time
Topic Starter
Logfile of HijackThis v1.99.1
Scan saved at 5:23:43 PM, on
9/28/2005
Platform: Windows XP SP2 (WinNT
5.01.2600)
MSIE: Internet Explorer v6.00 SP2
(6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program
Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsv
r.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsv
c.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\System32\inetsrv\inetinfo
.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\mqtgsvc.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\MSN
Messenger\msnmsgr.exe
C:\Program Files\Spyware
Doctor\swdoctor.exe
C:\Program Files\CallWave\IAM.exe
C:\WINDOWS\system32\wuauclt.exe
D:\MoonDragon05\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B
3} - C:\Program Files\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard -
{5C8B2A36-3DB1-42A4-A3CB-D426709BBFE
B} -
C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dl
l
O2 - BHO: MSEvents Object -
{6DD0BC06-4719-4BA3-BEBC-FBAE6A44815
2} - C:\WINDOWS\system32\vturo.dll
O2 - BHO: PCTools Browser Monitor -
{B56A7D7D-6927-48C8-A975-17DF180C71A
C} -
C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dl
l
O4 - HKLM\..\Run: [SoundMan]
SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG]
C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [AGRSMMSG]
AGRSMMSG.exe
O4 - HKLM\..\Run: [msnappau]
"C:\Program Files\MSN
Apps\Updater\01.03.0000.1005\en-us\m
snappau.exe"
O4 - HKLM\..\Run: [InCD] C:\Program
Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Program Files\QuickTime
6\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr]
"C:\Program Files\MSN
Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor]
"C:\Program Files\Spyware
Doctor\swdoctor.exe" /Q
O4 - Global Startup: Internet
Answering Machine.lnk = C:\Program
Files\CallWave\IAM.exe
O9 - Extra button: Yahoo! Login -
{2499216C-4BA5-11D5-BD9C-000103C116D
5} - C:\Program
Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo!
Login -
{2499216C-4BA5-11D5-BD9C-000103C116D
5} - C:\Program
Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Spyware Doctor -
{2D663D1A-8670-49D9-A1A5-4C56B4E14E8
4} -
C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dl
l
O9 - Extra button: Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0A
D} - C:\Program
Files\Yahoo!\Messenger\yhexbmes0521.
dll
O9 - Extra 'Tools' menuitem: Yahoo!
Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0A
D} - C:\Program
Files\Yahoo!\Messenger\yhexbmes0521.
dll
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F79568
3} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows
Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F79568
3} - C:\Program
Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.cybertown.com
O16 - DPF:
{04E214E5-63AF-4236-83C6-A7ADCBF9BD0
2} (HouseCall Control) -
http://housecall60.trendmicro.com/ho
usecall/xscan60.cab
O16 - DPF:
{231B1C6E-F934-42A2-92B6-C2FEFEC2427
6} (yucsetreg Class) - C:\Program
Files\Yahoo!\common\yucconfig.dll
O16 - DPF:
{30528230-99f7-4bb4-88d8-fa1d4f56a2a
b} (YInstStarter Class) - C:\Program
Files\Yahoo!\common\yinsthelper.dll
O16 - DPF:
{6414512B-B978-451D-A0D8-FCFDF33E833
C} (WUWebControl Class) -
http://v5.windowsupdate.microsoft.co
m/v5consumer/V5Controls/en/x86/clien
t/wuweb_site.cab?1107236204467
O16 - DPF:
{644E432F-49D3-41A1-8DD5-E099162EEEC
5} (Symantec RuFSI Utility Class) -
http://security.symantec.com/sscv6/S
haredContent/common/bin/cabsa.cab
O16 - DPF:
{D18F962A-3722-4B59-B08D-28BB9EB2281
E} (PhotosCtrl Class) -
http://photos.yahoo.com/ocx/us/yexpl
orer1_9us.cab
O16 - DPF:
{F58E1CEF-A068-4C15-BA5E-587CAF3EE8C
6} (MSN Chat Control 4.5) -
http://chat.msn.com/controls/msnchat
45.cab
O20 - Winlogon Notify: vturo -
C:\WINDOWS\system32\vturo.dll
O23 - Service: AVG7 Alert Manager
Server (Avg7Alrt) - GRISOFT, s.r.o.
-
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsv
r.exe
O23 - Service: AVG7 Update Service
(Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsv
c.exe
O23 - Service: Fix-It Task Manager -
V Communications, Inc. -
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
O23 - Service: InCD Helper (InCDsrv)
- Nero AG - C:\Program
Files\Ahead\InCD\InCDsrv.exe
O23 - Service: TuneUp WinStyler
Theme Service (TUWinStylerThemeSvc)
- TuneUp Software GmbH - C:\Program
Files\TuneUp Utilities
2004\WinStylerThemeSvc.exe
O23 - Service: YPCService - Yahoo!
Inc. -
C:\WINDOWS\system32\YPCSER~1.EXE
I have deleted R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = and tryed to delete O20 - Winlogon Notify: vturo - C:\WINDOWS\system32\vturo.dll it keeps coming back . I have allways had this in trusted site ,it is a 3d game i play (O15 - Trusted Zone: *.cybertown.com) can stuff come thur here to cause me trouble? Thank You for your Help and Your Time
Scan saved at 5:23:43 PM, on
9/28/2005
Platform: Windows XP SP2 (WinNT
5.01.2600)
MSIE: Internet Explorer v6.00 SP2
(6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program
Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsv
r.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsv
c.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\System32\inetsrv\inetinfo
.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\mqtgsvc.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\MSN
Messenger\msnmsgr.exe
C:\Program Files\Spyware
Doctor\swdoctor.exe
C:\Program Files\CallWave\IAM.exe
C:\WINDOWS\system32\wuauclt.exe
D:\MoonDragon05\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B
3} - C:\Program Files\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard -
{5C8B2A36-3DB1-42A4-A3CB-D426709BBFE
B} -
C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dl
l
O2 - BHO: MSEvents Object -
{6DD0BC06-4719-4BA3-BEBC-FBAE6A44815
2} - C:\WINDOWS\system32\vturo.dll
O2 - BHO: PCTools Browser Monitor -
{B56A7D7D-6927-48C8-A975-17DF180C71A
C} -
C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dl
l
O4 - HKLM\..\Run: [SoundMan]
SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG]
C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [AGRSMMSG]
AGRSMMSG.exe
O4 - HKLM\..\Run: [msnappau]
"C:\Program Files\MSN
Apps\Updater\01.03.0000.1005\en-us\m
snappau.exe"
O4 - HKLM\..\Run: [InCD] C:\Program
Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Program Files\QuickTime
6\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr]
"C:\Program Files\MSN
Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor]
"C:\Program Files\Spyware
Doctor\swdoctor.exe" /Q
O4 - Global Startup: Internet
Answering Machine.lnk = C:\Program
Files\CallWave\IAM.exe
O9 - Extra button: Yahoo! Login -
{2499216C-4BA5-11D5-BD9C-000103C116D
5} - C:\Program
Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo!
Login -
{2499216C-4BA5-11D5-BD9C-000103C116D
5} - C:\Program
Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Spyware Doctor -
{2D663D1A-8670-49D9-A1A5-4C56B4E14E8
4} -
C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dl
l
O9 - Extra button: Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0A
D} - C:\Program
Files\Yahoo!\Messenger\yhexbmes0521.
dll
O9 - Extra 'Tools' menuitem: Yahoo!
Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0A
D} - C:\Program
Files\Yahoo!\Messenger\yhexbmes0521.
dll
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F79568
3} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows
Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F79568
3} - C:\Program
Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.cybertown.com
O16 - DPF:
{04E214E5-63AF-4236-83C6-A7ADCBF9BD0
2} (HouseCall Control) -
http://housecall60.trendmicro.com/ho
usecall/xscan60.cab
O16 - DPF:
{231B1C6E-F934-42A2-92B6-C2FEFEC2427
6} (yucsetreg Class) - C:\Program
Files\Yahoo!\common\yucconfig.dll
O16 - DPF:
{30528230-99f7-4bb4-88d8-fa1d4f56a2a
b} (YInstStarter Class) - C:\Program
Files\Yahoo!\common\yinsthelper.dll
O16 - DPF:
{6414512B-B978-451D-A0D8-FCFDF33E833
C} (WUWebControl Class) -
http://v5.windowsupdate.microsoft.co
m/v5consumer/V5Controls/en/x86/clien
t/wuweb_site.cab?1107236204467
O16 - DPF:
{644E432F-49D3-41A1-8DD5-E099162EEEC
5} (Symantec RuFSI Utility Class) -
http://security.symantec.com/sscv6/S
haredContent/common/bin/cabsa.cab
O16 - DPF:
{D18F962A-3722-4B59-B08D-28BB9EB2281
E} (PhotosCtrl Class) -
http://photos.yahoo.com/ocx/us/yexpl
orer1_9us.cab
O16 - DPF:
{F58E1CEF-A068-4C15-BA5E-587CAF3EE8C
6} (MSN Chat Control 4.5) -
http://chat.msn.com/controls/msnchat
45.cab
O20 - Winlogon Notify: vturo -
C:\WINDOWS\system32\vturo.dll
O23 - Service: AVG7 Alert Manager
Server (Avg7Alrt) - GRISOFT, s.r.o.
-
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsv
r.exe
O23 - Service: AVG7 Update Service
(Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsv
c.exe
O23 - Service: Fix-It Task Manager -
V Communications, Inc. -
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
O23 - Service: InCD Helper (InCDsrv)
- Nero AG - C:\Program
Files\Ahead\InCD\InCDsrv.exe
O23 - Service: TuneUp WinStyler
Theme Service (TUWinStylerThemeSvc)
- TuneUp Software GmbH - C:\Program
Files\TuneUp Utilities
2004\WinStylerThemeSvc.exe
O23 - Service: YPCService - Yahoo!
Inc. -
C:\WINDOWS\system32\YPCSER~1.EXE
I have deleted R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = and tryed to delete O20 - Winlogon Notify: vturo - C:\WINDOWS\system32\vturo.dll it keeps coming back . I have allways had this in trusted site ,it is a 3d game i play (O15 - Trusted Zone: *.cybertown.com) can stuff come thur here to cause me trouble? Thank You for your Help and Your Time
