: 372
Started: True
Exit Code: 0
Accept Pause: True
Accept Stop: True

Unknown Service # 6
Service Name: %AF夶À¨
Display Name: %AF夶À¨
Start Mode: Unknown
Start Name:
Description: %AF夶À¨…
Service Type: Unknown
Path:
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

—> End Service Listing <—

There are 71 Win32 services on this machine.
6 were unrecognized.

Script Execution Time: 5.375 seconds.

File C:\WINNT\addcv.exe.bak infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\addig32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\apipm32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\apiwv.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\appdt32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appgt.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appjw32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\apprz32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appsm32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appve32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlbe32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlcl32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlea32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlgp32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atllc.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlmh.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlox32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlrs32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crfm.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\crhi.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crlv32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crmr.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crsc32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\crvm.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crxb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\d3ds32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\d3ib.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\d3oj32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\ieah32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ieaw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\iegz.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ielp32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ieri.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ietm32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ievd32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipeh32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ippn.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\iprx.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipuu.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipvl32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipww.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipyn32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javacb.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javaml32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javaqf32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javaqn32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javavr32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcif.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcsk.exe infected by "TrojanDownloader.Win32.Agent.cd" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcwj.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcwo.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcyy32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\mslv.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\msni32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\msso.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\netjb.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\netwa.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntac32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntap.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\nthb32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntpw32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntzp.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\nwuninstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINNT\n_cazrdf.txt infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken.
File C:\WINNT\n_gskitm.dat infected by "Trojan-Downloader.Win32.Agent.db" Virus. Action Taken: No Action Taken.
File C:\WINNT\n_xpefmw.log infected by "Trojan-Downloader.Win32.Agent.db" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkem.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkhz.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkjb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkkc32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkkv32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkpk32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkyg.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysak.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\syshb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysiw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysrr32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysus32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\syszu32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\wingz.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\winot.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\winys32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addck.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addcq.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addip.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addtq32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addyd.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apiib32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apilp.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apimt.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apinx32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apitw32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apiuj32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appcz32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appjb.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apppn32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appqf.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appzq32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\atlak32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\atldd.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\atlos.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\craf.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crcq.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crez.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crgf32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crnd.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crug32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crxz.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3if.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3ju32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3os.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3qc32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3rh32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3vv.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iean.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ieco.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iehg.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ieic32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ieji.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iejp.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iera32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ievy32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipae32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipak32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipgc.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipld.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iplm32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipwh32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\javabk.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\javahv.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\javazn32.dll infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mfcmg32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\msgy32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\msky32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mspr.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mssc.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mstz32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netew.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netme32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netqs.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netuz32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netvb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netvw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netwg32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netyu32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ntah.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\nths.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ntrm.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkbb.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkgj32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkou32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkqm.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkqy.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdksh.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkyw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\syseh.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\syshh32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sysmh.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sysnf32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winam32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\wingt32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winjc.dll infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winlo.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winmf32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winmn.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winmz32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winrb.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winvr.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\ACCOUN~1\LOCALS~1\Temp\CF.tmp infected by "Trojan.Win32.HideProc.a" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\accounting\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.jar-2a572d57-22e0e0a8.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\accounting\Local Settings\Temp\CF.tmp infected by "Trojan.Win32.HideProc.a" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\management\Local Settings\Temp\xwxload.exe infected by "TrojanDownloader.Win32.Small.eh" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\0TAZCL2B\gallery[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\816P6HU9\CA45U305.htm infected by "TrojanDownoader.JS.FlingStone" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\9OWJLL4H\CA7QXOLH.htm infected by "TrojanDownoader.JS.FlingStone" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\JZTDDDLM\msits[1].exe infected by "TrojanDownloader.Win32.Petrolin.a" Virus. Action Taken: No Action Taken.
File C:\hijackthis\backups\backup-20041117-205315-952.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\Program Files\Internet Explorer\ugyxclem.exe infected by "TrojanDownloader.Win32.Petrolin.b" Virus. Action Taken: No Action Taken.
File C:\Q250204.exe infected by "TrojanDownloader.Win32.WinShow.r" Virus. Action Taken: No Action Taken.
File C:\Q250214.exe infected by "TrojanDropper.Win32.Agent.x" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1708537768-1500820517-725345543-1002\Dc1434.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\RECYCLER\S-1-5-21-1708537768-1500820517-725345543-1002\Dc1506.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\RECYCLER\S-1-5-21-1708537768-1500820517-725345543-1002\Dc1617.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1708537768-1500820517-725345543-1002\Dc1618.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1708537768-1500820517-725345543-1002\Dc1619.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1708537768-1500820517-725345543-1002\Dc1620.exe infected by "TrojanDownloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken.
File C:\WINNT\addcv.exe.bak infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\addig32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\apipm32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\apiwv.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\appdt32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appgt.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appjw32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\apprz32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appsm32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\appve32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlbe32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlcl32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlea32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlgp32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atllc.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlmh.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlox32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\atlrs32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crfm.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\crhi.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crlv32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crmr.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crsc32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\crvm.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\crxb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\d3ds32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\d3ib.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\d3oj32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\ieah32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ieaw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\iegz.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ielp32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ieri.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ietm32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ievd32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipeh32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ippn.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\iprx.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipuu.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipvl32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipww.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ipyn32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javacb.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javaml32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javaqf32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javaqn32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\javavr32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcif.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcsk.exe infected by "TrojanDownloader.Win32.Agent.cd" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcwj.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcwo.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\mfcyy32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\mslv.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\msni32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\msso.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\netjb.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\netwa.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntac32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntap.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\nthb32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntpw32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\ntzp.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\nwuninstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINNT\n_cazrdf.txt infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken.
File C:\WINNT\n_gskitm.dat infected by "Trojan-Downloader.Win32.Agent.db" Virus. Action Taken: No Action Taken.
File C:\WINNT\n_xpefmw.log infected by "Trojan-Downloader.Win32.Agent.db" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkem.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkhz.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkjb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkkc32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkkv32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkpk32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sdkyg.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysak.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\syshb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysiw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysrr32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addck.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addcq.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addip.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addtq32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\addyd.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apiib32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apilp.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apimt.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apinx32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apitw32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apiuj32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appcz32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appjb.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\apppn32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appqf.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\appzq32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\atlak32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\atldd.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\atlos.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\craf.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crcq.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crez.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crgf32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crnd.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crug32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\crxz.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3if.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3ju32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3os.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3qc32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3rh32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\d3vv.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iean.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ieco.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iehg.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ieic32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ieji.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iejp.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iera32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ievy32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipae32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipak32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipgc.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipld.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\iplm32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ipwh32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\javabk.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\javahv.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\javazn32.dll infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mfcmg32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\msgy32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\msky32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mspr.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mssc.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mstz32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netew.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netme32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netqs.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netuz32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netvb32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netvw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netwg32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netyu32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ntah.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\nths.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\ntrm.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkbb.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkgj32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkou32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkqm.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkqy.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdksh.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sdkyw.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\syseh.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\syshh32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sysmh.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\sysnf32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winam32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\wingt32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winjc.dll infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winlo.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winmf32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winmn.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winmz32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winrb.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\winvr.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\sysus32.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\syszu32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\WINNT\wingz.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\winot.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken.
File C:\WINNT\winys32.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
File C:\xdldr17.exe infected by "TrojanDownloader.Win32.Small.eh" Virus. Action Taken: No Action Taken.
Post #30 last edited
OK, let's clean you up a bit. Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it.

Start Killbox and click on Tools->Delete Temp Files.

When that finishes, copy and paste each of the following lines one by one into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\Documents and Settings\accounting\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.jar-2a572d57-22e0e0a8.zip

C:\Documents and Settings\accounting\Local Settings\Temp\CF.tmp
C:\Documents and Settings\management\Local Settings\Temp\xwxload.exe

C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\0TAZCL2B\gallery[1].htm

C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\816P6HU9\CA45U305.htm

C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\9OWJLL4H\CA7QXOLH.htm

C:\Documents and Settings\management\Local Settings\Temporary Internet Files\Content.IE5\JZTDDDLM\msits[1].exe

C:\Program Files\Internet Explorer\ugyxclem.exe
C:\Q250204.exe
C:\Q250214.exe
C:\WINNT\addcv.exe.bak
C:\WINNT\addig32.exe
C:\WINNT\apipm32.exe
C:\WINNT\apiwv.exe
C:\WINNT\appdt32.exe
C:\WINNT\appgt.dll
C:\WINNT\appjw32.exe
C:\WINNT\apprz32.dll
C:\WINNT\appsm32.exe
C:\WINNT\appve32.dll
C:\WINNT\atlbe32.exe
C:\WINNT\atlcl32.exe
C:\WINNT\atlea32.dll
C:\WINNT\atlgp32.dll
C:\WINNT\atllc.dll
C:\WINNT\atlmh.exe
C:\WINNT\atlox32.dll
C:\WINNT\atlrs32.dll
C:\WINNT\crfm.exe
C:\WINNT\crhi.dll
C:\WINNT\crlv32.dll
C:\WINNT\crmr.dll
C:\WINNT\crsc32.exe
C:\WINNT\crvm.dll
C:\WINNT\crxb32.dll
C:\WINNT\d3ds32.dll
C:\WINNT\d3ib.dll
C:\WINNT\d3oj32.exe
C:\WINNT\ieah32.dll
C:\WINNT\ieaw.dll
C:\WINNT\iegz.dll
C:\WINNT\ielp32.exe
C:\WINNT\ieri.exe
C:\WINNT\ietm32.exe
C:\WINNT\ievd32.dll
C:\WINNT\ipeh32.dll
C:\WINNT\ippn.dll
C:\WINNT\iprx.exe
C:\WINNT\ipuu.exe
C:\WINNT\ipvl32.dll
C:\WINNT\ipww.dll
C:\WINNT\ipyn32.dll
C:\WINNT\javacb.dll
C:\WINNT\javaml32.dll
C:\WINNT\javaqf32.dll
C:\WINNT\javaqn32.exe
C:\WINNT\javavr32.exe
C:\WINNT\mfcif.exe
C:\WINNT\mfcpt.exe
C:\WINNT\mfcsk.exe
C:\WINNT\mfcwj.exe
C:\WINNT\mfcwo.exe
C:\WINNT\mfcyy32.exe
C:\WINNT\mslv.exe
C:\WINNT\msni32.dll
C:\WINNT\msso.exe
C:\WINNT\n_cazrdf.txt
C:\WINNT\n_gskitm.dat
C:\WINNT\n_xpefmw.log
C:\WINNT\netjb.dll
C:\WINNT\netwa.exe
C:\WINNT\ntac32.dll
C:\WINNT\ntap.dll
C:\WINNT\nthb32.exe
C:\WINNT\ntpw32.dll
C:\WINNT\ntzp.exe
C:\WINNT\sdkem.dll
C:\WINNT\sdkhz.exe
C:\WINNT\sdkjb32.dll
C:\WINNT\sdkkc32.dll
C:\WINNT\sdkkv32.dll
C:\WINNT\sdkpk32.dll
C:\WINNT\sdkyg.dll
C:\WINNT\sysak.dll
C:\WINNT\syshb32.dll
C:\WINNT\sysiw.dll
C:\WINNT\sysrr32.exe
C:\WINNT\system32\addck.dll
C:\WINNT\system32\addcq.dll
C:\WINNT\system32\addip.dll
C:\WINNT\system32\addtq32.dll
C:\WINNT\system32\addyd.dll
C:\WINNT\system32\apiib32.exe
C:\WINNT\system32\apilp.dll
C:\WINNT\system32\apimt.exe
C:\WINNT\system32\apinx32.dll
C:\WINNT\system32\apitw32.dll
C:\WINNT\system32\apiuj32.exe
C:\WINNT\system32\appcz32.exe
C:\WINNT\system32\appjb.exe
C:\WINNT\system32\apppn32.dll
C:\WINNT\system32\appqf.dll
C:\WINNT\system32\appzq32.exe
C:\WINNT\system32\atlak32.exe
C:\WINNT\system32\atldd.exe
C:\WINNT\system32\atlos.dll
C:\WINNT\system32\craf.dll
C:\WINNT\system32\crcq.exe
C:\WINNT\system32\crez.exe
C:\WINNT\system32\crgf32.dll
C:\WINNT\system32\crnd.dll
C:\WINNT\system32\crug32.dll
C:\WINNT\system32\crxz.exe
C:\WINNT\system32\d3if.dll
C:\WINNT\system32\d3ju32.dll
C:\WINNT\system32\d3os.exe
C:\WINNT\system32\d3qc32.exe
C:\WINNT\system32\d3rh32.exe
C:\WINNT\system32\d3vv.dll
C:\WINNT\system32\iean.exe
C:\WINNT\system32\ieco.dll
C:\WINNT\system32\iehg.dll
C:\WINNT\system32\ieic32.dll
C:\WINNT\system32\ieji.dll
C:\WINNT\system32\iejp.exe
C:\WINNT\system32\iera32.exe
C:\WINNT\system32\ievy32.exe
C:\WINNT\system32\ipae32.dll
C:\WINNT\system32\ipak32.exe
C:\WINNT\system32\ipgc.dll
C:\WINNT\system32\ipld.dll
C:\WINNT\system32\iplm32.exe
C:\WINNT\system32\ipwh32.dll
C:\WINNT\system32\javabk.dll
C:\WINNT\system32\javahv.dll
C:\WINNT\system32\javazn32.dll
C:\WINNT\system32\mfcmg32.exe
C:\WINNT\system32\msgy32.exe
C:\WINNT\system32\msky32.exe
C:\WINNT\system32\mspr.dll
C:\WINNT\system32\mssc.dll
C:\WINNT\system32\mstz32.dll
C:\WINNT\system32\netew.dll
C:\WINNT\system32\netme32.dll
C:\WINNT\system32\netqs.exe
C:\WINNT\system32\netuz32.exe
C:\WINNT\system32\netvb32.dll
C:\WINNT\system32\netvw.dll
C:\WINNT\system32\netwg32.exe
C:\WINNT\system32\netyu32.dll
C:\WINNT\system32\ntah.exe
C:\WINNT\system32\nths.dll
C:\WINNT\system32\ntrm.dll
C:\WINNT\system32\sdkbb.exe
C:\WINNT\system32\sdkgj32.dll
C:\WINNT\system32\sdkou32.exe
C:\WINNT\system32\sdkqm.dll
C:\WINNT\system32\sdkqy.exe
C:\WINNT\system32\sdksh.dll
C:\WINNT\system32\sdkyw.dll
C:\WINNT\system32\syseh.exe
C:\WINNT\system32\syshh32.exe
C:\WINNT\system32\sysmh.dll
C:\WINNT\system32\sysnf32.dll
C:\WINNT\system32\winam32.exe
C:\WINNT\system32\wingt32.dll
C:\WINNT\system32\winjc.dll
C:\WINNT\system32\winlo.exe
C:\WINNT\system32\winmf32.exe
C:\WINNT\system32\winmn.dll
C:\WINNT\system32\winmz32.exe
C:\WINNT\system32\winrb.exe
C:\WINNT\system32\winvr.exe
C:\WINNT\sysus32.dll
C:\WINNT\syszu32.exe
C:\WINNT\wingz.dll
C:\WINNT\winot.dll
C:\WINNT\winys32.exe
C:\xdldr17.exe

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

When it reboots, with only HJT running, have it fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pphwc.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\fupnq.dll/sp.html#37794
O4 - HKLM\..\Run: [mfcpt.exe] C:\WINNT\mfcpt.exe
O4 - HKLM\..\RunOnce: [dxcyx] C:\WINNT\Active Setup Log.BAK:dxcyx

Using Windows Explorer, navigate to the !Submit folder on the C:\ drive and delete it. Please post a new HJT log and mwavscan log again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI