What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

UnspyPC

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

I read some previous post here regrarding UNspyPC. I tried to follow the instructions given to that poster.

I downloaded Ewido and ran in safe mode.

Then downloaded FixWareout and ran that. It gave me the following log and instructions to post them here.

I look forward to your comments and thanks in advance. Here is the log:

Logfile of HijackThis v1.97.7
Scan saved at 10:37:17 PM, on 12/29/05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\fixwareout\SUB\BFU.exe
D:\PROGRA~1\avg\avgamsvr.exe
D:\PROGRA~1\avg\avgupsvc.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\HyJack This\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adb…/search/ie.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.171.41.30:6588
R3 - URLSearchHook: (no name) - {6C715290-9B75-6990-AE53-088DD6FC2AD9} - backorif.dll (file missing)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Iomega Startup Options] d:\program files\iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] d:\program files\iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB002" /M "Stylus CX6400"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\avg\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\avg\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [sbin] prcmon.exe
O4 - HKLM\..\Run: [vxdman] powerdll.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [dmjsq.exe] C:\WINDOWS\system32\dmjsq.exe
O4 - HKLM\..\Run: [00ERSRRRNKY] D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MONITER] TemplateDongle.exe
O4 - HKCU\..\Run: [scanSYS] new32.exe
O4 - HKCU\..\Run: [CToolBar] sysconf16.exe
O4 - HKLM\..\RunOnce: [MRUBlaster] D:\Program Files\MRU Blaster\MRU-Blaster\indexcleaner.exe -CC
O4 - HKLM\..\RunOnce: [00ERSRRRNKY] "D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe" remove
O4 - Startup: MRU-Blaster Silent Clean.lnk = D:\Program Files\MRU Blaster\MRU-Blaster\mrublaster.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Travelaxe (HKLM)
O9 - Extra button: ProxyPal (HKLM)
O9 - Extra 'Tools' menuitem: ProxyPal (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: DigiChat Applet - http://host16.digichat.com/DigiChat/DigiCl…s/Client_IE.cab
O16 - DPF: hrmultiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/hrmult…herrycasino.cab
O16 - DPF: multiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/multib…herrycasino.cab
O16 - DPF: multiboxbj_en_speedbet_xp - http://www.speedbet.com/classes/multiboxbj_en_speedbet.cab
O16 - DPF: piratesslot_en_cherrycasino_xp - http://www.cherrycasino.com/classes/pirate…herrycasino.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://www.powerleap.com/downloads/cpuid.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control) - http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) - http://racing.youbet.com/wr_5_5/controls/ybrequest.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8276E2C6-1F6B-4C6D-8517-7CA89254C666} (Iris Available Tables Control) - https://secure.casinowebcam.com/welcome/LiveCasino.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) - http://www.microsoft.com/security/controls/DoomCln.CAB
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/ve…n7/dlhelper.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/531/webolr/OCX/FlashAX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3492752D-FBAE-4771-936F-EDA023E5834D}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{66146681-D92F-4BCE-A557-17553BBA2FD4}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D233530-DBCC-4595-8392-B68A5C26254A}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{8963DA92-4DF4-495D-988B-E47A87F5E4A8}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{C08AF5A1-E0F6-4241-B2C4-1490239D6F1C}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0CBFE9-4636-4886-9E37-A7E61D6ACDBB}: NameServer = 85.255.114.45,85.255.112.105

Thnx again,
MrickDude
Post #3


Then post a new log.


Thanks Siggyx, Here it is:

