Spyware / Malware / Virus Removal

Please help new comer

5 min read

Looking for the outcome? Ask AI

elf405 Topic Starter

Post #1November 17, 2006, 4:58 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 16:52, on 06-11-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\Program Files\Common Files\Microsoft Shared\Media Manager\airsvcu.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Canon\CAL\CALMAIN.exe
G:\WINDOWS\system32\wscntfy.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
G:\WINDOWS\Mixer.exe
G:\WINDOWS\system32\atiptaxx.exe
G:\WINDOWS\system32\mswinup.exe
G:\WINDOWS\system32\winsvcup.exe
G:\WINDOWS\system32\winupsvc.exe
G:\DOCUME~1\John\LOCALS~1\Temp\svchost.exe
G:\PROGRA~1\Grisoft\AVG7\avgcc.exe
G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
G:\Program Files\QuickTime\qttask.exe
G:\Program Files\iTunes\iTunesHelper.exe
G:\WINDOWS\win32101112558595.exe
G:\WINDOWS\win32075951112558.exe
G:\WINDOWS\hkgryhiA.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\ATI Multimedia\main\launchpd.exe
G:\Program Files\Messenger\msmsgs.exe
G:\PROGRA~1\COMMON~1\imzf\imzfm.exe
G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
G:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
G:\Program Files\iPod\bin\iPodService.exe
G:\Program Files\palmOne\Hotsync.exe
G:\PROGRA~1\Grisoft\AVG7\avgw.exe
G:\PROGRA~1\COMMON~1\imzf\imzfa.exe
G:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\help\HijackThis.exe
G:\sUBs\ComboFix.exe
G:\WINDOWS\system32\cmd.exe
G:\WINDOWS\system32\cmd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.suntrust.com/portal/server.pt?c…e=CommunityPage
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - G:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {D8691D6A-AB8A-F170-DBAA-D928EA013ABB} - G:\WINDOWS\system32\vhejp.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: CouponBar - {5BED3930-2E9E-76D8-BACC-80DF2188D455} - G:\WINDOWS\CouponBarIE.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - G:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AnyDVD] G:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MSWindowsUpdate] G:\WINDOWS\system32\mswinup.exe
O4 - HKLM\..\Run: [WindowsFirewallSvc] G:\WINDOWS\system32\winsvcup.exe
O4 - HKLM\..\Run: [Windows Update Host] G:\WINDOWS\system32\winupsvc.exe
O4 - HKLM\..\Run: [WindowsServicesStartup] G:\DOCUME~1\John\LOCALS~1\Temp\svchost.exe 1
O4 - HKLM\..\Run: [AVG7_CC] G:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [AVG7_RegCleaner] G:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [win32101112558595] G:\WINDOWS\win32101112558595.exe
O4 - HKLM\..\Run: [qvafbaba] RUNDLL32.EXE w00452df.dll,n 006fbab40000000300452df
O4 - HKLM\..\Run: [{04-4C-C0-03-ZN}] G:\windows\system32\nndsregl.exe GEN001
O4 - HKLM\..\Run: [win32089511125585] G:\WINDOWS\win32089511125585.exe
O4 - HKLM\..\Run: [win32075951112558] G:\WINDOWS\win32075951112558.exe
O4 - HKLM\..\Run: [hkgryhiA] G:\WINDOWS\hkgryhiA.exe
O4 - HKCU\..\Run: [NBJ] "G:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "G:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [ATI Launchpad] "G:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [DVDXGhost] G:\Program Files\DVD Ghost\DVDGhost.EXE
O4 - HKCU\..\Run: [swg] G:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [imzf] G:\PROGRA~1\COMMON~1\imzf\imzfm.exe
O4 - HKCU\..\Run: [Prar] "G:\PROGRA~1\WNSXS~1\userinit.exe" -vt yazb
O4 - HKCU\..\Run: [Rrat] G:\Documents and Settings\John\Application Data\?ecurity\r?gsvr32.exe
O4 - Startup: Introducing Media Manager.lnk = G:\Program Files\Common Files\Microsoft Shared\Media Manager\SPLASHA.EXE
O4 - Startup: palmOne Registration.lnk = ?
O4 - Startup: TA_Start.lnk = G:\WINDOWS\system32\dwdsregt.exe
O4 - Global Startup: Acrobat Assistant.lnk = G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = G:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = G:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: &Suchen - res://G:\WINDOWS\system32\Suchspur.dll/Suchspur.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 1.5 - G:\Program Files\Sony\Image Converter 1.5\menu.htm
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - G:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1112616108984
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O23 - Service: Adobe LM Service - Unknown owner - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - G:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: iPod Service - Apple Computer, Inc. - G:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - G:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

