What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I think I have a new one- Generic.ZIV

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I actually think I have more than one virus on my one week old comp:(


Logfile of HijackThis v1.99.1
Scan saved at 8:52:10 PM, on 8/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Net Nanny\nnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Net Nanny\nntray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\pvfsf.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,brmwpcb.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NNTray] C:\Program Files\Net Nanny\nnstart.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1150921350061
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1155411036358
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NNSvc - Net Nanny Software International, Inc. - C:\Program Files\Net Nanny\nnsvc.exe
Post #2
Hi I'm Angelfire777 and it'll be my pleasure to assist you in your problem. Reasearching Hijackthis logs could take sometime so please, be patient while I research a fix for you. Also, I have to let experts check my fixes first before bringing them to you. Please observe these while we work: 1.) Please stick with this thread until we are finished, do not start a new topic here or start a new thread at other forums. Do not worry, We were trained to help and never give up until we get you all fixed up. 2.) Stop if you have questions!! Never proceed if something is unclear to you. We don't want to start all over again. 3.) Avoid downloading other applications or other anti-spyware programs unless you really need to. 4.) Lastly, please be patient and never lose hope. Sometimes, it will take us several tries and posts to get something done. Sit back tight, I'll be back for you!
Post #3
Please download Qoofix by RubbeR DuckY from one of the following locations:
http://www.malwarebytes.org/Qoofix.zip
http://www.besttechie.net/tools/Qoofix.zip

1. Unzip all files to a convenient location such as C:\Qoofix.
2. Go to the folder you unzipped all files and run Qoofix.exe.
3. Click Begin Removal and wait for the scan to finish.
4. If an infection has been found, select yes to restart your computer.

Finally post a new Hijack This log and the contents of the Qoofix logfile.
Post #4
Thank you so much Angelfire for your help. I have done what you said, and will copy/paste logfiles. Be sure to notice the pvfsf.exe which I and avg believe is my problem.

Qoofix v1.03 by http://www.malwarebytes.org
Scan started on [8/25/2006] at [4:34:27 PM]
————————————————————-
No malicious modules found!
————————————————————-
C:\WINDOWS\unwn.exe will be deleted on reboot!

User prompted YES to reboot, system now rebooting…
————————————————————-
Scan COMPLETED SUCCESSFULLY on [8/25/2006] at [4:36:20 PM]

Note: Some registry keys may have been removed.


Qoofix v1.03 by http://www.malwarebytes.org
Scan started on [8/25/2006] at [4:41:19 PM]
————————————————————-
No malicious modules found!
————————————————————-
No Qoologic infected files found!
————————————————————-
Scan COMPLETED SUCCESSFULLY on [8/25/2006] at [4:42:37 PM]

Note: Some registry keys may have been removed.




Logfile of HijackThis v1.99.1
Scan saved at 4:43:25 PM, on 8/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Net Nanny\nnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Net Nanny\nntray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\pvfsf.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,brmwpcb.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NNTray] C:\Program Files\Net Nanny\nnstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1150921350061
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1155411036358
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NNSvc - Net Nanny Software International, Inc. - C:\Program Files\Net Nanny\nnsvc.exe
Post #5 last edited
I'm very sorry for this post, I made a mistake with this one Brainhiccup, I'll be back please hold on..
Post #7 last edited
Download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only
DO NOT USE IT YET
==========================
Open hijackthis > choose scan only > tick the boxes beside these entries in bold

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\pvfsf.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,brmwpcb.exe

close ALL browsers and windows/programs that are running, leave only hijackthis running then click "Fix Checked"
==========================
Reboot into Safe Mode

You may want to print these instructions here or save them in notepad since you'll work offline

To enter Safe Mode

Click start > turn off computer > Restart > When you hear the computer beep once, begin tapping F8 rapidly > this will bring up a menu > use your keyboard to scroll to safe mode > hit enter

If you need further instructions/help on how to go to safe mode, see THIS
==========================
You may need to see your hidden files first

Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files option.
* Click Yes to confirm.
* Click OK.

You can refer to this site HERE
==========================
Open Windows Explorer by hitting your windows key + E at the same time.
*If you do not have a windows key, double click my computer > click the folders icon

Then navigate to these files and delete them:

C:\WINDOWS\System32\pvfsf.exe
C:\WINDOWS\System32\brmwpcb.exe
Empty your recycle bin
==========================
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose:Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click
  • No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE:If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
==========================
Close ALL open Windows / Programs / Folders. Please start Ewido and run a full scan.
  • Click on Scanner
  • Click on the Settings tab.
    • Under How to act?
      Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      All checkboxes should be ticked.
    • Under Possibly unwanted software:
      All checkboxes should be ticked.
    • Under Reports:
      Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished:
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
  • When done, click the Save Scan Report button.
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
==========================
On your next reply, please include:
  • A Fresh Hijackthis log
  • ewido log
  • A detailed description on how your computer is behaving
Post #8
I did everything just like you said, I hope;)

Logfile of HijackThis v1.99.1
Scan saved at 7:11:23 PM, on 8/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Net Nanny\nnsvc.exe
C:\Program Files\Net Nanny\nnstart.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Net Nanny\nntray.exe
C:\Hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\pvfsf.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,brmwpcb.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NNTray] C:\Program Files\Net Nanny\nnstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1150921350061
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1155411036358
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NNSvc - Net Nanny Software International, Inc. - C:\Program Files\Net Nanny\nnsvc.exe



———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 6:55:48 PM 8/26/2006

+ Scan result:



C:\Documents and Settings\Cayla\Cookies\cayla@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.27:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined).
:mozilla.59:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.60:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.61:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.62:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.16:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.35:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.30:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.31:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.32:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.33:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.34:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Cassidy\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.57:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.58:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.28:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
:mozilla.29:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
:mozilla.50:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.51:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.52:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.53:C:\Documents and Settings\Cassidy\Application Data\Mozilla\Firefox\Profiles\apvaytzr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).


::Report end
Post #9
Download combofix.exe

1. Double click combofix.exe & follow the prompts.
2. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
==========================
Please download Blacklight
  • Hit I accept. It will take you to download page.
  • Download blbeta.exe and save it to the Desktop.
  • Click accept agreement and Click scan
    This app too may fire off a warning from antivirus. Let the driver load.
  • Wait for it to finish.
  • If it displays any items…don't do anything with them yet. Just hit exit (close)
  • It will drop a log on Desktop that starts with fsbl….big number
Please post contents of log.
==========================
On your next reply, please include:
  • A Fresh Hijackthis log
  • combofix log
  • blacklight log
Post #10
I do believe we've had some sort of success this time. That Combo fix is pretty powerful.

Logfile of HijackThis v1.99.1
Scan saved at 8:45:19 AM, on 8/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Net Nanny\nnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Net Nanny\nntray.exe
C:\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NNTray] C:\Program Files\Net Nanny\nnstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1150921350061
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1155411036358
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NNSvc - Net Nanny Software International, Inc. - C:\Program Files\Net Nanny\nnsvc.exe



Joseph - 06-08-27 8:32:43.15
ComboFix 06.08.26BT - Running from: C:\Combofix

((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log )))))))))))))))))))))))))))))))))))))))))))))))))))


* * * PRE-RUN - Filepaths extracted from the Registry * * * * * * * * * * * * * * * * * * * * * *


O4 - HKEY_CURRENT_USER\…\Run C:\WINDOWS\system32\ymoofw.exe
O4 - HKEY_LOCAL_MACHINE\…\Run C:\WINDOWS\system32\ymoofw.exe
F2 -REG:system.ini: Shell C:\WINDOWS\system32\pvfsf.exe
F2 -REG:system.ini: UserInit C:\WINDOWS\system32\brmwpcb.exe


* * * PRE-RUN - Filepaths from Locate * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


2006-08-26 19:10 28672 –a—— C:\WINDOWS\system32\pvfsf.exe
2006-08-18 21:37 53 –a—— C:\WINDOWS\nlccow.dat
2006-08-18 21:37 51712 –a—— C:\WINDOWS\system32\ftoovfm.dll
2006-08-18 21:37 141312 –a—— C:\WINDOWS\system32\ymoofw.exe
2006-08-18 21:37 141312 –a—— C:\WINDOWS\system32\fkdrq.dat
2006-08-18 21:37 141312 –a—— C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rtbpl.exe
2006-08-04 10:37 73728 –a—— C:\WINDOWS\system32\dpl100.dll
2006-08-04 10:37 196608 –a—— C:\WINDOWS\system32\dtu100.dll
2006-07-21 03:24 72704 –a—— C:\WINDOWS\system32\hlink.dll
2006-07-18 21:51 53248 –a—— C:\WINDOWS\system32\ATIDDC.DLL
2006-06-21 05:43 520192 –a—— C:\WINDOWS\system32\DivXsm.exe
2006-06-21 05:42 200704 –a—— C:\WINDOWS\system32\ssldivx.dll
2006-06-21 05:42 1044480 –a—— C:\WINDOWS\system32\libdivx.dll
2006-06-21 05:34 57344 –a—— C:\WINDOWS\system32\dpv11.dll
2006-06-21 05:34 344064 –a—— C:\WINDOWS\system32\dpus11.dll
2006-06-21 05:34 294912 –a—— C:\WINDOWS\system32\dpu11.dll
2006-06-21 05:34 294912 –a—— C:\WINDOWS\system32\dpu10.dll


* * * PRE-RUN - Filepaths extracted by Memory Dump * * * * * * * * * * * * * * * * * * * * * *


2006-08-18 21:37 51712 C:\WINDOWS\system32\ftoovfm.dll
2006-08-18 21:37 141312 C:\WINDOWS\system32\ymoofw.exe
2006-08-26 19:10 23552 C:\WINDOWS\system32\brmwpcb.exe
2006-08-18 21:37 141312 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rtbpl.exe
2006-08-27 08:24 495 C:\WINDOWS\xhvuv.dll
2006-08-18 21:37 141312 C:\WINDOWS\system32\fkdrq.dat
2006-08-26 19:10 28672 C:\WINDOWS\system32\pvfsf.exe


* * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * *


06-08-18 21:37 141312 rtbpl.exe.qoo
06-08-18 21:37 141312 ymoofw.exe.qoo
06-08-18 21:37 141312 fkdrq.dat.qoo
06-08-18 21:37 51712 ftoovfm.dll.qoo
06-08-26 19:10 28672 pvfsf.exe.qoo
06-08-18 21:37 53 nlccow.dat.qoo

DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\ati2evxx.dll
C:\WINDOWS\system32\ati2evxx.dll


((((((((((((((((((((((((((((((( Files Created from 2006-07-27 to 2006-08-27 ))))))))))))))))))))))))))))))))))


2006-08-25 11:03 23,552 –a—— C:\WINDOWS\system32\brmwpcb.exe
2006-08-24 23:09 109,568 ——— C:\WINDOWS\system32\pxinsi64.exe
2006-08-24 23:09 108,544 ——— C:\WINDOWS\system32\pxcpyi64.exe
2006-08-24 23:07 761,856 –a—— C:\WINDOWS\system32\xvidcore.dll
2006-08-24 23:07 180,224 –a—— C:\WINDOWS\system32\xvidvfw.dll
2006-08-24 23:04 245,408 –a—— C:\WINDOWS\system32\unicows.dll
2006-08-24 23:03 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2006-08-19 14:37 127,208 –a—— C:\WINDOWS\system32\mucltui.dll
2006-08-18 21:37 495 –a—— C:\WINDOWS\xhvuv.dll
2006-08-17 05:22 778,240 C:\WINDOWS\system32Petz 5.scr
2006-08-15 16:44 212,480 ——— C:\WINDOWS\system32\PCDLIB32.DLL
2006-08-15 08:28 12,800 -ra—— C:\WINDOWS\system32\wing32.dll
2006-08-14 14:50 757,760 ——— C:\WINDOWS\NuNinst.exe
2006-08-14 07:20 81,920 –a—— C:\WINDOWS\system32\NNComm.dll
2006-08-14 07:20 446,464 –a—— C:\WINDOWS\system32\HHActiveX.dll
2006-08-14 07:20 24,576 –a—— C:\WINDOWS\system32\HookRes.dll
2006-08-13 18:01 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2006-08-12 17:56 94,208 –a—— C:\WINDOWS\DEVREG.DLL
2006-08-12 17:56 90,112 ——— C:\WINDOWS\Updreg.EXE
2006-08-12 17:56 84,992 ——— C:\WINDOWS\system32\SFCVRT32.DLL
2006-08-12 17:56 82,432 ——— C:\WINDOWS\system32\CTWFLT32.DLL
2006-08-12 17:56 77,824 –a—— C:\WINDOWS\system32\EAXAC3.DLL
2006-08-12 17:56 643,072 –a—— C:\WINDOWS\system32\CTSBLFX.DLL
2006-08-12 17:56 61,440 –a—— C:\WINDOWS\system32\CTAGENT.DLL
2006-08-12 17:56 61,440 –a—— C:\WINDOWS\MIDIDEF.EXE
2006-08-12 17:56 54,784 ——— C:\WINDOWS\system32\INETWH32.DLL
2006-08-12 17:56 53,552 ——— C:\WINDOWS\CTCCW.DLL
2006-08-12 17:56 53,248 –a—— C:\WINDOWS\system32\AC3API.DLL
2006-08-12 17:56 49,152 –a—— C:\WINDOWS\system32\KILLAPPS.EXE
2006-08-12 17:56 49,152 –a—— C:\WINDOWS\CTDCRES.DLL
2006-08-12 17:56 36,864 –a—— C:\WINDOWS\system32\REGPLIB.EXE
2006-08-12 17:56 36,864 –a—— C:\WINDOWS\system32\CTEMUPIA.DLL
2006-08-12 17:56 319,488 –a—— C:\WINDOWS\system32\CTDEVCON.DLL
2006-08-12 17:56 28,672 –a—— C:\WINDOWS\system32\CTSPKHLP.DLL
2006-08-12 17:56 270,336 –a—— C:\WINDOWS\system32\SFMS32.DLL
2006-08-12 17:56 26,768 ——— C:\WINDOWS\system32\CTL3D.DLL
2006-08-12 17:56 24,976 ——— C:\WINDOWS\CTRES.DLL
2006-08-12 17:56 24,576 –a—— C:\WINDOWS\system32\CTHELPER.EXE
2006-08-12 17:56 20,480 –a—— C:\WINDOWS\INRES.DLL
2006-08-12 17:56 184,320 –a—— C:\WINDOWS\PSCONV.EXE
2006-08-12 17:56 176,128 –a—— C:\WINDOWS\READREG.EXE
2006-08-12 17:56 155,648 –a—— C:\WINDOWS\system32\CTOSUSER.DLL
2006-08-12 17:56 149,504 ——— C:\WINDOWS\system32\MFCANS32.DLL
2006-08-12 17:56 135,168 –a—— C:\WINDOWS\system32\OPENAL32.DLL
2006-08-12 17:56 110,592 –a—— C:\WINDOWS\system32\PIAPROXY.DLL
2006-08-12 17:56 110,592 –a—— C:\WINDOWS\system32\COMMONFX.DLL
2006-08-12 17:56 108,032 ——— C:\WINDOWS\system32\MFCUIA32.DLL
2006-08-12 17:56 106,496 –a—— C:\WINDOWS\system32\CTDPROXY.DLL
2006-08-12 17:56 106,496 –a—— C:\WINDOWS\system32\CTASIO.DLL
2006-08-12 17:55 12,288 –a—— C:\WINDOWS\system32\AHQCpURes.dll
2006-08-12 17:54 6,752 ——— C:\WINDOWS\system32\PFMODNT.SYS
2006-08-12 16:32 520,192 ——— C:\WINDOWS\system32\ati2sgag.exe
2006-08-12 16:04 184,320 -ra—— C:\WINDOWS\W2KSetup.exe
2006-08-12 16:03 63,488 –a—— C:\WINDOWS\system32\unam4ie.exe
2006-08-12 16:03 4,608 –a—— C:\WINDOWS\system32\w95inf32.dll
2006-08-12 16:03 38,160 –a—— C:\WINDOWS\system32\LMRTREND.dll
2006-08-12 16:03 2,272 –a—— C:\WINDOWS\system32\w95inf16.dll
2006-08-12 16:03 194,320 –a—— C:\WINDOWS\system32\qcut.dll
2006-08-12 16:03 182,032 –a—— C:\WINDOWS\system32\dxtmsft3.dll
2006-08-12 16:03 10,240 –a—— C:\WINDOWS\system32\vidx16.dll
2006-08-12 16:02 306,688 –a—— C:\WINDOWS\IsUninst.exe
2006-08-12 16:02 12,288 -ra—— C:\WINDOWS\system32\sisinst.dll
2006-08-12 15:18 22,752 –a—— C:\WINDOWS\system32\spupdsvc.exe
2006-08-12 15:10 11,776 ——— C:\WINDOWS\system32\spnpinst.exe
2006-08-12 14:47 77,312 –a—— C:\WINDOWS\system32\browser.dll
2006-08-12 14:47 614,912 –a—— C:\WINDOWS\system32\h323msp.dll
2006-08-12 14:47 39,936 –a—— C:\WINDOWS\system32\mf3216.dll
2006-08-12 14:47 331,264 –a—— C:\WINDOWS\system32\ipnathlp.dll
2006-08-12 14:45 956,416 –a—— C:\WINDOWS\system32\msdtctm.dll
2006-08-12 14:45 91,136 –a—— C:\WINDOWS\system32\mtxoci.dll
2006-08-12 14:45 66,560 –a—— C:\WINDOWS\system32\mtxclu.dll
2006-08-12 14:45 625,152 –a—— C:\WINDOWS\system32\catsrvut.dll
2006-08-12 14:45 60,416 –a—— C:\WINDOWS\system32\colbact.dll
2006-08-12 14:45 581,120 –a—— C:\WINDOWS\system32\rpcrt4.dll
2006-08-12 14:45 540,160 –a—— C:\WINDOWS\system32\comuid.dll
2006-08-12 14:45 426,496 –a—— C:\WINDOWS\system32\msdtcprx.dll
2006-08-12 14:45 397,824 –a—— C:\WINDOWS\system32\rpcss.dll
2006-08-12 14:45 243,200 –a—— C:\WINDOWS\system32\es.dll
2006-08-12 14:45 225,792 –a—— C:\WINDOWS\system32\catsrv.dll
2006-08-12 14:45 161,280 –a—— C:\WINDOWS\system32\msdtcuiu.dll
2006-08-12 14:45 110,080 –a—— C:\WINDOWS\system32\clbcatex.dll
2006-08-12 14:45 101,376 –a—— C:\WINDOWS\system32\txflog.dll
2006-08-12 14:45 1,285,120 –a—— C:\WINDOWS\system32\ole32.dll
2006-08-12 14:45 1,267,200 –a—— C:\WINDOWS\system32\comsvcs.dll
2006-08-12 14:42 239,104 –a—— C:\WINDOWS\system32\srrstr.dll
2006-08-12 14:39 26,112 –a—— C:\WINDOWS\system32\xpsp1hfm.exe
2006-08-12 14:16 4,096 –a—— C:\WINDOWS\system32\ksuser.dll
2006-08-12 14:10 495,616 –a—— C:\WINDOWS\system32\sblfx.dll
2006-08-12 14:10 4,096 –a—— C:\WINDOWS\system32\ctwdm32.dll
2006-08-12 14:10 36,864 –a—— C:\WINDOWS\system32\sfman32.dll
2006-08-12 14:10 256,512 –a—— C:\WINDOWS\system32\devcon32.dll
2006-08-12 14:10 24,064 –a—— C:\WINDOWS\system32\devldr32.exe
2006-08-04 10:37 73,728 –a—— C:\WINDOWS\system32\dpl100.dll
2006-08-04 10:37 196,608 –a—— C:\WINDOWS\system32\dtu100.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-08-27 08:35 ——– dr——- C:\Program Files\Net Nanny
2006-08-27 08:23 ——– d——– C:\Program Files\Mozilla Firefox
2006-08-26 22:16 ——– d——– C:\Program Files\GameSpy Arcade
2006-08-26 21:18 ——– d——– C:\Program Files\LimeWire
2006-08-26 17:53 ——– d——– C:\Program Files\ewido anti-spyware 4.0
2006-08-26 07:21 ——– d——– C:\Program Files\Ahead
2006-08-25 20:22 ——– d——– C:\Program Files\Furcadia
2006-08-25 06:48 ——– d——– C:\Documents and Settings\Joseph\Application Data\Microsoft Games
2006-08-24 23:09 ——– d——– C:\Program Files\DivX
2006-08-24 23:07 ——– d——– C:\Program Files\XviD
2006-08-24 23:04 ——– d——– C:\Program Files\MsnMusic
2006-08-24 23:03 ——– d——– C:\Program Files\Windows Media Player
2006-08-23 08:24 777472 –a—— C:\WINDOWS\system32\drivers\avg7core.sys
2006-08-23 08:24 27904 –a—— C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-08-22 20:37 ——– d——– C:\Program Files\Google
2006-08-22 20:28 ——– d——– C:\Program Files\HP
2006-08-22 19:59 ——– d——– C:\Program Files\Yahoo!
2006-08-20 07:12 ——– d——– C:\Program Files\Winamp
2006-08-19 16:29 ——– d——– C:\Documents and Settings\Joseph\Application Data\TrojanHunter
2006-08-19 13:02 4992 –a—— C:\WINDOWS\system32\drivers\avgtdi.sys
2006-08-19 13:02 4288 –a—— C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-08-19 13:02 23424 –a—— C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-08-19 13:01 ——– d—s—- C:\Documents and Settings\Joseph\Application Data\Microsoft
2006-08-19 13:01 ——– d——– C:\Program Files\Grisoft
2006-08-19 08:00 ——– d——– C:\Documents and Settings\Joseph\Application Data\AVG7
2006-08-18 16:04 ——– d——– C:\Documents and Settings\Joseph\Application Data\Sun
2006-08-18 16:03 ——– d——– C:\Program Files\Java
2006-08-18 15:53 ——– d——– C:\Program Files\Common Files\Java
2006-08-18 15:53 ——– d——– C:\Program Files\Common Files
2006-08-17 05:22 ——– d——– C:\Program Files\Ubi Soft
2006-08-15 16:53 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-08-15 16:44 ——– d——– C:\Program Files\Common Files\Ulead Systems
2006-08-14 20:19 ——– d——– C:\Program Files\Microsoft Games
2006-08-14 16:30 ——– d——– C:\Program Files\Atari
2006-08-14 14:21 12528 –a—— C:\WINDOWS\system32\drivers\secdrv.sys
2006-08-14 00:41 ——– d——– C:\Documents and Settings\Joseph\Application Data\Leadertech
2006-08-14 00:32 ——– d——– C:\Program Files\NovaLogic
2006-08-14 00:30 ——– d——– C:\Program Files\Common Files\InstallShield
2006-08-14 00:08 ——– d——– C:\Program Files\Lavasoft
2006-08-14 00:08 ——– d——– C:\Documents and Settings\Joseph\Application Data\Lavasoft
2006-08-13 23:58 ——– d——– C:\Documents and Settings\Joseph\Application Data\Help
2006-08-13 20:51 ——– d——– C:\Documents and Settings\Joseph\Application Data\AdobeUM
2006-08-13 20:29 ——– d——– C:\Program Files\Common Files\Adobe
2006-08-13 19:23 ——– d——– C:\Documents and Settings\Joseph\Application Data\.BitTornado
2006-08-13 19:21 ——– d——– C:\Program Files\BitTornado
2006-08-13 18:17 ——– d——– C:\Documents and Settings\Joseph\Application Data\Mozilla
2006-08-13 08:52 ——– d——– C:\Program Files\CyberLink
2006-08-13 08:26 ——– d——– C:\Documents and Settings\Joseph\Application Data\Google
2006-08-12 22:58 ——– d——– C:\Documents and Settings\Joseph\Application Data\Macromedia
2006-08-12 22:54 1563 –a—— C:\Documents and Settings\Joseph\Application Data\AdobeDLM.log
2006-08-12 22:54 0 –a—— C:\Documents and Settings\Joseph\Application Data\dm.ini
2006-08-12 22:54 ——– d——– C:\Program Files\Adobe
2006-08-12 22:53 ——– d——– C:\Documents and Settings\Joseph\Application Data\Adobe
2006-08-12 18:10 ——– d——– C:\Program Files\PCI Audio Applications
2006-08-12 17:55 ——– d——– C:\Program Files\Creative
2006-08-12 16:35 ——– d——– C:\Documents and Settings\Joseph\Application Data\ATI
2006-08-12 16:33 ——– d——– C:\Program Files\ATI Technologies
2006-08-12 16:27 ——– d——– C:\Program Files\Internet Explorer
2006-08-12 16:05 ——– d——– C:\Documents and Settings\Joseph\Application Data\InterTrust
2006-08-12 16:04 ——– d——– C:\Program Files\C-Media
2006-08-12 15:56 ——– d——– C:\Program Files\Outlook Express
2006-08-12 15:56 ——– d——– C:\Program Files\Common Files\System
2006-08-12 15:53 ——– d——– C:\Program Files\Messenger
2006-08-12 15:24 ——– d——– C:\Program Files\Movie Maker
2006-08-12 15:22 ——– d——– C:\Program Files\Windows NT
2006-08-12 15:22 ——– d——– C:\Program Files\NetMeeting
2006-07-27 08:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-07-26 21:05 3596288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2006-07-21 03:24 72704 –a—— C:\WINDOWS\system32\hlink.dll
2006-07-18 21:58 258048 –a—— C:\WINDOWS\system32\ati2dvag.dll
2006-07-18 21:58 1621504 –a—— C:\WINDOWS\system32\drivers\ati2mtag.sys
2006-07-18 21:53 77824 –a—— C:\WINDOWS\system32\Oemdspif.dll
2006-07-18 21:53 26112 –a—— C:\WINDOWS\system32\Ati2mdxx.exe
2006-07-18 21:53 114688 –a—— C:\WINDOWS\system32\atipdlxx.dll
2006-07-18 21:52 86016 –a—— C:\WINDOWS\system32\ati2evxx.dll
2006-07-18 21:52 41984 –a—— C:\WINDOWS\system32\ati2edxx.dll
2006-07-18 21:51 53248 –a—— C:\WINDOWS\system32\ATIDDC.DLL
2006-07-18 21:51 401408 –a—— C:\WINDOWS\system32\ati2evxx.exe
2006-07-18 21:44 2732608 –a—— C:\WINDOWS\system32\ati3duag.dll
2006-07-18 21:39 1744416 –a—— C:\WINDOWS\system32\ativvaxx.dll
2006-07-18 21:27 204800 –a—— C:\WINDOWS\system32\atikvmag.dll
2006-07-18 21:26 17408 –a—— C:\WINDOWS\system32\atitvo32.dll
2006-07-18 21:23 307200 –a—— C:\WINDOWS\system32\atiiiexx.dll
2006-07-18 21:22 6684672 –a—— C:\WINDOWS\system32\atioglx1.dll
2006-07-18 21:22 286720 –a—— C:\WINDOWS\system32\ati2cqag.dll
2006-07-18 21:21 290816 –a—— C:\WINDOWS\system32\ATIDEMGR.dll
2006-07-18 21:13 5136384 –a—— C:\WINDOWS\system32\atioglxx.dll
2006-07-03 16:40 778240 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2006-07-03 16:40 778240 –a—— C:\WINDOWS\system32\divx_xx07.dll
2006-07-03 16:40 761856 –a—— C:\WINDOWS\system32\divx_xx11.dll
2006-07-03 16:40 620180 –a—— C:\WINDOWS\system32\DivX.dll
2006-06-21 14:00 0 -rahs—- C:\MSDOS.SYS
2006-06-21 14:00 0 -rahs—- C:\IO.SYS
2006-06-21 14:00 0 –a—— C:\CONFIG.SYS
2006-06-21 14:00 0 –a—— C:\AUTOEXEC.BAT
2006-06-21 08:20 62 –ahs—- C:\Documents and Settings\Joseph\Application Data\desktop.ini
2006-06-21 05:49 53248 –a—— C:\WINDOWS\system32\dpuGUI10.dll
2006-06-21 05:43 520192 –a—— C:\WINDOWS\system32\DivXsm.exe
2006-06-21 05:42 200704 –a—— C:\WINDOWS\system32\ssldivx.dll
2006-06-21 05:42 1044480 –a—— C:\WINDOWS\system32\libdivx.dll
2006-06-21 05:34 593920 –a—— C:\WINDOWS\system32\dpuGUI11.dll
2006-06-21 05:34 57344 –a—— C:\WINDOWS\system32\dpv11.dll
2006-06-21 05:34 344064 –a—— C:\WINDOWS\system32\dpus11.dll
2006-06-21 05:34 294912 –a—— C:\WINDOWS\system32\dpu11.dll
2006-06-21 05:34 294912 –a—— C:\WINDOWS\system32\dpu10.dll
2006-06-21 05:33 12288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll
2006-06-21 05:33 118784 –a—— C:\WINDOWS\system32\DivXCodecUpdateChecker.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NNTray"="C:\\Program Files\\Net Nanny\\nnstart.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,00,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^rtbpl.exe]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\rtbpl.exe"
"backup"="C:\\WINDOWS\\pss\\rtbpl.exeCommon Startup"
"location"="Common Startup"
"command"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\rtbpl.exe"
"item"="rtbpl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Joseph^Start Menu^Programs^Startup^Registration Dogz 5 - Catz 5 Compilation Jewelcase.LNK]
"path"="C:\\Documents and Settings\\Joseph\\Start Menu\\Programs\\Startup\\Registration Dogz 5 - Catz 5 Compilation Jewelcase.LNK"
"backup"="C:\\WINDOWS\\pss\\Registration Dogz 5 - Catz 5 Compilation Jewelcase.LNKStartup"
"location"="Startup"
"command"="D:\\REGIS~20.EXE -d 802744 -l english -r 7 -g Dogz 5 - Catz 5 Compilation Jewelcase -c us -i 2070"
"item"="Registration Dogz 5 - Catz 5 Compilation Jewelcase"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\!ewido]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ewido"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATICCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CLIStart"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AVG7_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\InCD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="InCD"
"hkey"="HKLM"
"command"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Jet Detection]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ADGJDet"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Creative\\SBLive\\PROGRAM\\ADGJDet.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Run]
"key"="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
"item"=" "
"hkey"="HKCU"
"command"=" "
"inimapping"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Spyware Doctor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="swdoctor"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\swg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleToolbarNotifier"
"hkey"="HKCU"
"command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.711.1664\\GoogleToolbarNotifier.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\THGuard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="THGuard"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\TrojanHunter 4.5\\THGuard.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ubahg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ymoofw"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ymoofw.exe reg_run"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\UpdReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="UpdReg"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\UpdReg.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\WINDVDPatch]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CTHELPER"
"hkey"="HKLM"
"command"="CTHELPER.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\yesgfu]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ymoofw"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\ymoofw.exe reg_run"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\services]
"NNSvc"=dword:00000002



Completion time: Sun 08/27/2006 8:38:21.04
ComboFix.txt




08/27/06 08:42:10 [Info]: BlackLight Engine 1.0.46 initialized
08/27/06 08:42:10 [Info]: OS: 5.1 build 2600 (Service Pack 2)
08/27/06 08:42:11 [Note]: 7019 4
08/27/06 08:42:11 [Note]: 7005 0
08/27/06 08:42:16 [Note]: 7006 0
08/27/06 08:42:16 [Note]: 7011 1732
08/27/06 08:42:17 [Note]: 7026 0
08/27/06 08:42:17 [Note]: 7026 0
08/27/06 08:42:21 [Note]: FSRAW library version 1.7.1019
08/27/06 08:44:39 [Note]: 7007 0
Post #11
Also I noticed these entries C:\WINDOWS\system32\ati2evxx.dll C:\WINDOWS\system32\ati2evxx.dll, were deleted and wondered if they had anything to do with my graphics card?
Post #12
Hi Brainhiccup,

Also I noticed these entries C:\WINDOWS\system32\ati2evxx.dll C:\WINDOWS\system32\ati2evxx.dll, were deleted and wondered if they had anything to do with my graphics card?


Yes, you're right, they were mistakenly deleted by combofix. This is a direct statement which came from sUBs, the creator of combofix:

Please offer my apologies to the user. If he wishes, he can download a replacement from here

http://download.bleepingcomputer.com/sUBs/ati2evxx.dll

Reinstalling the driver would be a better alternative



Go to control panel > add/remove programs > Uninstall the items in bold if found.

Limewire
BitTornado
These programs could probably be the reason why you are having some malware troubles. Having a P2p program on your machine is like playing with fire. I suggest you remove those

Reboot
==========================
Open notepad. It must be notepad, not wordpad.
Copy and paste the text inside the code box below into notepad, including the blank line at the end.
Choose file save as and set file type to all files.
Type fixreg.reg in the file name and save it to your desktop.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^rtbpl.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ubahg]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\yesgfu]




Make sure there are NO blank lines before REGEDIT4
Make sure there IS one blank line at the end of the file.

Close notepad. Make sure that all windows are closed.

Find the fixreg.reg file on your desktop.
Double click it.
It will then ask if you want the file merged to your registry.
Answer yes.
==========================
Reboot into Safe Mode

You may want to print these instructions here or save them in notepad since you'll work offline

To enter Safe Mode

Click start > turn off computer > Restart > When you hear the computer beep once, begin tapping F8 rapidly > this will bring up a menu > use your keyboard to scroll to safe mode > hit enter
You may need to see your hidden files first

Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files option.
* Click Yes to confirm.
* Click OK.

You can refer to this site HERE
==========================
Open Windows Explorer by hitting your windows key + E at the same time.
*If you do not have a windows key, double click my computer > click the folders icon

Then navigate to these files and delete them:

C:\WINDOWS\xhvuv.dll
C:\WINDOWS\system32Petz 5.scr
C:\WINDOWS\System32\brmwpcb.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rtbpl.exe

Empty your recycle bin

Reboot back to normal mode
==========================
On your next reply, please include:
  • A Fresh Hijackthis log
  • A detailed description on how your computer is behaving
Post #13
I was unable to locate and delete the following:
C:\WINDOWS\system32Petz 5.scr
C:\WINDOWS\System32\brmwpcb.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rtbpl.exe
Any ideas?
Also I dont have the drivers for my vid card so can I just add back in that one or two .dlls?
Here is a current Hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 11:15:01 AM, on 9/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Net Nanny\nnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Net Nanny\nnstart.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Net Nanny\nntray.exe
C:\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NNTray] C:\Program Files\Net Nanny\nnstart.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1150921350061
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1155411036358
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NNSvc - Net Nanny Software International, Inc. - C:\Program Files\Net Nanny\nnsvc.exe
Post #14
OMG and I have had some programs go down. Programs like Winamp which I reinstalled, but Net Nanny is not loading, won't let me uninstall, (I get a Installshield Engine iKernel error) and I'm afraid has some kind of power over all programs. Haven't seen anything else out of the ordinary…yet.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI