What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

WinAntiVirus (vtstu.dll)

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
here is the second post of the log file. Thanks again.



[Start Post #2]

Services
Name——————————————————–Internal Name————Startup Type—State—–Service Type————————————–Path (Version Info)
Alerter—————————————————–Alerter——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Ati HotKey Poller——————————————-Ati HotKey Poller——–Automatic——Running—Win32, running in it's own process—————-C:\WINDOWS\System32\Ati2evxx.exe (ATI Technologies Inc. [Ver = 6.14.10.4124 | Size = 393216 bytes | Date = 12/11/2005 23:33 | Attr = ])
Windows Audio———————————————–AudioSrv—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Automatic LiveUpdate Scheduler——————————Automatic LiveUpdate SchedulerAutomatic——Running—Win32, running in it's own process—————-"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" (Symantec Corporation [Ver = 3.0.0.160 | Size = 100032 bytes | Date = 02/23/2006 11:41 | Attr = ])
Computer Browser——————————————–Browser——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Symantec Event Manager————————————–ccEvtMgr—————–Automatic——Running—Win32, running in it's own process—————-"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (Symantec Corporation [Ver = 103.0.7.2 | Size = 198304 bytes | Date = 02/17/2006 11:05 | Attr = ])
Symantec Settings Manager———————————–ccSetMgr—————–Automatic——Running—Win32, running in it's own process—————-"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (Symantec Corporation [Ver = 103.0.7.2 | Size = 181920 bytes | Date = 02/17/2006 11:05 | Attr = ])
Creative Service for CDROM Access—————————Creative Service for CDROM AccessAutomatic——Running—Win32, running in it's own process—————-C:\WINDOWS\System32\CTsvcCDA.EXE (Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Date = 12/13/1999 02:01 | Attr = ])
Cryptographic Services————————————–CryptSvc—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
DHCP Client————————————————-Dhcp———————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Logical Disk Manager—————————————-dmserver—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
DNS Client————————————————–Dnscache—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k NetworkService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Error Reporting Service————————————-ERSvc——————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Event Log—————————————————Eventlog—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\services.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 101376 bytes | Date = 08/23/2001 08:00 | Attr = ])
COM+ Event System——————————————-EventSystem————–On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Fast User Switching Compatibility—————————FastUserSwitchingCompatibilityOn Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Help and Support——————————————–helpsvc——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Human Interface Device Access——————————-HidServ——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Altera JTAG Server——————————————JTAGServer—————Automatic——Running—Win32, running in it's own process—————-C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe ( [Ver = | Size = 143360 bytes | Date = 06/24/2004 00:40 | Attr = ])
Server——————————————————lanmanserver————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Workstation————————————————-lanmanworkstation——–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
TCP/IP NetBIOS Helper—————————————LmHosts——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Norton AntiVirus Auto-Protect Service———————–navapsvc—————–Automatic——Running—Win32, running in it's own process—————-"C:\Applications\Norton AntiVirus 2005\navapsvc.exe" (Symantec Corporation [Ver = 11.0.16.2 | Size = 177264 bytes | Date = 10/19/2005 13:54 | Attr = ])
Network Connections—————————————–Netman——————-On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Norton Internet Security Service—————————-NISSERV——————Automatic——Running—Win32, running in it's own process—————-C:\Applications\Norton Internet Security\NISSERV.EXE (Symantec Corporation [Ver = 4.0.3.104 | Size = 63144 bytes | Date = 02/18/2002 14:03 | Attr = ])
Norton Internet Security Accounts Manager——————-NISUM——————–On Demand——Running—Win32, running in it's own process—————-C:\Applications\Norton Internet Security\NISUM.EXE (Symantec Corporation [Ver = 4.0.3.104 | Size = 87720 bytes | Date = 02/18/2002 14:03 | Attr = ])