Logfile of HijackThis v1.97.7
Scan saved at 12:08:31 AM, on 01/07/06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\avg\avgamsvr.exe
D:\PROGRA~1\avg\avgupsvc.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\program files\iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
D:\PROGRA~1\avg\avgcc.exe
D:\PROGRA~1\avg\avgemc.exe
d:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\alg.exe
D:\Program Files\HyJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adb…/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/William%20Peeples/Desktop/other%20stuff/HomePage/homepage.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.171.41.30:6588
R3 - URLSearchHook: (no name) - {6C715290-9B75-6990-AE53-088DD6FC2AD9} - backorif.dll (file missing)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Iomega Startup Options] d:\program files\iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] d:\program files\iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB002" /M "Stylus CX6400"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\avg\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\avg\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dmhcb.exe] C:\WINDOWS\system32\dmhcb.exe
O4 - HKLM\..\Run: [00ERSRRRNKY] D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKLM\..\RunOnce: [MRUBlaster] D:\Program Files\MRU Blaster\MRU-Blaster\indexcleaner.exe -CC
O4 - HKLM\..\RunOnce: [00ERSRRRNKY] "D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe" remove
O4 - Startup: MRU-Blaster Silent Clean.lnk = D:\Program Files\MRU Blaster\MRU-Blaster\mrublaster.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Travelaxe (HKLM)
O9 - Extra button: ProxyPal (HKLM)
O9 - Extra 'Tools' menuitem: ProxyPal (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: DigiChat Applet - http://host16.digichat.com/DigiChat/DigiCl…s/Client_IE.cab
O16 - DPF: hrmultiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/hrmult…herrycasino.cab
O16 - DPF: multiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/multib…herrycasino.cab
O16 - DPF: multiboxbj_en_speedbet_xp - http://www.speedbet.com/classes/multiboxbj_en_speedbet.cab
O16 - DPF: piratesslot_en_cherrycasino_xp - http://www.cherrycasino.com/classes/pirate…herrycasino.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://www.powerleap.com/downloads/cpuid.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control) - http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) - http://racing.youbet.com/wr_5_5/controls/ybrequest.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8276E2C6-1F6B-4C6D-8517-7CA89254C666} (Iris Available Tables Control) - https://secure.casinowebcam.com/welcome/LiveCasino.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) - http://www.microsoft.com/security/controls/DoomCln.CAB
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/ve…n7/dlhelper.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://register3.valueactive.com/531/webolr/OCX/FlashAX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3492752D-FBAE-4771-936F-EDA023E5834D}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{66146681-D92F-4BCE-A557-17553BBA2FD4}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D233530-DBCC-4595-8392-B68A5C26254A}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{8963DA92-4DF4-495D-988B-E47A87F5E4A8}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{C08AF5A1-E0F6-4241-B2C4-1490239D6F1C}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0CBFE9-4636-4886-9E37-A7E61D6ACDBB}: NameServer = 85.255.114.45,85.255.112.105
Post #5

That is still the old version 1.97.7

The new version is 1.99.1

Completely delete hijackthis and download the nextest version


Not sure what happened. Here it is. Says 1.99 - Thanks for your patience.

Logfile of HijackThis v1.99.1
Scan saved at 1:04:02 AM, on 01/07/06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\avg\avgamsvr.exe
D:\PROGRA~1\avg\avgupsvc.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\program files\iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
D:\PROGRA~1\avg\avgcc.exe
D:\PROGRA~1\avg\avgemc.exe
d:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\My Documents\My Downloads\hyjack this\new version 01-07-06\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adb…/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/William%20Peeples/Desktop/other%20stuff/HomePage/homepage.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.171.41.30:6588
R3 - URLSearchHook: (no name) - {6C715290-9B75-6990-AE53-088DD6FC2AD9} - backorif.dll (file missing)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Iomega Startup Options] d:\program files\iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] d:\program files\iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB002" /M "Stylus CX6400"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\avg\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\avg\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dmhcb.exe] C:\WINDOWS\system32\dmhcb.exe
O4 - HKLM\..\Run: [00ERSRRRNKY] D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
O4 - HKLM\..\RunOnce: [MRUBlaster] D:\Program Files\MRU Blaster\MRU-Blaster\indexcleaner.exe -CC
O4 - HKLM\..\RunOnce: [00ERSRRRNKY] "D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe" remove
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: MRU-Blaster Silent Clean.lnk = D:\Program Files\MRU Blaster\MRU-Blaster\mrublaster.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Travelaxe - {32A32D38-B8ED-4b3f-AFD0-EF23B697B5C1} - D:\Program Files\Travelaxe.exe
O9 - Extra button: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe
O9 - Extra 'Tools' menuitem: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: DigiChat Applet - http://host16.digichat.com/DigiChat/DigiCl…s/Client_IE.cab
O16 - DPF: hrmultiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/hrmult…herrycasino.cab
O16 - DPF: multiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/multib…herrycasino.cab
O16 - DPF: multiboxbj_en_speedbet_xp - http://www.speedbet.com/classes/multiboxbj_en_speedbet.cab
O16 - DPF: piratesslot_en_cherrycasino_xp - http://www.cherrycasino.com/classes/pirate…herrycasino.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://www.powerleap.com/downloads/cpuid.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control) - http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) - http://racing.youbet.com/wr_5_5/controls/ybrequest.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8276E2C6-1F6B-4C6D-8517-7CA89254C666} (Iris Available Tables Control) - https://secure.casinowebcam.com/welcome/LiveCasino.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/ve…n7/dlhelper.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://register3.valueactive.com/531/webolr/OCX/FlashAX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3492752D-FBAE-4771-936F-EDA023E5834D}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{66146681-D92F-4BCE-A557-17553BBA2FD4}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D233530-DBCC-4595-8392-B68A5C26254A}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{8963DA92-4DF4-495D-988B-E47A87F5E4A8}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{C08AF5A1-E0F6-4241-B2C4-1490239D6F1C}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0CBFE9-4636-4886-9E37-A7E61D6ACDBB}: NameServer = 85.255.114.45,85.255.112.105
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\avg\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\avg\avgupsvc.exe
O23 - Service: Eraser Service (EraserThread) - Unknown owner - D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner - C:\WINDOWS\system32\vmnat.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\System32\ZipToA.exe
Post #6
Have also ran CW Shredder. AdAware SE, Spyware Blaster and Spybot. Spybot S&D is showing Pipas.A and it seems to come back after every fix. Running Trend Micro now. Just wanted to update the thread so you would have current info. Thnx, mrickdude
Post #7
Trend Micro says there are vulnerbilites that have to be manually deleted and to click "OK" for list. I click "OK" but get no list. I did this twice. I had HyJack this fix the following that was on my log: 04 - HKLM\..\Run: [dmhcb.exe] C:\WINDOWS\system32\dmhcb.exe I think this may be part of my problem. From googling the net, I can't find much on dmhcb.exe but I did find one post that indicated dmh**.exe was related to the trojan Pipas.a. I have turned off system restore till I get this done. Just an update for you. Awaiting your instruction for futher procedures. I am still being redirected on google searches. I test it by googling "sex" and then clicking a link. Seems it loves to redirect to porn. Thanks, mrickdude
Post #8
Follow-up. Looks like I should have rebooted before trying to test with Google. Ran another Hijack This scan and the same line was back - but the letters after "Dm " had changed. Fixed it again. Then rebooted. Googled "sex". Click a few links to safe websites like Playboy. Got no re-directs. Maybe cured. Still would like your input on anything else to delete or any other process to run. Thanks, mrickdude
Post #10

