Most Recent HJT log.....
Logfile of HijackThis v1.99.1
Scan saved at 3:18:11 PM, on 2/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Ahead(Nero)\InCD\InCDsrv.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
D:\WINDOWS\system32\hphmon04.exe
D:\Program Files\ewido anti-malware\ewidoctrl.exe
D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\Ahead(Nero)\InCD\InCD.exe
D:\Program Files\ewido anti-malware\ewidoguard.exe
D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Common Files\AOL\1140095039\ee\AOLSoftware.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\devldr32.exe
D:\PROGRA~1\AHEAD(~1\Ahead\data\xtras\mssysmgr.exe
D:\WINDOWS\system32\wdfmgr.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
D:\Program Files\AIRPLUS\D-Link AirPlus DWL-120+ Wireless USB Adapter\AIRPLUS.EXE
D:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\HPHipm11.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\alg.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\HiJack This\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.iastate.edu/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] D:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "D:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] D:\Program Files\Ahead(Nero)\InCD\InCD.exe
O4 - HKLM\..\Run: [ViewMgr] D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] D:\Program Files\Common Files\AOL\1140095039\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] D:\PROGRA~1\AHEAD(~1\Ahead\data\xtras\mssysmgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus USB.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = D:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.micros...b?1137885040491
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Program Files\Ahead(Nero)\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - D:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPH11 - HP - D:\WINDOWS\system32\HPHipm11.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
Ewido Log:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 2:53:25 PM, 2/16/2006
+ Report-Checksum: D80A7D72
+ Scan result:
[712] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning
[736] VM_00B20000 -> Downloader.Agent.uj : Error during cleaning
[1748] VM_009D0000 -> Downloader.Agent.uj : Error during cleaning
[1744] VM_003A0000 -> Downloader.Agent.uj : Error during cleaning
[672] VM_008C0000 -> Downloader.Agent.uj : Error during cleaning
[708] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning
[756] VM_00890000 -> Downloader.Agent.uj : Error during cleaning
[904] VM_003F0000 -> Downloader.Agent.uj : Error during cleaning
[1012] VM_008A0000 -> Downloader.Agent.uj : Error during cleaning
[1072] VM_00390000 -> Downloader.Agent.uj : Error during cleaning
[1108] VM_00990000 -> Downloader.Agent.uj : Error during cleaning
[1124] VM_008B0000 -> Downloader.Agent.uj : Error during cleaning
[1156] VM_008A0000 -> Downloader.Agent.uj : Error during cleaning
[1396] VM_003A0000 -> Downloader.Agent.uj : Error during cleaning
[1432] D:\WINDOWS\system32\idemlog.exe -> Hijacker.Small : Error during cleaning
[1680] VM_00950000 -> Downloader.Agent.uj : Error during cleaning
[1984] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning
[2008] VM_00840000 -> Downloader.Agent.uj : Error during cleaning
[2120] VM_00890000 -> Downloader.Agent.uj : Error during cleaning
[2364] VM_007B0000 -> Downloader.Agent.uj : Error during cleaning
[2200] VM_00960000 -> Downloader.Agent.uj : Error during cleaning
[2740] VM_01250000 -> Downloader.Agent.uj : Error during cleaning
D:\Documents and Settings\Me\Cookies\me@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@ads.realcastmedia[1].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@adtech[1].txt -> TrackingCookie.Adtech : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@c4.zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@centrport[1].txt -> TrackingCookie.Centrport : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@com[2].txt -> TrackingCookie.Com : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz11.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz3.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz4.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz5.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz6.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz8.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@cz9.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@e-2dj6wjlyegd5wgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@free.wegcash[2].txt -> TrackingCookie.Wegcash : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@paycounter[1].txt -> TrackingCookie.Paycounter : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@revenue[2].txt -> TrackingCookie.Revenue : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@sel.as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@server3.web-stat[1].txt -> TrackingCookie.Web-stat : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@stat.onestat[2].txt -> TrackingCookie.Onestat : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@vip2.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@xxxcounter[1].txt -> TrackingCookie.Xxxcounter : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned with backup
D:\Documents and Settings\Me\Cookies\me@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup
D:\Documents and Settings\Me\Local Settings\Temp\dk.dial -> Trojan.Dialer.ay : Cleaned with backup
D:\Documents and Settings\Me\Local Settings\Temporary Internet Files\Content.IE5\9WIYA2LZ\xxx[1].wmf -> Exploit.MS05-053-WMF : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP23\A0006647.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP24\A0007647.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP26\A0008647.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP27\A0008672.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP36\A0009003.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP42\A0009979.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP42\A0010023.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP45\A0011023.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP45\A0012023.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP49\A0012125.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP51\A0013122.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP53\A0013238.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP54\A0013261.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP55\A0014261.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP58\A0014342.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP59\A0015338.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP62\A0015433.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP63\A0016432.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP64\A0017433.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP65\A0018432.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP68\A0018521.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP68\A0020518.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP68\A0020552.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP68\A0020756.exe -> Trojan.Pakes : Cleaned with backup
D:\System Volume Information\_restore{7F6803A5-412A-4D88-9789-BB0C42A392F0}\RP68\A0020811.exe -> Trojan.Pakes : Cleaned with backup
D:\WINDOWS\system32\dial32.exe -> Trojan.Dialer.ay : Cleaned with backup
D:\WINDOWS\system32\whtgv.dll -> Adware.SBSoft : Cleaned with backup
::Report End
--Side Note: The Desktop links are gone and things APPEAR to be running more smoothly. I could not find files "D:\windows\system32\popcorn72" or "D:\Program Files\UnSpyPC", but used Killbox on them. Thanks for the help so far.