Network Location Awareness (NLA)—————————-Nla———————-On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Plug and Play———————————————–PlugPlay—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\services.exe (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 101376 bytes | Date = 08/23/2001 08:00 | Attr = ])
IPSEC Services———————————————-PolicyAgent————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
Protected Storage——————————————-ProtectedStorage———Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
Remote Access Connection Manager—————————-RasMan——————-On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Remote Registry———————————————RemoteRegistry———–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Remote Procedure Call (RPC)———————————RpcSs——————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost -k rpcss (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Security Accounts Manager———————————–SamSs——————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\lsass.exe (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 11776 bytes | Date = 08/28/2002 23:41 | Attr = ])
Task Scheduler———————————————-Schedule—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
PC Tools Spyware Doctor————————————-SDhelper—————–Automatic——Running—Win32, running in it's own process—————-C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe (PC Tools Research Pty Ltd [Ver = 3.6.0.2024 | Size = 894120 bytes | Date = 07/21/2006 19:02 | Attr = ])
Secondary Logon———————————————seclogon—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
System Event Notification———————————–SENS———————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Shell Hardware Detection————————————ShellHWDetection———Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Symantec SPBBCSvc——————————————-SPBBCSvc—————–Automatic——Running—Win32, running in it's own process—————-C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation [Ver = 1,0,1,47 | Size = 173160 bytes | Date = 07/21/2004 12:24 | Attr = ])
Print Spooler———————————————–Spooler——————Automatic——Running—Win32, running in it's own process—————-C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 51200 bytes | Date = 08/23/2001 08:00 | Attr = ])
SSDP Discovery Service————————————–SSDPSRV——————On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Windows Image Acquisition (WIA)—————————–stisvc——————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k imgsvc (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Symantec Core LC——————————————–Symantec Core LC———Automatic——Running—Win32, running in it's own process—————-C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation [Ver = 1, 8, 54, 534 | Size = 822424 bytes | Date = 06/14/2005 17:29 | Attr = ])
Norton Internet Security Proxy Service———————-SymProxySvc————–Automatic——Running—Win32, running in it's own process—————-C:\Applications\Norton Internet Security\SymProxySvc.exe (Symantec Corporation [Ver = 4.0.3.104 | Size = 54952 bytes | Date = 02/18/2002 14:02 | Attr = ])
Telephony—————————————————TapiSrv——————On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Terminal Services——————————————-TermService————–On Demand——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Themes——————————————————Themes——————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Distributed Link Tracking Client—————————-TrkWks——————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Windows User Mode Driver Framework————————–UMWdf——————–Automatic——Running—Win32, running in it's own process—————-C:\WINDOWS\System32\wdfmgr.exe (Microsoft Corporation [Ver = 5.2.3790.1230 built by: DNSRV(bld4act) | Size = 38912 bytes | Date = 09/22/2004 18:46 | Attr = ])
Upload Manager———————————————-uploadmgr—————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Windows Time————————————————W32Time——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
WebClient—————————————————WebClient—————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k LocalService (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Windows Management Instrumentation————————–winmgmt——————Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Automatic Updates——————————————-wuauserv—————–Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\system32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])
Wireless Zero Configuration———————————WZCSVC——————-Automatic——Running—Win32, running in a shared process—————-C:\WINDOWS\System32\svchost.exe -k netsvcs (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12800 bytes | Date = 08/23/2001 08:00 | Attr = ])

Files
Full Path————————————————————————————————————— Details
%SystemDrive%———————————————————————————————————–
%ProgramFilesDir%——————————————————————————————————-
%WinDir%—————————————————————————————————————-
C:\WINDOWS\epsuninst.exe———————————————————————————————— UPX! (Marcelo Bona Boff [Ver = 3.6.0.1 | Size = 231936 bytes | Date = 07/12/2003 18:35 | Attr = ])
C:\WINDOWS\myst5ss_1280x1024.scr—————————————————————————————- UPX! ( [Ver = | Size = 16080574 bytes | Date = 09/18/2005 02:57 | Attr = ])
C:\WINDOWS\RADEON®X850 Cube Scan.scr———————————————————————————— .aspack (ScreenTime Media [Ver = 2.3.3 | Size = 194560 bytes | Date = 09/18/2005 03:03 | Attr = ])
%System%—————————————————————————————————————-
C:\WINDOWS\SYSTEM32\d3dx9_25.dll—————————————————————————————- D3DXUVAtlasPack (Microsoft Corporation [Ver = 9.06.168.0000 | Size = 2337488 bytes | Date = 03/18/2005 18:19 | Attr = ])
C:\WINDOWS\SYSTEM32\d3dx9_26.dll—————————————————————————————- D3DXUVAtlasPack (Microsoft Corporation [Ver = 9.07.239.0000 | Size = 2297552 bytes | Date = 05/26/2005 16:34 | Attr = ])
C:\WINDOWS\SYSTEM32\d3dx9_27.dll—————————————————————————————- D3DXUVAtlasPack (Microsoft Corporation [Ver = 9.08.299.0000 | Size = 2319568 bytes | Date = 07/22/2005 19:59 | Attr = ])
C:\WINDOWS\SYSTEM32\dfrg.msc——————————————————————————————– AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213( [Ver = | Size = 41397 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\fmod.dll——————————————————————————————– UPX! (Firelight Firelight Technologies Pty, Ltd [Ver = 3.62 | Size = 135680 bytes | Date = 04/09/2003 12:58 | Attr = ])
C:\WINDOWS\SYSTEM32\KeyLbE32.dll—————————————————————————————- .aspack (Concept Software, Inc. [Ver = 4.109b | Size = 54272 bytes | Date = 02/06/2001 18:23 | Attr = ])
C:\WINDOWS\SYSTEM32\KEYLIB32.dll—————————————————————————————- .aspack (Concept Software, Inc. [Ver = 4.109b | Size = 39936 bytes | Date = 02/08/2001 18:29 | Attr = ])
C:\WINDOWS\SYSTEM32\NPHKAPI.DLL—————————————————————————————– UPX! (© INCA [Ver = 2002, 2, 20, 1 | Size = 23552 bytes | Date = 05/27/2003 18:59 | Attr = ])
C:\WINDOWS\SYSTEM32\NPSCAN.DLL—————————————————————————————— pec2 (© INCA [Ver = 2003, 4, 16, 2 | Size = 247808 bytes | Date = 05/27/2003 18:59 | Attr = ])
C:\WINDOWS\SYSTEM32\NPSHAR2K.DLL—————————————————————————————- UPX! (nProtect.com [Ver = 2002, 2, 20, 1 | Size = 16384 bytes | Date = 05/27/2003 18:59 | Attr = ])
C:\WINDOWS\SYSTEM32\NPSHARE.DLL—————————————————————————————– UPX! (nProtect.com [Ver = 2002, 2, 20, 1 | Size = 21504 bytes | Date = 05/27/2003 18:59 | Attr = ])
C:\WINDOWS\SYSTEM32\rasdlg.dll—————————————————————————————— \DuMonitor SendMessage(WM_RASEVENT) done(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 631808 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\SKCA32.dll—————————————————————————————— .aspack (Concept Software, Inc. [Ver = 4.109b | Size = 48640 bytes | Date = 02/16/2001 13:23 | Attr = ])
C:\WINDOWS\SYSTEM32\wbdbase.deu—————————————————————————————– msubjsuchsullsupeswinsyncszens( [Ver = | Size = 1309184 bytes | Date = 08/23/2001 08:00 | Attr = ])
%System%\Drivers folder and sub-folders———————————————————————————
%windir% + sub-dirs for System or Hidden files less than 60 days old—————————————————-
C:\WINDOWS\bootstat.dat————————————————————————————————- ( [Ver = | Size = 2048 bytes | Date = 07/28/2006 00:21 | Attr = S])
C:\WINDOWS\QTFont.qfn————————————————————————————————— ( [Ver = | Size = 54156 bytes | Date = 07/26/2006 23:43 | Attr = H ])
C:\WINDOWS\Thumbs.db—————————————————————————————————- ( [Ver = | Size = 73728 bytes | Date = 07/18/2006 17:54 | Attr = HS])
C:\WINDOWS\Fonts\Thumbs.db———————————————————————————————- ( [Ver = | Size = 9728 bytes | Date = 06/20/2006 00:24 | Attr = HS])
C:\WINDOWS\LastGood\INF\Iesetup.inf————————————————————————————- ( [Ver = | Size = 0 bytes | Date = 07/27/2006 01:19 | Attr = H ])
C:\WINDOWS\LastGood\INF\Iesetup.PNF————————————————————————————- ( [Ver = | Size = 0 bytes | Date = 07/27/2006 01:19 | Attr = H ])
C:\WINDOWS\LastGood\INF\oem36.inf————————————————————————————— ( [Ver = | Size = 0 bytes | Date = 07/27/2006 01:19 | Attr = H ])
C:\WINDOWS\LastGood\INF\oem36.PNF————————————————————————————— ( [Ver = | Size = 0 bytes | Date = 07/27/2006 01:19 | Attr = H ])
C:\WINDOWS\system32\Thumbs.db——————————————————————————————- ( [Ver = | Size = 10240 bytes | Date = 06/20/2006 00:24 | Attr = HS])