New hijackthis log please.


Here is my new log:

Logfile of HijackThis v1.99.1
Scan saved at 4:12:59 PM, on 01/07/06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\avg\avgamsvr.exe
D:\PROGRA~1\avg\avgupsvc.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\program files\iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
D:\PROGRA~1\avg\avgcc.exe
D:\PROGRA~1\avg\avgemc.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
d:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\My Documents\My Downloads\hyjack this\new version 01-07-06\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adb…/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/William%20Peeples/Desktop/other%20stuff/HomePage/homepage.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.171.41.30:6588
R3 - URLSearchHook: (no name) - {6C715290-9B75-6990-AE53-088DD6FC2AD9} - backorif.dll (file missing)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Iomega Startup Options] d:\program files\iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] d:\program files\iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB002" /M "Stylus CX6400"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\avg\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\avg\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [00ERSRRRNKY] D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
O4 - HKLM\..\RunOnce: [MRUBlaster] D:\Program Files\MRU Blaster\MRU-Blaster\indexcleaner.exe -CC
O4 - HKLM\..\RunOnce: [00ERSRRRNKY] "D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe" remove
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: MRU-Blaster Silent Clean.lnk = D:\Program Files\MRU Blaster\MRU-Blaster\mrublaster.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Travelaxe - {32A32D38-B8ED-4b3f-AFD0-EF23B697B5C1} - D:\Program Files\Travelaxe.exe
O9 - Extra button: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe
O9 - Extra 'Tools' menuitem: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: DigiChat Applet - http://host16.digichat.com/DigiChat/DigiCl…s/Client_IE.cab
O16 - DPF: hrmultiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/hrmult…herrycasino.cab
O16 - DPF: multiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/multib…herrycasino.cab
O16 - DPF: multiboxbj_en_speedbet_xp - http://www.speedbet.com/classes/multiboxbj_en_speedbet.cab
O16 - DPF: piratesslot_en_cherrycasino_xp - http://www.cherrycasino.com/classes/pirate…herrycasino.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://www.powerleap.com/downloads/cpuid.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control) - http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) - http://racing.youbet.com/wr_5_5/controls/ybrequest.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8276E2C6-1F6B-4C6D-8517-7CA89254C666} (Iris Available Tables Control) - https://secure.casinowebcam.com/welcome/LiveCasino.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/ve…n7/dlhelper.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://register3.valueactive.com/531/webolr/OCX/FlashAX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3492752D-FBAE-4771-936F-EDA023E5834D}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{66146681-D92F-4BCE-A557-17553BBA2FD4}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D233530-DBCC-4595-8392-B68A5C26254A}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{8963DA92-4DF4-495D-988B-E47A87F5E4A8}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{C08AF5A1-E0F6-4241-B2C4-1490239D6F1C}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0CBFE9-4636-4886-9E37-A7E61D6ACDBB}: NameServer = 85.255.114.45,85.255.112.105
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\avg\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\avg\avgupsvc.exe
O23 - Service: Eraser Service (EraserThread) - Unknown owner - D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner - C:\WINDOWS\system32\vmnat.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\System32\ZipToA.exe
Post #11
You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download FixWareout from one of these sites:
http://forums.subratam.org/index.php?act=A…e=post&id=43811
http://swandog46.geekstogo.com/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/William%20Peeples/Desktop/other%20stuff/HomePage/homepage.htm

R3 - URLSearchHook: (no name) - {6C715290-9B75-6990-AE53-088DD6FC2AD9} - backorif.dll (file missing)

O16 - DPF: hrmultiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/hrmult…herrycasino.cab
O16 - DPF: multiboxbj_en_cherrycasino_xp - http://www.cherrycasino.com/classes/multib…herrycasino.cab
O16 - DPF: multiboxbj_en_speedbet_xp - http://www.speedbet.com/classes/multiboxbj_en_speedbet.cab
O16 - DPF: piratesslot_en_cherrycasino_xp - http://www.cherrycasino.com/classes/pirate…herrycasino.cab

O16 - DPF: {8276E2C6-1F6B-4C6D-8517-7CA89254C666} (Iris Available Tables Control) - https://secure.casinowebcam.com/welcome/LiveCasino.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{3492752D-FBAE-4771-936F-EDA023E5834D}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{66146681-D92F-4BCE-A557-17553BBA2FD4}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D233530-DBCC-4595-8392-B68A5C26254A}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{8963DA92-4DF4-495D-988B-E47A87F5E4A8}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{C08AF5A1-E0F6-4241-B2C4-1490239D6F1C}: NameServer = 85.255.114.45,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC0CBFE9-4636-4886-9E37-A7E61D6ACDBB}: NameServer = 85.255.114.45,85.255.112.105

Click Fix Checked. Close HijackThis, and click OK to proceed.

At the end of the fix, you may need to restart your computer again.

Finally, please post the contents of the logfile C:\fixwareout\report.txt, along with a new HijackThis log.
Post #12 last edited


When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/William%20Peeples/Desktop/other%20stuff/HomePage/homepage.htm
…

…Finally, please post the contents of the logfile C:\fixwareout\report.txt, along with a new HijackThis log…


Should I turn System Restore back on?

The line above ending with homepage.htm is just my personal home page that I use instead of MSN or whatever. FixWareOut automatically removes it.

Removed the others. Here are my logs after another re-boot. Bunches of thanks for your help.

Fixwareout ver 1.003
Last edited 12/5/2005
Post this report in the forums please

Reg Entries that were deleted

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\DMWJD.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

Logfile of HijackThis v1.99.1
Scan saved at 5:00:11 PM, on 01/07/06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\avg\avgamsvr.exe
D:\PROGRA~1\avg\avgupsvc.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\program files\iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
D:\PROGRA~1\avg\avgcc.exe
d:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\PROGRA~1\avg\avgemc.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Adobe\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
D:\My Documents\My Downloads\hyjack this\new version 01-07-06\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://us.rd.yahoo.com/customize/ycomp_adb…//www.yahoo.com

/search/ie.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyServer = 200.171.41.30:6588
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} -

C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

D:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Iomega Startup Options] d:\program

files\iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] d:\program

files\iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus CX6400]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus

CX6400" /O6 "USB002" /M "Stylus CX6400"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\avg\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\avg\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] d:\Program Files\Zone

Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [00ERSRRRNKY] D:\Program Files\evidence

exterminator\Evidence Exterminator\eraser.exe
O4 - HKLM\..\RunOnce: [MRUBlaster] D:\Program Files\MRU

Blaster\MRU-Blaster\indexcleaner.exe -CC
O4 - HKLM\..\RunOnce: [00ERSRRRNKY] "D:\Program Files\evidence

exterminator\Evidence Exterminator\erasrv.exe" remove
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"

/background
O4 - Startup: MRU-Blaster Silent Clean.lnk = D:\Program Files\MRU

Blaster\MRU-Blaster\mrublaster.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program

Files\Adobe\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Travelaxe - {32A32D38-B8ED-4b3f-AFD0-EF23B697B5C1} -

D:\Program Files\Travelaxe.exe
O9 - Extra button: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} -

C:\WINDOWS\system32\proxypal.exe
O9 - Extra 'Tools' menuitem: ProxyPal -

{B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O16 - DPF: DigiChat Applet -

http://host16.digichat.com/DigiChat/DigiCl…s/Client_IE.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) -

http://www.powerleap.com/downloads/cpuid.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage

Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control)

- http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://a1540.g.akamai.net/7/1540/52/200312…ple.com/mickey/

us/win/QuickTimeInstaller.exe
O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data

Transfer Control) - http://racing.youbet.com/wr_5_5/controls/ybrequest.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai.net/7/840/537/2004061…icro.com/housec

all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) -

http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer

Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} -

http://activex.microgaming.com/DLhelper/ve…n7/dlhelper.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -

http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} -

https://register3.valueactive.com/531/webolr/OCX/FlashAX.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -

D:\PROGRA~1\avg\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -

D:\PROGRA~1\avg\avgupsvc.exe
O23 - Service: Eraser Service (EraserThread) - Unknown owner - D:\Program

Files\evidence exterminator\Evidence Exterminator\erasrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program

Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program

Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
O23 - Service: IomegaAccess - Iomega Corporation -

C:\WINDOWS\System32\IomegaAccess.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner

- D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. -

C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner -

C:\WINDOWS\system32\vmnat.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\System32\ZipToA.exe

thnx,
mrickdude
Post #14

Do you use a proxy server? Also please post a new hijackthis log but in notepad hit options and make sure word wrap in unchecked.


I have used a proxy on occasion when surfing. I don't think I use one on a regular basis although I had some connection problems with my ISP and they had me change something from automatic to a specific address. I don't recall the details. Is there a way we can REM the line out like we used to do in DOS and just see if it makes a difference?

Here is the new log. I set my personal homepage back up so that is back in the registry.

Logfile of HijackThis v1.99.1
Scan saved at 2:21:58 PM, on 01/08/06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\avg\avgamsvr.exe
D:\PROGRA~1\avg\avgupsvc.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\program files\iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE
D:\PROGRA~1\avg\avgcc.exe
d:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\PROGRA~1\avg\avgemc.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\My Documents\My Downloads\hyjack this\new version 01-07-06\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adb…/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/William%20Peeples/Desktop/other%20stuff/HomePage/homepage.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.171.41.30:6588
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Iomega Startup Options] d:\program files\iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] d:\program files\iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O6 "USB002" /M "Stylus CX6400"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\avg\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\avg\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [00ERSRRRNKY] D:\Program Files\evidence exterminator\Evidence Exterminator\eraser.exe
O4 - HKLM\..\RunOnce: [MRUBlaster] D:\Program Files\MRU Blaster\MRU-Blaster\indexcleaner.exe -CC
O4 - HKLM\..\RunOnce: [00ERSRRRNKY] "D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe" remove
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: MRU-Blaster Silent Clean.lnk = D:\Program Files\MRU Blaster\MRU-Blaster\mrublaster.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Travelaxe - {32A32D38-B8ED-4b3f-AFD0-EF23B697B5C1} - D:\Program Files\Travelaxe.exe
O9 - Extra button: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe
O9 - Extra 'Tools' menuitem: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: DigiChat Applet - http://host16.digichat.com/DigiChat/DigiCl…s/Client_IE.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://www.powerleap.com/downloads/cpuid.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8} (NewUpgradeFinder Control) - http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) - http://racing.youbet.com/wr_5_5/controls/ybrequest.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/ve…n7/dlhelper.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://register3.valueactive.com/531/webolr/OCX/FlashAX.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\avg\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\avg\avgupsvc.exe
O23 - Service: Eraser Service (EraserThread) - Unknown owner - D:\Program Files\evidence exterminator\Evidence Exterminator\erasrv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido anitmalware\ewido anti-malware\ewidoguard.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - Unknown owner - C:\WINDOWS\system32\vmnat.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\System32\ZipToA.exe

Thanks,
MrickDude

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI