ssr2115
Topic Starter
I used the restore back to sp1
HJT log listed
Spydoctor listed
Please help
Logfile of HijackThis v1.99.1
Scan saved at 18:34:52, on 20/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ishost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Update.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\ismini.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\ssrout\Local Settings\Temp\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Spyware Doctor Activity Report
Generated on 20/10/2006 18:10:29 Spyware Doctor Homepage PC Tools Homepage Technical Support
Scans (basic information only):
Scan Results:
scan start: 20/10/2006 18:11:40
scan stop: 20/10/2006 18:26:44
scanned items: 104269
found items: 171
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner
Infection Name Location Risk
PSGuard Desktop Hijacker C:\Documents and Settings\All Users.WINDOWS\Desktop\Online Security Guide.url High
PSGuard Desktop Hijacker C:\Documents and Settings\All Users.WINDOWS\Start Menu\Online Security Guide.url High
PSGuard Desktop Hijacker C:\Documents and Settings\All Users.WINDOWS\Start Menu\Security Troubleshooting.url High
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp Elevated
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp\Toolbar Vision Elevated
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt Elevated
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt Elevated
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@247realmedia[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@adlegend[1].txt (Remnant) Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@atdmt[1].txt Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@cgi-bin[2].txt (Remnant) Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@doubleclick[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@mediaplex[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@overture[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\[removed][1].txt Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\[removed][2].txt Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@tribalfusion[1].txt Low
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\4DS7GNKN\arrow[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\4DS7GNKN\ico4[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\4DS7GNKN\spacer[1].gif High
Rogue Anti-Spyware Products C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\download2[1].htm High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\ico2[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\ico5[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\logo[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\CXQV8L6F\2-120x90[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\CXQV8L6F\CAB20ZJT.swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\EDQ9ITIV\CA27O5AZ.swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\KXIZWDUJ\ico1[1].gif High
Rogue Anti-Spyware Products C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\KXIZWDUJ\Scanner2[1].swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\OLE7OD2V\bar[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\OLE7OD2V\ico3[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\OLE7OD2V\styles[1].css High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\WLYBO5IN\CATGID17.swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\button2[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\spacer[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\stats[1].jpg High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\top1[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\top1_menu[1].gif High
Maxifiles C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\services.dll High
Maxifiles C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Update.exe High
Maxifiles C:\Program Files\Common Files\{388B5A65-0975-2057-0314-03040130002c}\Activate.exe High
Maxifiles C:\Program Files\Common Files\{388B5A65-0975-2057-0314-03040130002c}\MyToolBar.dll High
MediaTickets C:\Program Files\Common Files\Yazzle1162OinAdmin.exe Elevated
MediaTickets C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe Elevated
Common Components Unrelated C:\Program Files\InetGet2 Medium
WhenU.SaveNow C:\Program Files\Save Info & PUAs
WhenU.SaveNow C:\Program Files\Save\Save.exe.acm.dll.mdmp Info & PUAs
VSToolbar C:\Program Files\VSToolbar Elevated
VSToolbar C:\Program Files\VSToolbar\VSToolBar.dll Elevated
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP122\A0026074.exe High
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP122\A0026075.exe High
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP123\A0026079.exe High
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP123\A0026080.exe High
SafetyBar C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP123\A0026082.dll Medium
SafetyBar C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP137\A0027112.dll Medium
SpyAxe C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP146\A0028061.dll Elevated
VSToolbar C:\System Volume Information\_restore{D2CB9BD5-C2DB-4DB0-A195-DFBC6332C8D4}\RP11\A0004239.dll Elevated
MediaTickets C:\System Volume Information\_restore{D2CB9BD5-C2DB-4DB0-A195-DFBC6332C8D4}\RP12\A0004261.exe Elevated
Trojan.Busky C:\System Volume Information\_restore{D2CB9BD5-C2DB-4DB0-A195-DFBC6332C8D4}\RP24\A0008571.dll High
Trojan.Popuper C:\WINDOWS\System32\components\flx0.dll High
Trojan.Popuper C:\WINDOWS\System32\components\flx1.dll High
Trojan.Popuper C:\WINDOWS\System32\components\flx2.dll High
Trojan.Popuper C:\WINDOWS\System32\ishost.exe High
Trojan.Popuper C:\WINDOWS\System32\ismini.exe High
Trojan.Popuper C:\WINDOWS\System32\issearch.exe High
Trojan.Busky C:\WINDOWS\system32\ldlehth.dll High
Trojan.Busky C:\WINDOWS\system32\mrlpapb.dll High
Trojan.Busky C:\WINDOWS\system32\ooqgwql.dll High
PSGuard Desktop Hijacker C:\WINDOWS\System32\ot.ico High
VSToolbar C:\WINDOWS\system32\phcydfau.exe Elevated
Virtumonde C:\WINDOWS\system32\qomjkjh.dll Elevated
Trojan.Downloader.Small.CML C:\WINDOWS\system32\winfvy32.dll High
Virtumonde C:\WINDOWS\system32\wvusr.dll Elevated
Trojan.Busky Explorer.EXE (C:\WINDOWS\System32\ldlehth.dll) High
Virtumonde Explorer.EXE (C:\WINDOWS\System32\wvusr.dll) Elevated
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A} High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}## High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32 High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32## High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32##ThreadingModel High
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}## Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32 Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32## Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32##ThreadingModel Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D} Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}## Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32 Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32## Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32##ThreadingModel Elevated
Trojan.Busky HKCU\Software\AdwareDisableKey3 High
Trojan.Busky HKCU\Software\AdwareDisableKey3## High
VSToolbar HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser##{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
Maxifiles HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run##{088B5A65-0975-2057-0314-03040130002c} High
VSToolbar HKCU\Software\Search Toolbar Corp Elevated
VSToolbar HKCU\Software\Search Toolbar Corp## Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision## Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options## Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##Default Action Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##New Window Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##Show Page Search Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##Sort Method Elevated
Trojan.Busky HKLM\Software\AdwareDisableKey3 High
Trojan.Busky HKLM\Software\AdwareDisableKey3## High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A} High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}## High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32 High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32## High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32##ThreadingModel High
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}## Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32 Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32## Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32##ThreadingModel Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D} Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}## Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32 Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32## Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32##ThreadingModel Elevated
VSToolbar HKLM\Software\Microsoft\Internet Explorer\Toolbar##{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
Maxifiles HKLM\Software\Microsoft\Internet Explorer\Toolbar##{C004DEC2-2623-438E-9CA2-C9043AB28508} High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR## High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##BPTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##Brnd High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##BSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##Data High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##LID High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##LSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##MSLIST High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##PID High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##PSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##Rid High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##SCLIST High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##SSLIST High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##SSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32 High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32## High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Asynchronous High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\winfvy32##DllName High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Impersonate High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Shutdown High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Startup High
Virtumonde HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\wvusr##DllName Elevated
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08D89992-051F-4DD2-9ADB-06935F93756A} High
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08D89992-051F-4DD2-9ADB-06935F93756A}## High
Virtumonde HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D} Elevated
Virtumonde HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}## Elevated
Trojan.Popuper HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run##ishost.exe High
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Run##mrlpapb.dll High
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Run##ooqgwql.dll High
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51}## Elevated
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51}##DisplayName Elevated
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51}##UninstallString Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin## Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin##DisplayName Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin##UninstallString Elevated
Trojan.Busky iexplore.exe (C:\WINDOWS\System32\ldlehth.dll) High
Trojan.Busky iexplore.exe (C:\WINDOWS\System32\mrlpapb.dll) High
Virtumonde iexplore.exe (C:\WINDOWS\System32\wvusr.dll) Elevated
Trojan.Popuper ishost.exe (C:\WINDOWS\System32\ishost.exe) High
Trojan.Popuper ismini.exe (C:\WINDOWS\System32\ismini.exe) High
Common Components for Trojans multiple Medium
Trojan.Busky rundll32.exe (C:\WINDOWS\System32\mrlpapb.dll) High
Trojan.Busky rundll32.exe (C:\WINDOWS\System32\ooqgwql.dll) High
Maxifiles Update.exe (C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Services.dll) High
Maxifiles Update.exe (C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Update.exe) High
Other Sections:
Copyright ? 2003 PC Tools Research Pty Ltd. All rights reserved. Legal Notice
sigs
Click to go back
HJT log listed
Spydoctor listed
Please help
Logfile of HijackThis v1.99.1
Scan saved at 18:34:52, on 20/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ishost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Update.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\ismini.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\ssrout\Local Settings\Temp\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Spyware Doctor Activity Report
Generated on 20/10/2006 18:10:29 Spyware Doctor Homepage PC Tools Homepage Technical Support
Scans (basic information only):
Scan Results:
scan start: 20/10/2006 18:11:40
scan stop: 20/10/2006 18:26:44
scanned items: 104269
found items: 171
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner
Infection Name Location Risk
PSGuard Desktop Hijacker C:\Documents and Settings\All Users.WINDOWS\Desktop\Online Security Guide.url High
PSGuard Desktop Hijacker C:\Documents and Settings\All Users.WINDOWS\Start Menu\Online Security Guide.url High
PSGuard Desktop Hijacker C:\Documents and Settings\All Users.WINDOWS\Start Menu\Security Troubleshooting.url High
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp Elevated
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp\Toolbar Vision Elevated
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt Elevated
VSToolbar C:\Documents and Settings\ssrout\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt Elevated
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@247realmedia[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@adlegend[1].txt (Remnant) Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@atdmt[1].txt Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@cgi-bin[2].txt (Remnant) Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@doubleclick[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@mediaplex[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\ssrout@overture[1].txt Low
Advertising C:\Documents and Settings\ssrout\Cookies\[removed][1].txt Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\[removed][2].txt Low
Tracking Cookie(s) C:\Documents and Settings\ssrout\Cookies\ssrout@tribalfusion[1].txt Low
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\4DS7GNKN\arrow[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\4DS7GNKN\ico4[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\4DS7GNKN\spacer[1].gif High
Rogue Anti-Spyware Products C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\download2[1].htm High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\ico2[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\ico5[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\C5AZODIR\logo[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\CXQV8L6F\2-120x90[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\CXQV8L6F\CAB20ZJT.swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\EDQ9ITIV\CA27O5AZ.swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\KXIZWDUJ\ico1[1].gif High
Rogue Anti-Spyware Products C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\KXIZWDUJ\Scanner2[1].swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\OLE7OD2V\bar[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\OLE7OD2V\ico3[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\OLE7OD2V\styles[1].css High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\WLYBO5IN\CATGID17.swf High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\button2[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\spacer[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\stats[1].jpg High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\top1[1].gif High
Known Bad Sites C:\Documents and Settings\ssrout\Local Settings\Temporary Internet Files\Content.IE5\YDYXQLA5\top1_menu[1].gif High
Maxifiles C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\services.dll High
Maxifiles C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Update.exe High
Maxifiles C:\Program Files\Common Files\{388B5A65-0975-2057-0314-03040130002c}\Activate.exe High
Maxifiles C:\Program Files\Common Files\{388B5A65-0975-2057-0314-03040130002c}\MyToolBar.dll High
MediaTickets C:\Program Files\Common Files\Yazzle1162OinAdmin.exe Elevated
MediaTickets C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe Elevated
Common Components Unrelated C:\Program Files\InetGet2 Medium
WhenU.SaveNow C:\Program Files\Save Info & PUAs
WhenU.SaveNow C:\Program Files\Save\Save.exe.acm.dll.mdmp Info & PUAs
VSToolbar C:\Program Files\VSToolbar Elevated
VSToolbar C:\Program Files\VSToolbar\VSToolBar.dll Elevated
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP122\A0026074.exe High
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP122\A0026075.exe High
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP123\A0026079.exe High
DialerPlatform C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP123\A0026080.exe High
SafetyBar C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP123\A0026082.dll Medium
SafetyBar C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP137\A0027112.dll Medium
SpyAxe C:\System Volume Information\_restore{3A5D022A-07C8-4108-86B0-895F6DCABBFC}\RP146\A0028061.dll Elevated
VSToolbar C:\System Volume Information\_restore{D2CB9BD5-C2DB-4DB0-A195-DFBC6332C8D4}\RP11\A0004239.dll Elevated
MediaTickets C:\System Volume Information\_restore{D2CB9BD5-C2DB-4DB0-A195-DFBC6332C8D4}\RP12\A0004261.exe Elevated
Trojan.Busky C:\System Volume Information\_restore{D2CB9BD5-C2DB-4DB0-A195-DFBC6332C8D4}\RP24\A0008571.dll High
Trojan.Popuper C:\WINDOWS\System32\components\flx0.dll High
Trojan.Popuper C:\WINDOWS\System32\components\flx1.dll High
Trojan.Popuper C:\WINDOWS\System32\components\flx2.dll High
Trojan.Popuper C:\WINDOWS\System32\ishost.exe High
Trojan.Popuper C:\WINDOWS\System32\ismini.exe High
Trojan.Popuper C:\WINDOWS\System32\issearch.exe High
Trojan.Busky C:\WINDOWS\system32\ldlehth.dll High
Trojan.Busky C:\WINDOWS\system32\mrlpapb.dll High
Trojan.Busky C:\WINDOWS\system32\ooqgwql.dll High
PSGuard Desktop Hijacker C:\WINDOWS\System32\ot.ico High
VSToolbar C:\WINDOWS\system32\phcydfau.exe Elevated
Virtumonde C:\WINDOWS\system32\qomjkjh.dll Elevated
Trojan.Downloader.Small.CML C:\WINDOWS\system32\winfvy32.dll High
Virtumonde C:\WINDOWS\system32\wvusr.dll Elevated
Trojan.Busky Explorer.EXE (C:\WINDOWS\System32\ldlehth.dll) High
Virtumonde Explorer.EXE (C:\WINDOWS\System32\wvusr.dll) Elevated
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A} High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}## High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32 High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32## High
Trojan.Busky HKCR\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32##ThreadingModel High
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}## Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32 Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32## Elevated
VSToolbar HKCR\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32##ThreadingModel Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D} Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}## Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32 Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32## Elevated
Virtumonde HKCR\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32##ThreadingModel Elevated
Trojan.Busky HKCU\Software\AdwareDisableKey3 High
Trojan.Busky HKCU\Software\AdwareDisableKey3## High
VSToolbar HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser##{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
Maxifiles HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run##{088B5A65-0975-2057-0314-03040130002c} High
VSToolbar HKCU\Software\Search Toolbar Corp Elevated
VSToolbar HKCU\Software\Search Toolbar Corp## Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision## Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options## Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##Default Action Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##New Window Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##Show Page Search Elevated
VSToolbar HKCU\Software\Search Toolbar Corp\Toolbar Vision\Options##Sort Method Elevated
Trojan.Busky HKLM\Software\AdwareDisableKey3 High
Trojan.Busky HKLM\Software\AdwareDisableKey3## High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A} High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}## High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32 High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32## High
Trojan.Busky HKLM\Software\Classes\CLSID\{08D89992-051F-4DD2-9ADB-06935F93756A}\InprocServer32##ThreadingModel High
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}## Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32 Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32## Elevated
VSToolbar HKLM\Software\Classes\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InProcServer32##ThreadingModel Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D} Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}## Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32 Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32## Elevated
Virtumonde HKLM\Software\Classes\CLSID\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}\InprocServer32##ThreadingModel Elevated
VSToolbar HKLM\Software\Microsoft\Internet Explorer\Toolbar##{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
Maxifiles HKLM\Software\Microsoft\Internet Explorer\Toolbar##{C004DEC2-2623-438E-9CA2-C9043AB28508} High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR## High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##BPTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##Brnd High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##BSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##Data High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##LID High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##LSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##MSLIST High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##PID High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##PSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##Rid High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##SCLIST High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##SSLIST High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\MSSMGR##SSTV High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32 High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32## High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Asynchronous High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\winfvy32##DllName High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Impersonate High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Shutdown High
Trojan.Downloader.Small.CML HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winfvy32##Startup High
Virtumonde HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\wvusr##DllName Elevated
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08D89992-051F-4DD2-9ADB-06935F93756A} High
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08D89992-051F-4DD2-9ADB-06935F93756A}## High
Virtumonde HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D} Elevated
Virtumonde HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC7E68B8-2B18-4932-9F2A-AB28440B8B0D}## Elevated
Trojan.Popuper HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run##ishost.exe High
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Run##mrlpapb.dll High
Trojan.Busky HKLM\Software\Microsoft\Windows\CurrentVersion\Run##ooqgwql.dll High
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51} Elevated
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51}## Elevated
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51}##DisplayName Elevated
VSToolbar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{821F87FF-8245-4972-9E28-732E92EC2F51}##UninstallString Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin## Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin##DisplayName Elevated
MediaTickets HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1162Oin##UninstallString Elevated
Trojan.Busky iexplore.exe (C:\WINDOWS\System32\ldlehth.dll) High
Trojan.Busky iexplore.exe (C:\WINDOWS\System32\mrlpapb.dll) High
Virtumonde iexplore.exe (C:\WINDOWS\System32\wvusr.dll) Elevated
Trojan.Popuper ishost.exe (C:\WINDOWS\System32\ishost.exe) High
Trojan.Popuper ismini.exe (C:\WINDOWS\System32\ismini.exe) High
Common Components for Trojans multiple Medium
Trojan.Busky rundll32.exe (C:\WINDOWS\System32\mrlpapb.dll) High
Trojan.Busky rundll32.exe (C:\WINDOWS\System32\ooqgwql.dll) High
Maxifiles Update.exe (C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Services.dll) High
Maxifiles Update.exe (C:\Program Files\Common Files\{088B5A65-0975-2057-0314-03040130002c}\Update.exe) High
Other Sections:
Copyright ? 2003 PC Tools Research Pty Ltd. All rights reserved. Legal Notice
sigs
Click to go back