C:\WINDOWS\system32\config\default.LOG———————————————————————————- ( [Ver = | Size = 1024 bytes | Date = 07/28/2006 00:27 | Attr = H ])
C:\WINDOWS\system32\config\SAM.LOG————————————————————————————– ( [Ver = | Size = 1024 bytes | Date = 07/28/2006 00:24 | Attr = H ])
C:\WINDOWS\system32\config\SECURITY.LOG——————————————————————————— ( [Ver = | Size = 1024 bytes | Date = 07/28/2006 00:24 | Attr = H ])
C:\WINDOWS\system32\config\software.LOG——————————————————————————— ( [Ver = | Size = 1024 bytes | Date = 07/28/2006 00:33 | Attr = H ])
C:\WINDOWS\system32\config\system.LOG———————————————————————————– ( [Ver = | Size = 1024 bytes | Date = 07/28/2006 00:32 | Attr = H ])
C:\WINDOWS\system32\drivers\fidbox.dat———————————————————————————- ( [Ver = | Size = 16303648 bytes | Date = 07/28/2006 00:32 | Attr = HS])
C:\WINDOWS\system32\drivers\fidbox.idx———————————————————————————- ( [Ver = | Size = 221444 bytes | Date = 07/28/2006 00:02 | Attr = HS])
C:\WINDOWS\system32\drivers\fidbox2.dat——————————————————————————— ( [Ver = | Size = 934944 bytes | Date = 07/28/2006 00:37 | Attr = HS])
C:\WINDOWS\system32\drivers\fidbox2.idx——————————————————————————— ( [Ver = | Size = 90620 bytes | Date = 07/28/2006 00:02 | Attr = HS])
C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\45cdf95a-c486-4a24-98a0-776ae265f313——————————– ( [Ver = | Size = 388 bytes | Date = 06/25/2006 18:21 | Attr = HS])
C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred———————————————————– ( [Ver = | Size = 24 bytes | Date = 06/25/2006 18:21 | Attr = HS])
C:\WINDOWS\Tasks\SA.DAT————————————————————————————————- ( [Ver = | Size = 6 bytes | Date = 07/28/2006 00:21 | Attr = H ])
C:\WINDOWS\twain_32\Thumbs.db——————————————————————————————- ( [Ver = | Size = 7168 bytes | Date = 06/20/2006 00:24 | Attr = HS])
C:\WINDOWS\Web\Thumbs.db———————————————————————————————— ( [Ver = | Size = 9728 bytes | Date = 06/20/2006 00:24 | Attr = HS])
CPL files—————————————————————————————————————
C:\WINDOWS\SYSTEM32\access.cpl—————————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 66048 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\AKCPanel.cpl—————————————————————————————- (Anark Corporation [Ver = 1,2,1,784 | Size = 67072 bytes | Date = 09/06/2002 07:30 | Attr = ])
C:\WINDOWS\SYSTEM32\appwiz.cpl—————————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 578560 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\AudioHQU.cpl—————————————————————————————- (Creative Technology Ltd. [Ver = 1.0.0 | Size = 32768 bytes | Date = 05/28/2001 14:47 | Attr = ])
C:\WINDOWS\SYSTEM32\bdeadmin.cpl—————————————————————————————- ( [Ver = | Size = 183808 bytes | Date = 11/12/1999 06:11 | Attr = ])
C:\WINDOWS\SYSTEM32\CTDetect.cpl—————————————————————————————- (Creative Technology Ltd. [Ver = 2.0.0.0 | Size = 230912 bytes | Date = 03/30/2001 03:00 | Attr = ])
C:\WINDOWS\SYSTEM32\desk.cpl——————————————————————————————– (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 129024 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\hdwwiz.cpl—————————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 150016 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\ImageDrive.cpl————————————————————————————– ( [Ver = | Size = 53248 bytes | Date = 02/09/2003 23:20 | Attr = ])
C:\WINDOWS\SYSTEM32\inetcpl.cpl—————————————————————————————– (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 292352 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\intl.cpl——————————————————————————————– (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 121856 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\joy.cpl——————————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 208896 bytes | Date = 08/29/2002 04:41 | Attr = ])
C:\WINDOWS\SYSTEM32\jpicpl32.cpl—————————————————————————————- (Sun Microsystems [Ver = 1, 4, 1, 50 | Size = 229487 bytes | Date = 07/09/2003 02:49 | Attr = ])
C:\WINDOWS\SYSTEM32\LTower.cpl—————————————————————————————— (The LEGO Group [Ver = 1.0.50 Build 0159 | Size = 94208 bytes | Date = 04/25/2001 17:01 | Attr = ])
C:\WINDOWS\SYSTEM32\main.cpl——————————————————————————————– (Microsoft Corporation [Ver = 5.1.2403.1 | Size = 187904 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\mmsys.cpl——————————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 559616 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\ncpa.cpl——————————————————————————————– (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 35840 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\nusrmgr.cpl—————————————————————————————– (Microsoft Corporation [Ver = 6.00.2600.0000 (xpclient.010817-1148) | Size = 256000 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\nwc.cpl——————————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 36864 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\odbccp32.cpl—————————————————————————————- (Microsoft Corporation [Ver = 3.520.7713.0 | Size = 36864 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\plotman.cpl—————————————————————————————– (Autodesk, Inc. [Ver = 7.0.15.90 | Size = 454718 bytes | Date = 06/12/2000 02:09 | Attr = ])
C:\WINDOWS\SYSTEM32\powercfg.cpl—————————————————————————————- (Microsoft Corporation [Ver = 6.00.2600.0000 (xpclient.010817-1148) | Size = 109056 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\QuickTime.cpl————————————————————————————— (Apple Computer, Inc. [Ver = 6.5.1 | Size = 323072 bytes | Date = 09/23/2004 20:57 | Attr = ])
C:\WINDOWS\SYSTEM32\speech.cpl—————————————————————————————— (Microsoft [Ver = 1.0.0.2702 | Size = 49152 bytes | Date = 03/02/1999 17:10 | Attr = ])
C:\WINDOWS\SYSTEM32\styleman.cpl—————————————————————————————- (Autodesk, Inc. [Ver = 7.0.15.90 | Size = 454719 bytes | Date = 06/12/2000 02:09 | Attr = ])
C:\WINDOWS\SYSTEM32\sysdm.cpl——————————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 268288 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\telephon.cpl—————————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 28160 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\timedate.cpl—————————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 90112 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\access.cpl——————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 66048 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\appwiz.cpl——————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 578560 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\desk.cpl———————————————————————————– (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 129024 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl——————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 150016 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl——————————————————————————– (Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 292352 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\intl.cpl———————————————————————————– (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 121856 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\joy.cpl———————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 208896 bytes | Date = 08/29/2002 04:41 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\main.cpl———————————————————————————– (Microsoft Corporation [Ver = 5.1.2403.1 | Size = 187904 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\mmsys.cpl———————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 559616 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl———————————————————————————– (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 35840 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl——————————————————————————– (Microsoft Corporation [Ver = 6.00.2600.0000 (xpclient.010817-1148) | Size = 256000 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl———————————————————————————— (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 36864 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl——————————————————————————- (Microsoft Corporation [Ver = 3.520.7713.0 | Size = 36864 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\powercfg.cpl——————————————————————————- (Microsoft Corporation [Ver = 6.00.2600.0000 (xpclient.010817-1148) | Size = 109056 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\sapi.cpl———————————————————————————– (Microsoft Corporation [Ver = 5.1.4111.00 (xpsp1.020828-1920) | Size = 147456 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\sysdm.cpl———————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 268288 bytes | Date = 08/28/2002 23:41 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl——————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 28160 bytes | Date = 08/23/2001 08:00 | Attr = ])
C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl——————————————————————————- (Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 90112 bytes | Date = 08/23/2001 08:00 | Attr = ])
AllUsers Startup Folder————————————————————————————————-
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini——————————————— ( [Ver = | Size = 84 bytes | Date = 12/29/2004 21:09 | Attr = HS])
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk—————————————- ( [Ver = | Size = 779 bytes | Date = 07/23/2006 00:43 | Attr = ])
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk———————————— ( [Ver = | Size = 1760 bytes | Date = 07/23/2006 00:43 | Attr = ])
AllUsers ApplicationData Folder—————————————————————————————–
C:\Documents and Settings\All Users\Application Data\desktop.ini——————————————————– ( [Ver = | Size = 62 bytes | Date = 12/29/2004 20:58 | Attr = HS])
C:\Documents and Settings\All Users\Application Data\hpzinstall.log—————————————————– ( [Ver = | Size = 390 bytes | Date = 12/30/2004 00:19 | Attr = ])
CurrentUser Startup Folder———————————————————————————————-
C:\Documents and Settings\Michael\Start Menu\Programs\Startup\desktop.ini———————————————– ( [Ver = | Size = 84 bytes | Date = 01/23/2003 00:55 | Attr = HS])
CurrentUser ApplicationData Folder————————————————————————————–
C:\Documents and Settings\Michael\Application Data\$_hpcst$.hpc——————————————————— ( [Ver = | Size = 2508 bytes | Date = 04/25/2006 19:54 | Attr = ])
C:\Documents and Settings\Michael\Application Data\Comma Separated Values (Windows).ADR——————————— ( [Ver = | Size = 25372 bytes | Date = 05/06/2006 13:14 | Attr = ])
C:\Documents and Settings\Michael\Application Data\desktop.ini———————————————————- ( [Ver = | Size = 62 bytes | Date = 01/22/2003 19:36 | Attr = HS])
C:\Documents and Settings\Michael\Application Data\GDIPFONTCACHEV1.DAT————————————————– ( [Ver = | Size = 139856 bytes | Date = 04/05/2006 20:41 | Attr = ])
DPF files—————————————————————————————————————
{00B71CFB-6864-4346-A978-C0A14556272C}———————————————————————————- Checkers Class - CodeBase = http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
{14B87622-7E19-4EA8-93B3-97215F77A6BC}———————————————————————————- MessengerStatsClient Class - CodeBase = http://messenger.zone.msn.com/binary/Messe…nt.cab30149.cab
{166B1BCA-3F9C-11CF-8075-444553540000}———————————————————————————- Shockwave ActiveX Control - CodeBase = http://fpdownload.macromedia.com/get/shock…director/sw.cab
{2917297F-F02B-4B9D-81DF-494B6333150B}———————————————————————————- Minesweeper Flags Class - CodeBase = http://messenger.zone.msn.com/binary/MineSweeper.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93}———————————————————————————- Java Plug-in 1.4.1_05 - CodeBase = http://java.sun.com/products/plugin/1.4/ji…indows-i586.cab
{8E0D4DE5-3180-4024-A327-4DFAD1796A8D}———————————————————————————- MessengerStatsClient Class - CodeBase = http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
{90C9629E-CD32-11D3-BBFB-00105A1F0D68}———————————————————————————- InstallShield International Setup Player - CodeBase = http://www.installengine.com/engine/isetup.cab
{B38870E4-7ECB-40DA-8C6A-595F0A5519FF}———————————————————————————- MsnMessengerSetupDownloadControl Class - CodeBase = http://messenger.msn.com/download/MsnMesse…pDownloader.cab
{B8BE5E93-A60C-4D26-A2DC-220313175592}———————————————————————————- ZoneIntro Class - CodeBase = http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}———————————————————————————- Java Plug-in 1.4.1_05 - CodeBase = http://java.sun.com/products/plugin/1.4/ji…indows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000}———————————————————————————- Shockwave Flash Object - CodeBase = http://download.macromedia.com/pub/shockwa…ash/swflash.cab
{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}———————————————————————————- PopCapLoader Object - CodeBase = http://antu.popcap.com/games/popcaploader_v5.cab
{F281A59C-7B65-11D3-8617-0010830243BD}———————————————————————————- AcPreview Control - CodeBase = file://C:\Applications\AutoCAD 2000i\AcPreview.ocx
{FE5D6722-826F-11D5-A24E-0060B0F1A5AE}———————————————————————————- Tukati Launcher - CodeBase = http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab
DirectAnimation Java Classes——————————————————————————————– - CodeBase = file://C:\WINDOWS\Java\classes\dajava.cab
Microsoft XML Parser for Java——————————————————————————————- - CodeBase = file://C:\WINDOWS\Java\classes\xmldso.cab
Hosts file = 25 bytes. Reading all entries.—————————————————————————– C:\WINDOWS\System32\drivers\etc\Hosts
127.0.0.1 localhost————————————————————————————————-
Post #17
Hi, This log is going to take some time to look over, so I won't be as quick to reply as before. Thanks for your patience,
Post #18
I'm still going through you log, but let try something:

We are going to run System File Checker, to make sure all of your protected files are not corrupt. The scan will automatically replace any corrupt files that it finds.

Click Start
Select Run
At the prompt type sfc /scannow Please note that there is a single space between sfc and /scannow.

Typing this will start the program, and a box should appear telling you how much longer the process should take.

Sometimes the scan will prompt you for your Windows XP disc upon starting the scan. if this happens please make sure that you can view protected files:My Computer
Tools
Folder Options
View
"Uncheck" Hide protected operating system files.
Then rerun the scan. If this still asks you to put in your windows XP CD, and you do not have the CD (If you bought it preinstalled) post back for more tips, otherwise enter Windows CD.

Once the scan is complete:

Check your Windows Updates! After using the File Protection Service, you might need to reapply some updates.

Please reboot, and let me know if anything has changed.

Also, please rehide the protected files:My Computer
Tools
Folder Options
View
"Check" Hide protected operating system files.
Post #19
I tried using the FIle Protection Service, and it worked properly. Unfortunatly after reboot nothing had changed, and IE and all its related programs still shut down as soon as they attempt to access the internet. Thanks for the suggestion though, hopefully there will be some other hint in the log.
Post #21
Yes, I am using Mozilla Firefox to browse the internet (and this is what I normally use, that is why I don't know exactly when it was that I started having these problems). And it seems that other non-microsoft programs which I suspect connect to the internet without the use of IE (such as Limewire, and anti-virus program self-updaters) also all work. This is why I suspect the problem has to be related to IE. To recap, the 4 programs that I've so far noticed to instantly terminate are:

1) IE: as soon as it attempts to contact and recieve a reply from the internet (I've tried various websites)

2) Windows Media Player: as soon as it opens, I suspect because right on its startup it tries to get that Windows Media Live stuff from the internet

3) MSN/Windows Live Messenger: on sign in if the MSN today window was supposed to appear, but now that I have MSN today disabled(not to appear on sign in), it runs fine. I experienced this problem with MSN, updated to Windows live, experienced the same problem and then realized it was the MSN today window's attempted startup that was the problem

4) Outlook Express: it will check E-mail just fine, but under some circumstances (I'm not exactly sure what the command the user gave it was, but I'm betting whatever the command was it had Outlook Express attemp to utilize IE) it will instantly terminate
Post #22
ok. thanks for the detailed info! I'll probably need to consult some other experts on your issue so it might be a while. thanks for your patience,
Post #23
Not a probelm B) :thumbup: Thanks for all your help and all the effort! I know this is a real bizzare situation, esspecially after all the logical fix attempts we've made. I really appreciate your continued hard work.
Post #24 last edited
Let's try this:

Download IEFix and extract it to your desktop. <> on IEfix.exe to run the program. When it finishes, reboot, and try using IE to connect to the internet.

Let me know if it works.
Post #25
I think the link to the IEFix program is brocken because when I click it it only takes me to a view of a text document, where there is no further link to download a program. Also, when I right click the link to try to save target as, it won't let me.
Post #27
:lol: :thumbup: HEY!!!!!!!!!! It worked!!!! Everything is back to normal now! WOW! It feels like we've been through a battle together or something! Thank you so much for all the help, I had practically given up hope of having that ever work again. :)
Post #28
Hi,

I'm glad it worked! Let's do this online scan to make sure you're good to go:

Please go HERE to run Panda's ActiveScan
Note: This Scanner is for Internet Explorer Only!
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open…click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Please include a new hijackthis log along with your panda log in your next post.
Post #29
Sorry for the long wait I've been quite busy recently. Here are the results of the active scan and another Hi-Jack This! log. Thanks a million for all the help.

___________________________________________________________________________


ActiveScan:

Incident Status Location

Adware:adware/cws.payfortraffic Not disinfected Windows Registry
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\David\.jpi_cache\jar\1.0\archive.jar-502da0c1-52a662fb.zip[Dummy.class]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\z8e87bjd.default\cookies.txt[.hitbox.com/]

____________________________________________________________________________


Logfile of HijackThis v1.99.1
Scan saved at 7:41:18 AM, on 04/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Applications\Norton Internet Security\IAMAPP.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
C:\Applications\Norton AntiVirus 2005\navapsvc.exe
C:\Applications\Norton Internet Security\NISUM.EXE
C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Applications\Norton Internet Security\SymProxySvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Applications\Norton Internet Security\NISSERV.EXE
C:\Applications\Firefox\firefox.exe
C:\Applications\Hi-Jack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2FF5573C-0EB5-43db-A1B2-C4326813468E} - (no file)
O2 - BHO: (no name) - {3D117109-0505-4A69-9E90-ECD6583F14F1} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\APPLIC~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\APPLIC~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Applications\Norton AntiVirus 2005\NavShExt.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Applications\Norton AntiVirus 2005\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [iamapp] C:\Applications\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Applications\SpyBot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Applications\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\APPLIC~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Applications\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: vtstu - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Applications\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\Applications\UofT Software\Altera\Quartus41\bin\JTAGServer.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Applications\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Applications\Norton Internet Security\NISUM.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\IWP\NPFMntor.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Applications\Norton AntiVirus 2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Applications\Spyware Doctor - PC Tools\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Applications\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #30 last edited
This step is really important:

Some security programs with active monitoring processes are known to interfere with automatic scanners and can actually prevent HJT fixes from taking effect.

Spybot S&D (Teatimer)

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

A visual tutorial to disabling Spybot TeaTimer can be found here

Then, Download ResetTeaTimer.bat
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below (if present).

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {2FF5573C-0EB5-43db-A1B2-C4326813468E} - (no file)
O2 - BHO: (no name) - {3D117109-0505-4A69-9E90-ECD6583F14F1} - (no file)
O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: vtstu - C:\WINDOWS\

Now close all windows other than HiJackThis, then click Fix Checked. close HijackThis.


Your Java may be out of date. We need to update your Java if it is out of date. The older version is a security risk, as malware writers exploit the weaknesses in it's code.

Updating Java:
  • Go to Start > Control Panel double-click on the Software icon, Add or Remove programs.
  • Search in the list for all previous installed versions of Java. (J2SE Runtime Environment…. )
  • Select it and click Remove.
  • Then Download and install the newest version from here:
    http://www.java.com/en/download/manual.jsp
  • Once installed, reboot the machine
  • After the reboot, go back into the Control Panel and double-click the Java Icon.
  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
    • Downloaded Applications
    • Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.


reboot and post a new hijackthis log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI