Spyware / Malware / Virus Removal

I have a mess

1 min read

Looking for the outcome? Ask AI

SAIL Topic Starter

Post #1October 17, 2006, 3:40 PM UTC

OK, I´ve been working on this for days. I have done the following:

Run adaware
Reboot
Run Spybot
Reboot
Safe Mode
Run AVG antispy
reboot
Run AVG antispy
run cleaner

Now the system has gotten worse. The problem appears to be iebar. Both AVG antivirus and antispyware identify it, but they can´t delete it or move it to the vault. The only way I can make this thing function at all now is in safe mode. So, the following logs are from safe mode.

Hijack This
Logfile of HijackThis v1.99.1
Scan saved at 11:17:52 a.m., on 17/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sailcharlotte.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.latino.msn.com/0SEESUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\adocbc.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: netup - {0A44CDEC-87D0-4D4D-BF97-DE9AFB9B104A} - C:\WINDOWS\System32\netidp.dll
O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush.dll
O2 - BHO: SYM - {36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} - C:\WINDOWS\System32\usersrd.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: google bar - {607E95A1-8F89-4343-B9BC-2EFC2B291BB4} - C:\WINDOWS\System32\googlebar.dll
O2 - BHO: JMX.JmxCenter - {63859236-76BF-493C-A587-DF479EBA2D4B} - C:\WINDOWS\System32\EJMX.dll
O2 - BHO: (no name) - {6E1BC898-505A-44f4-BC88-BCE43016AC96} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9C363D55-07D7-433d-A13E-D9C105202F6F} - (no file)
O2 - BHO: bingo - {B626AE7E-4F5D-4CD4-B457-D8693015DEFC} - C:\WINDOWS\System32\amvda.dll
O2 - BHO: BrowserProxy4 - {BCF4D74B-E6BD-4C8F-83D7-90D6439705B9} - C:\WINDOWS\System32\AlxTbl.dll (file missing)
O2 - BHO: Barra de herramientas de MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\es-us\msntb.dll
O2 - BHO: isObject Class - {BE0B5843-553A-48C2-9A42-258A1D791AFC} - C:\WINDOWS\DOWNLO~1\tbcast.dll (file missing)
O2 - BHO: (no name) - {D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7} - (no file)
O2 - BHO: 1 - {E78F50F9-51CF-40EC-AE3F-4F802528150B} - C:\WINDOWS\Downloader.dll
O2 - BHO: Subconscious Intruder - {EBBC6E6D-7B65-46be-B509-86CED2D17876} - C:\WINDOWS\SYSTEM32\Inte32.dll
O2 - BHO: (no name) - {FE32DECF-06AD-426E-9F53-3018A366B5AE} - C:\WINDOWS\SYSTEM32\sys32version.dll (file missing)
O3 - Toolbar: Barra de herramientas de MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\es-us\msntb.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [realtpsk] C:\WINDOWS\system\realsched.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Búsqueda en el escritorio de Windows.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\es-us\bin\WindowsSearch.exe
O4 - Global Startup: IE-Bar.lnk = C:\Program Files\Common Files\IE-Bar\iebar.exe
O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\es-us\msntb.dll/search.htm
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html…45YYUS_ZZzebYYY
O8 - Extra context menu item: Abrir en nueva ficha de fondo - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\es-us\msntabres.dll/229?f7c64ee627e44238940608e56a9b59
O8 - Extra context menu item: Abrir en nueva ficha en primer plano - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\es-us\msntabres.dll/230?f7c64ee627e44238940608e56a9b59
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: www.myaccucare.com
O15 - Trusted IP range: 64.127.104.144 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://carolinaspinkworld.spaces.msn.com//…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1095962375093
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD0F213-465A-4A65-AE1C-5D5F4782A3FE}: NameServer = 205.152.37.23,192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DD0F213-465A-4A65-AE1C-5D5F4782A3FE}: NameServer = 205.152.37.23,192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{4DD0F213-465A-4A65-AE1C-5D5F4782A3FE}: NameServer = 205.152.37.23,192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - C:\WINDOWS\webwork\webwork.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ClipBook (ClipSrv) - SMSoft - C:\WINDOWS\system32\SVCH0ST.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

AVG
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 11:01:36 a.m. 17/10/2006

+ Scan result:

HKLM\SOFTWARE\Classes\VCCPGDATAACCESS.PgDataAccessCtrl.1 -> Adware.Delfin : Error during cleaning.Unkown Error
C:\Program Files\Common Files\IE-Bar\dmbar.dll -> Adware.Dmad : Marked for delete on rebootUnkown Error
C:\WINDOWS\SYSTEM32\DRIVERS\ProcServ.sys -> Adware.Ncast : Marked for delete on rebootUnkown Error
HKLM\SOFTWARE\Classes\MEDIATICKETSINSTALLER.MediaTicketsInstallerCtrl.1 -> Adware.PurityScan : Error during cleaning.Unkown Error
HKLM\SOFTWARE\Classes\Sep.Band -> Adware.SEP : Error during cleaning.Unkown Error
HKLM\SOFTWARE\Classes\Sep.Band.1 -> Adware.SEP : Error during cleaning.Unkown Error
HKLM\SOFTWARE\Classes\Sep.Search -> Adware.SEP : Error during cleaning.Unkown Error
HKLM\SOFTWARE\Classes\Sep.Search.1 -> Adware.SEP : Error during cleaning.Unkown Error
C:\Documents and Settings\taustin\Local Settings\Temporary Internet Files\Content.IE5\KLXHR3Q4\updatesetup[1].exe/Setup.exe -> Adware.VB : Marked for delete on rebootUnkown Error
C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP760\A0090599.exe/Setup.exe -> Adware.VB : Marked for delete on rebootUnkown Error
C:\WINDOWS\SYSTEM32\jmxsetup.exe/Setup.exe -> Adware.VB : Marked for delete on rebootUnkown Error
C:\WINDOWS\SYSTEM32\DRIVERS\fsprot.sys -> Adware.WSearch : Marked for delete on rebootUnkown Error
C:\RECYCLER\S-1-5-21-1219610485-3312601657-3688778432-1007\Dc2.txt -> Backdoor.Delf.auu : Marked for delete on rebootUnkown Error
C:\RECYCLER\S-1-5-21-1219610485-3312601657-3688778432-1007\Dc3.exe -> Backdoor.Delf.auu : Marked for delete on rebootUnkown Error
C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP760\A0090598.exe -> Backdoor.Delf.auu : Marked for delete on rebootUnkown Error
C:\Program Files\Common Files\IE-Bar\dmipn.dll -> Downloader.Delf.asz : Marked for delete on rebootUnkown Error
C:\Documents and Settings\taustin\Local Settings\Temporary Internet Files\Content.IE5\KLXHR3Q4\update5[1].exe -> Dropper.Agent.axt : Marked for delete on rebootUnkown Error
C:\WINDOWS\update5.exe -> Dropper.Agent.axt : Marked for delete on rebootUnkown Error

I will try to reboot and get Hijack to run in reg mode….but don´t know how successful I will be.

SAIL

Post #2October 17, 2006, 5:18 PM UTC

OK…I was able to run it in reg mode, so here is hijack log

Logfile of HijackThis v1.99.1
Scan saved at 11:32:03 a.m., on 17/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\Svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\RUNDLL.EXE
C:\WINDOWS\System32\server.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\winlogon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sailcharlotte.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.latino.msn.com/0SEESUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\adocbc.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: netup - {0A44CDEC-87D0-4D4D-BF97-DE9AFB9B104A} - C:\WINDOWS\System32\netidp.dll
O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush.dll
O2 - BHO: SYM - {36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} - C:\WINDOWS\System32\usersrd.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: google bar - {607E95A1-8F89-4343-B9BC-2EFC2B291BB4} - C:\WINDOWS\System32\googlebar.dll
O2 - BHO: JMX.JmxCenter - {63859236-76BF-493C-A587-DF479EBA2D4B} - C:\WINDOWS\System32\EJMX.dll
O2 - BHO: (no name) - {6E1BC898-505A-44f4-BC88-BCE43016AC96} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9C363D55-07D7-433d-A13E-D9C105202F6F} - (no file)
O2 - BHO: bingo - {B626AE7E-4F5D-4CD4-B457-D8693015DEFC} - C:\WINDOWS\System32\amvda.dll
O2 - BHO: BrowserProxy4 - {BCF4D74B-E6BD-4C8F-83D7-90D6439705B9} - C:\WINDOWS\System32\AlxTbl.dll (file missing)
O2 - BHO: Barra de herramientas de MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\es-us\msntb.dll
O2 - BHO: isObject Class - {BE0B5843-553A-48C2-9A42-258A1D791AFC} - C:\WINDOWS\DOWNLO~1\tbcast.dll (file missing)
O2 - BHO: (no name) - {D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7} - (no file)
O2 - BHO: 1 - {E78F50F9-51CF-40EC-AE3F-4F802528150B} - C:\WINDOWS\Downloader.dll
O2 - BHO: Subconscious Intruder - {EBBC6E6D-7B65-46be-B509-86CED2D17876} - C:\WINDOWS\SYSTEM32\Inte32.dll
O2 - BHO: (no name) - {FE32DECF-06AD-426E-9F53-3018A366B5AE} - C:\WINDOWS\SYSTEM32\sys32version.dll (file missing)
O3 - Toolbar: Barra de herramientas de MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\es-us\msntb.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [realtpsk] C:\WINDOWS\system\realsched.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Búsqueda en el escritorio de Windows.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\es-us\bin\WindowsSearch.exe
O4 - Global Startup: IE-Bar.lnk = C:\Program Files\Common Files\IE-Bar\iebar.exe
O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\es-us\msntb.dll/search.htm
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html…45YYUS_ZZzebYYY
O8 - Extra context menu item: Abrir en nueva ficha de fondo - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\es-us\msntabres.dll/229?f7c64ee627e44238940608e56a9b59
O8 - Extra context menu item: Abrir en nueva ficha en primer plano - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\es-us\msntabres.dll/230?f7c64ee627e44238940608e56a9b59
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: www.myaccucare.com
O15 - Trusted IP range: 64.127.104.144 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://carolinaspinkworld.spaces.msn.com//…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1095962375093
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD0F213-465A-4A65-AE1C-5D5F4782A3FE}: NameServer = 205.152.37.23,192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DD0F213-465A-4A65-AE1C-5D5F4782A3FE}: NameServer = 205.152.37.23,192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{4DD0F213-465A-4A65-AE1C-5D5F4782A3FE}: NameServer = 205.152.37.23,192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - C:\WINDOWS\webwork\webwork.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ClipBook (ClipSrv) - SMSoft - C:\WINDOWS\system32\SVCH0ST.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

Thanks for any help!

SAIL

Post #3October 18, 2006, 1:12 PM UTC

I have not received a response. PLEASE HELP!!!!!!!!!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

I have a mess

✨ Ask AI

Ask AI