Susan528

Post #2November 18, 2006, 1:31 AM UTC

Hello elf405 and Welcome to TomCoyote,

Please do the following:

STEP 1.
======
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

If you are taken to the internet page, just close the page.
You will be prompted to check for updated definitions, please do so.
(This may take several minutes)
Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!
When the sweep has finished, click Remove. Click Select All and then Next
From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

STEP 2.
======
The AVG anti-spyware program’s detection rate is excellent. After the Trial has expired, the auto updates and real time protection stop but you can still update it manually and run scans anytime you want.

First download AVG anti-spyware 7.5 from HERE and save that file to your
desktop.
This is a 30 day trial of the program

Once you have downloaded AVG anti-spyware , locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run AVG anti-spyware and update the definition
files.
On the main screen select the icon "Update" then select the "
Update now" link.
- Next select the "Start Update" button, the update will start and a
  progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG anti-spyware , Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.

Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while AVG anti-spyware is scanning, it may interfere with the scanning proccess:
Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
AVG anti-spyware will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close AVG anti-spyware and reboot your system back into Normal Mode and post the
results of the AVG anti-spyware report scan.

Please post the results from SpySweeper, AVG anti-spyware and a new hijackthis log.

elf405

Post #3November 18, 2006, 1:30 PM UTC

I was unable to save spy sweeper log. Thanks for your help and here are the logs….Elf

Logfile of HijackThis v1.99.1
Scan saved at 7:23:23 AM, on 11/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\Program Files\Common Files\Microsoft Shared\Media Manager\airsvcu.exe
G:\Program Files\Spyware Doctor\sdhelp.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\wdfmgr.exe
G:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
G:\WINDOWS\Mixer.exe
G:\WINDOWS\system32\atiptaxx.exe
G:\PROGRA~1\Grisoft\AVG7\avgcc.exe
G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
G:\Program Files\QuickTime\qttask.exe
G:\Program Files\iTunes\iTunesHelper.exe
G:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\ATI Multimedia\main\launchpd.exe
G:\Program Files\Messenger\msmsgs.exe
G:\Program Files\Spyware Doctor\swdoctor.exe
G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
G:\Program Files\Canon\CAL\CALMAIN.exe
G:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
G:\Program Files\palmOne\Hotsync.exe
G:\Program Files\iPod\bin\iPodService.exe
G:\WINDOWS\system32\wscntfy.exe
G:\WINDOWS\System32\alg.exe
G:\WINDOWS\system32\wuauclt.exe
G:\Program Files\Webroot\Spy Sweeper\SSU.EXE
D:\help\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.suntrust.com/portal/server.pt?c…e=CommunityPage
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - G:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - G:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - G:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - G:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AnyDVD] "G:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] "G:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [AVG7_RegCleaner] "G:\PROGRA~1\Grisoft\AVG7\avgregcl.exe" /BOOT
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [qvafbaba] "RUNDLL32.EXE" w00452df.dll,n 006fbab40000000300452df
O4 - HKLM\..\Run: [{04-4C-C0-03-ZN}] G:\windows\system32\nndsregl.exe GEN001
O4 - HKLM\..\Run: [SpySweeper] "G:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [NBJ] "G:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "G:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [ATI Launchpad] "G:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [DVDXGhost] G:\Program Files\DVD Ghost\DVDGhost.EXE
O4 - HKCU\..\Run: [swg] G:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Prar] "G:\PROGRA~1\WNSXS~1\userinit.exe" -vt yazb
O4 - HKCU\..\Run: [Rrat] G:\Documents and Settings\John\Application Data\?ecurity\r?gsvr32.exe
O4 - HKCU\..\Run: [Spyware Doctor] "G:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Introducing Media Manager.lnk = G:\Program Files\Common Files\Microsoft Shared\Media Manager\SPLASHA.EXE
O4 - Startup: palmOne Registration.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = G:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = G:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: &Suchen - res://G:\WINDOWS\system32\Suchspur.dll/Suchspur.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 1.5 - G:\Program Files\Sony\Image Converter 1.5\menu.htm
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - G:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - G:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1112616108984
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WRNotifier - G:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - G:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: iPod Service - Apple Computer, Inc. - G:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - G:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - G:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - G:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 7:19:20 AM 11/18/2006

+ Scan result:

G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154570.dll -> Adware.Agent : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154559.dll -> Adware.AutoSearch : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151091.exe -> Adware.Bagon : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153152.exe -> Adware.Bagon : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153149.exe -> Adware.BkdSpace : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153150.exe -> Adware.BkdSpace : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151087.exe -> Adware.BookedSpace : Cleaned with backup (quarantined).
G:\WINDOWS\stub_mm3.exe -> Adware.BookedSpace : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5BED3930-2E9E-76D8-BACC-80DF2188D455} -> Adware.CouponBar : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5BED3930-2E9E-76D8-BACC-80DF2188D455} -> Adware.CouponBar : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154572.dll -> Adware.Coupons : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154573.ocx -> Adware.Coupons : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153388.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153389.dll -> Adware.NewDotNet : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153390.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154568.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154569.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151084.dll -> Adware.Softomate : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151085.exe -> Adware.Softomate : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0152125.dll -> Adware.Softomate : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0152126.exe -> Adware.Softomate : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153326.dll -> Adware.Softomate : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153327.exe -> Adware.Softomate : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A8B28872-3324-4CD2-8AA3-7D555C872D96} -> Adware.Softomate : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A8B28872-3324-4CD2-8AA3-7D555C872D96} -> Adware.Softomate : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP668\A0155640.dll -> Adware.Stud : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153146.exe -> Adware.SurfSide : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154561.dll -> Adware.TargetServer : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP620\A0143127.exe -> Adware.WinAD : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP664\A0150057.exe -> Downloader.Adload.di : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151113.exe -> Downloader.Adload.di : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP664\A0149010.exe -> Downloader.Adload.ncp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153137.exe -> Downloader.Adload.ncw : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154567.exe -> Downloader.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP664\A0150062.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151119.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP664\A0150068.exe -> Downloader.Small.dxm : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151125.exe -> Downloader.Small.dxm : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153140.exe -> Downloader.Small.dxm : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151096.dll -> Downloader.Small.dxm : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0152132.dll -> Downloader.Small.dxm : Cleaned with backup (quarantined).
G:\WINDOWS\system32\ldcore.dll -> Downloader.Small.dxm : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154564.exe -> Downloader.TSUpdate.f : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154560.exe -> Downloader.TSUpdate.l : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154563.exe -> Downloader.TSUpdate.n : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP667\A0154562.exe -> Downloader.TSUpdate.r : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP664\A0150064.exe -> Downloader.VB.aqc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151123.exe -> Downloader.VB.aqc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0153138.exe -> Downloader.VB.aqc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP664\A0150061.exe -> Downloader.Zlob.avo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151118.exe -> Downloader.Zlob.avo : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151092.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined).
G:\WINDOWS\hkgryhi.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined).
G:\Program Files\folder.js -> Hijacker.Small.jf : Cleaned with backup (quarantined).
G:\Program Files\eMule\Temp\007.part/RAR Password Cracker v4.12+Crack/Crack/rpc.exe -> Not-A-Virus.PSWTool.Win32.RARPassCrack.a : Cleaned with backup (quarantined).
H:\eMule\Temp\007.part/RAR Password Cracker v4.12+Crack/Crack/rpc.exe -> Not-A-Virus.PSWTool.Win32.RARPassCrack.a : Cleaned with backup (quarantined).
G:\Documents and Settings\John\Cookies\john@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
G:\Documents and Settings\John\Cookies\john@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
G:\Documents and Settings\Guest\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned.
G:\Documents and Settings\John\Cookies\john@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
G:\Documents and Settings\LocalService\Cookies\system@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
G:\Documents and Settings\Guest\Cookies\guest@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
G:\Documents and Settings\John\Cookies\john@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
G:\Documents and Settings\LocalService\Cookies\system@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned.
G:\Documents and Settings\Guest\Cookies\guest@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
G:\Documents and Settings\John\Cookies\john@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][2].txt -> TrackingCookie.Fastclick : Cleaned.
G:\Documents and Settings\LocalService\Cookies\system@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
G:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> TrackingCookie.Fastclick : Cleaned.
G:\Documents and Settings\Guest\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
G:\Documents and Settings\Guest\Cookies\guest@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
G:\Documents and Settings\John\Cookies\john@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
G:\Documents and Settings\Guest\Cookies\guest@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.
G:\Documents and Settings\John\Cookies\john@webstat[2].txt -> TrackingCookie.Web-stat : Cleaned.
G:\Documents and Settings\John\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
G:\Documents and Settings\John\Cookies\john@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP665\A0151088.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP668\A0155633.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP668\A0155649.exe -> Worm.Drefir.c : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP668\A0155650.exe -> Worm.Drefir.c : Cleaned with backup (quarantined).
G:\System Volume Information\_restore{AA7375B7-FDD8-448B-A573-FE6B40B22703}\RP668\A0155651.exe -> Worm.Drefir.c : Cleaned with backup (quarantined).

::Report end

Susan528

Post #4November 19, 2006, 12:35 AM UTC

======
GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.

Download GMER and extract it to the C:\program files\GMER folder.
Run the Gmer.exe program by double-clicking the executable file (gmer.exe) in Windows Explorer.
You may be prompted to scan immediately if GMER detects rootkit activity.
If you are prompted to scan your system click "yes" to begin the scan.
If you are not prompted, Click the "Rootkit" tab, then click "Scan".

At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in a reply here.

======
Please show all files for your system.
You will need to reverse this process when all steps are done.

Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer:
G:\windows\system32\nndsregl.exe
Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.

Please repeat Jotti for the following files.
G:\PROGRA~1\WNSXS~1\userinit.exe– is in Program Files\folder that starts with WNSXS
G:\WINDOWS\system32\Suchspur.dll

======
WinPFind
Please Download the following tools to assist us in removing this infection! Download WinPFind from http://www.bleepingcomputer.com/files/winpfind.php

Right Click the Zip Folder and Select Extract All
Extract it somewhere you will remember like the Desktop
Don’t do anything with it yet!

Reboot.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode

Doubleclick WinPFind.exe
Click on Configure Scan Options.
Remove all the checkmarks under Folder Options on the left side by clicking the button Remove All, uncheck Run Addon's and click Apply.
Click Start Scan
It will scan the entire System, so please be patient! This scan may take awhile

Once the Scan is Complete

Reboot your computer into normal mode.
Go to the WinPFind folder
Locate WinPFind.txt
Copy the results from the WinPFind.txt file and post the results in your next reply.

Please post (reply) with the

log from GMER
results from Jotti for the three files
WinPFind log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please help new comer

✨ Ask AI

Ask AI