eddiehinton
say, isn't there a way to take a picture of this dayam thing? like i open it so i can see it on the scrren and then i can freeze the image on the screen and post it here?
Spyware / Malware / Virus Removal
hijackthis log
19 min read
LDTate
Let's try this:
Download and unzip http://metallica.geekstogo.com/MADEbyOSC.zip
You'll need to unzip it.
Run the file by doubleclicking metallica.bat
and post the log.
Do not reboot untill someone has looked at your log and given you the next step.
If you have to reboot repeat this part when you are back online.
Download and unzip http://metallica.geekstogo.com/MADEbyOSC.zip
You'll need to unzip it.
Run the file by doubleclicking metallica.bat
and post the log.
Do not reboot untill someone has looked at your log and given you the next step.
If you have to reboot repeat this part when you are back online.
eddiehinton
here goes the log:
************************************
**These are the hidden files found**
************************************
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 54F0-5E1E
Directory di C:\DOCUME~1\PROPRI~1\IMPOST~1\Temp
************************************
**These are the system files found**
************************************
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 54F0-5E1E
Directory di C:\DOCUME~1\PROPRI~1\IMPOST~1\Temp
Il volume nell'unit… C non ha etichetta. meand "the volume in C has no label" - whatever THAT means!
LDTate
Nope..nothing there.
Download Silentrunners.zip from HERE, to a new folder on your desktop.
Run the SilentRunners.vbs file. If your antivirus has a script blocker, you will get a warning asking if you want to allow SilentRunners.vbs to run. It might say something like Malicious Script Warning. This script is not malicious so you are safe in allowing it to run.
When it has finished it will produce a Startup Programs log. Copy and paste that log here.
Download Silentrunners.zip from HERE, to a new folder on your desktop.
Run the SilentRunners.vbs file. If your antivirus has a script blocker, you will get a warning asking if you want to allow SilentRunners.vbs to run. It might say something like Malicious Script Warning. This script is not malicious so you are safe in allowing it to run.
When it has finished it will produce a Startup Programs log. Copy and paste that log here.
eddiehinton
"Silent Runners.vbs", revision 37, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
———————————
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Creative Detector" = "C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"]
"Window Washer" = "C:\Programmi\Webroot\Washer\wwDisp.exe" ["Webroot Software"]
"Creative MediaSource Go" = "C:\Programmi\Creative\MediaSource\Go\CTCMSGo.exe /SCB" ["Creative Technology Ltd"]
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Index Washer" = "C:\Programmi\Webroot\Washer\WashIdx.exe "Proprietario"" [null data]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"KYE_Showicon" = ""C:\Programmi\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"" ["MyComp"]
"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"CTSysVol" = "C:\Programmi\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"]
"CTDVDDET" = "C:\Programmi\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" ["Creative Technology Ltd"]
"SBDrvDet" = "C:\Programmi\Creative\SB Drive Det\SBDrvDet.exe /r" ["Creative Technology Ltd"]
"SmcService" = "C:\PROGRA~1\Sygate\SPF\smc.exe -startgui" ["Sygate Technologies, Inc."]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"]
"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]
"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]
"zBrowser Launcher" = "C:\Programmi\Logitech\iTouch\iTouch.exe" ["Logitech Inc."]
"AdslTaskBar" = "rundll32.exe stmctrl.dll,TaskBar" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Index Washer" = "C:\Programmi\Webroot\Washer\WashIdx.exe "Proprietario"" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\SpywareGuard\dlprotect.dll" [null data]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{6EE51AA0-77A0-11D7-B4E1-000347126E46}" = "Window Washer Shell Shredding Utility"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\FILECO~1\WEBROO~1\SHELLW~1.DLL" ["Webroot Software"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\Real\RealOne Player\rpshellext.dll" ["RealNetworks"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\SpywareGuard\spywareguard.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\TuneUp Utilities 2004\sdshelex.dll"" ["TuneUp Software GmbH"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\SpywareGuard\spywareguard.dll" [null data]
INFECTION WARNING! "{93994DE8-8239-4655-B1D1-5F4E91300429}" = "DVDIdleShell Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\DVDIDL~1\DVDShell.dll" ["Fengtao Software"]
HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "smrgdf C:\Programmi\iolo\System Mechanic 5\" [null data], [file not found], [file not found], [file not found]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]
Enabled Active Desktop and Wallpaper:
————————————-
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Proprietario\Dati applicazioni\Microsoft\Internet Explorer\Sfondo Internet Explorer.bmp"
Startup items in "Proprietario" & "All Users" startup folders:
————————————————————–
C:\Documents and Settings\Proprietario\Menu Avvio\Programmi\Esecuzione automatica
"SpywareGuard" -> shortcut to: "C:\Programmi\SpywareGuard\sgmain.exe" [null data]
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
"Logitech SetPoint" -> shortcut to: "C:\Programmi\Logitech\SetPoint\KEM.exe" ["Logitech Inc."]
Enabled Scheduled Tasks:
————————
"1-Click Maintenance" -> launches: "C:\Programmi\TuneUp Utilities 2004\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]
Winsock2 Service Provider DLLs:
——————————-
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
————————————
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\msjava.dll" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
——————————————————————
avast! Antivirus, avast! Antivirus, "C:\Programmi\Alwil Software\Avast4\ashServ.exe" [null data]
avast! iAVS4 Control Service, aswUpdSv, "C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\System32\CTsvcCDA.exe" ["Creative Technology Ltd"]
Machine Debug Manager, MDM, ""C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Sygate Personal Firewall Pro, SmcService, "C:\Programmi\Sygate\SPF\smc.exe" ["Sygate Technologies, Inc."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\System32\MsPMSPSv.exe" [MS]
———-
This report excludes default entries except where indicated.
To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
———-
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
———————————
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Creative Detector" = "C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"]
"Window Washer" = "C:\Programmi\Webroot\Washer\wwDisp.exe" ["Webroot Software"]
"Creative MediaSource Go" = "C:\Programmi\Creative\MediaSource\Go\CTCMSGo.exe /SCB" ["Creative Technology Ltd"]
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Index Washer" = "C:\Programmi\Webroot\Washer\WashIdx.exe "Proprietario"" [null data]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"KYE_Showicon" = ""C:\Programmi\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"" ["MyComp"]
"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"CTSysVol" = "C:\Programmi\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"]
"CTDVDDET" = "C:\Programmi\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" ["Creative Technology Ltd"]
"SBDrvDet" = "C:\Programmi\Creative\SB Drive Det\SBDrvDet.exe /r" ["Creative Technology Ltd"]
"SmcService" = "C:\PROGRA~1\Sygate\SPF\smc.exe -startgui" ["Sygate Technologies, Inc."]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"]
"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]
"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]
"zBrowser Launcher" = "C:\Programmi\Logitech\iTouch\iTouch.exe" ["Logitech Inc."]
"AdslTaskBar" = "rundll32.exe stmctrl.dll,TaskBar" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Index Washer" = "C:\Programmi\Webroot\Washer\WashIdx.exe "Proprietario"" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\SpywareGuard\dlprotect.dll" [null data]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{6EE51AA0-77A0-11D7-B4E1-000347126E46}" = "Window Washer Shell Shredding Utility"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\FILECO~1\WEBROO~1\SHELLW~1.DLL" ["Webroot Software"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\Real\RealOne Player\rpshellext.dll" ["RealNetworks"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\SpywareGuard\spywareguard.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\OpenOffice.org 1.9.79\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
-> {CLSID}\InProcServer32\(Default) = ""C:\Programmi\TuneUp Utilities 2004\sdshelex.dll"" ["TuneUp Software GmbH"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard"
-> {CLSID}\InProcServer32\(Default) = "C:\Programmi\SpywareGuard\spywareguard.dll" [null data]
INFECTION WARNING! "{93994DE8-8239-4655-B1D1-5F4E91300429}" = "DVDIdleShell Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\DVDIDL~1\DVDShell.dll" ["Fengtao Software"]
HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "smrgdf C:\Programmi\iolo\System Mechanic 5\" [null data], [file not found], [file not found], [file not found]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]
Enabled Active Desktop and Wallpaper:
————————————-
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Proprietario\Dati applicazioni\Microsoft\Internet Explorer\Sfondo Internet Explorer.bmp"
Startup items in "Proprietario" & "All Users" startup folders:
————————————————————–
C:\Documents and Settings\Proprietario\Menu Avvio\Programmi\Esecuzione automatica
"SpywareGuard" -> shortcut to: "C:\Programmi\SpywareGuard\sgmain.exe" [null data]
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
"Logitech SetPoint" -> shortcut to: "C:\Programmi\Logitech\SetPoint\KEM.exe" ["Logitech Inc."]
Enabled Scheduled Tasks:
————————
"1-Click Maintenance" -> launches: "C:\Programmi\TuneUp Utilities 2004\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]
Winsock2 Service Provider DLLs:
——————————-
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
————————————
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\msjava.dll" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
——————————————————————
avast! Antivirus, avast! Antivirus, "C:\Programmi\Alwil Software\Avast4\ashServ.exe" [null data]
avast! iAVS4 Control Service, aswUpdSv, "C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\System32\CTsvcCDA.exe" ["Creative Technology Ltd"]
Machine Debug Manager, MDM, ""C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Sygate Personal Firewall Pro, SmcService, "C:\Programmi\Sygate\SPF\smc.exe" ["Sygate Technologies, Inc."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\System32\MsPMSPSv.exe" [MS]
———-
This report excludes default entries except where indicated.
To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
———-
LDTate
Then download this program.
http://downloads.subratam.org/DllCompare.exe
Open the program and click the "Run Locate.com" button.
Then click the "Compare" button (this will take a few minutes)
When it finishes click the "Make Log…." button.
Post the dll compare log to this thread.
http://downloads.subratam.org/DllCompare.exe
Open the program and click the "Run Locate.com" button.
Then click the "Compare" button (this will take a few minutes)
When it finishes click the "Make Log…." button.
Post the dll compare log to this thread.
eddiehinton
* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________
O^E says: "There were no files found 
"
________________________________________________
1.503 items found: 1.503 files, 0 directories.
Total of file sizes: 337.157.398 bytes 321,54 M
Administrator Account = True
——————–End log———————
"
________________________________________________
1.503 items found: 1.503 files, 0 directories.
Total of file sizes: 337.157.398 bytes 321,54 M
Administrator Account = True
——————–End log———————
LDTate
Is this one still unchecked in Startup?
click Start> Run> type in Msconfig tap enter key.
look in the Startup.
rundll32 — rundll32.exe smctrl.dll, TaskBar
click Start> Run> type in Msconfig tap enter key.
look in the Startup.
rundll32 — rundll32.exe smctrl.dll, TaskBar
eddiehinton
no, it's checked.
LDTate
Do a search for it and rename it.
smctrl.dll
when found, right click on it and select rename. Rename it to smctrl.old
Then uncheck it.
click Start> Run> type in Msconfig tap enter key.
look in the Startup.
rundll32 — rundll32.exe smctrl.dll, TaskBar
Reboot.
smctrl.dll
when found, right click on it and select rename. Rename it to smctrl.old
Then uncheck it.
click Start> Run> type in Msconfig tap enter key.
look in the Startup.
rundll32 — rundll32.exe smctrl.dll, TaskBar
Reboot.
eddiehinton
regedit won't find it
LDTate
Not using regedit. Windows search
click Start> Search> Files and folders
eddiehinton
tried TWICE, nothing!
LDTate
did you uncheck it.
click Start> Run> type in Msconfig tap enter key.
look in the Startup.
rundll32 — rundll32.exe smctrl.dll, TaskBar
eddiehinton
no but wait, it's not smctrl.dll, but stmctrl.dll
checkin' again
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI