Spyware / Malware / Virus Removal

Please help me with this HJ log

7 min read

Looking for the outcome? Ask AI

Tim777 Topic Starter

Post #1November 30, 2006, 12:55 AM UTC

I scanned my whole computer but it still seems to have something on it, some kind of trojan virus most likely, cause stuff isn't working properly. Would really apreciate some help, here is my log. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 1:48:22 AM, on 11/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\NetDrive\wdService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NetDrive\netdrive.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Documents and Settings\Tim Kalis\winstall.exe
C:\Program Files\Common Files\{783D28DE-0A5F-1033-0610-030414200001}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msrr.exe
C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by @Home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\en-us\msntb.dll
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WebDriveTray] C:\Program Files\NetDrive\netdrive.exe /trayicon
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Tim Kalis\winstall.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msrr.exe" /background
O4 - HKCU\..\RunOnce: [DeleteDLL] cmd.exe /c del C:\PROGRA~1\COMMON~1\{383D2~1\888Bar.dll > nul
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://cache.hyves.nl/statics/Aurigma/ImageUploader.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…902/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exe

amateur

Post #2December 4, 2006, 1:31 AM UTC

Hello and welcome to TC

.

Please print out these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Please download Ccleaner and save it to your desktop.
Tutorial for CCleaner
During the installation be sure to UN-check the box for "Ccleaner Yahoo Toolbar" unless you want it Do not use it yet.

==========================================

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Do not scan with it yet.

==========================================

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. Click here if you don't know how to do that. A folder named SmitfraudFix will be created on your Desktop.

Do not scan with it yet

==========================================

Please download Brute Force Uninstaller.

Unzip it to it's own folder (c:\BFU)

Use this URL to copy into the address bar of the Download script window:
http://metallica.geekstogo.com/alcanshorty.bfu

Press execute and let it do it's job.

Wait for the complete script execution box to pop up and press OK.
Press exit to terminate the BFU program.

=========================================
- Close all open Explorer windows and browsers/email, etc
- Run HijackThis
- Click on the Scan button and when complete
- Put a check beside all of the items listed below
- Click on the "Fix Checked" button
- When completed, close the application.
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Tim Kalis\winstall.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe

=========================================

Reboot your computer in Safe Mode.
- If the computer is running, shut down Windows, and then turn off the power.
- Wait 30 seconds, and then turn the computer on.
- Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
- Ensure that the Safe Mode option is selected.
- Press Enter. The computer then begins to start in Safe mode.
- Login on your usual account.
  
  =========================================
  
  Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
  Select option #2 - Clean by typing 2 and press Enter.
  Wait for the tool to complete and disk cleanup to finish.
  You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
  The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.
  
  A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.
  
  The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
  
  =========================================
  
  From Safe Mode run Ccleaner
  - Click on Options,
  - Select Advanced
  - Now UNCHECK "Only delete files in Windows Temp folders older than 48 hours"
  - Make sure the Cleaner block on the left is selected.
  - Do not use the "Issues" block . It's meant for professionals.
  - Choose the Windows tab.
  - Check everything EXCEPT Advanced part of the Menu.
  - Click on "Analyze". This process could take a while.
  - If you don't want to loose your login passwords to certain sites, click on Options
  - Select cookies and move the ones you want to keep to the "cookies to keep" section, by highlighting and using the arrows in the middle.
  - Choose Run Cleaner.
  When CCleaner shows how much has been removed, cleaning is finished. Click Exit.
  If you have more than one users, run Ccleaner for every user
  
  =========================================
  
  Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  - Click on Scanner on the toolbar.
  - Click on the Settings tab.
    - Under How to act?
      - Click on Recommended Action and choose Quarantine from the popup menu.
    - Under How to scan?
      - All checkboxes should be ticked.
    - Under Possibly unwanted software:
      - All checkboxes should be ticked.
    - Under Reports:
      - Select Automatically generate report after every scan and uncheck Only if threats were found.
    - Under What to scan?
      - Select Scan every file.
  - Click on the Scan tab.
  - Click on Complete System Scan to start the scan process.
  - Let the program scan the machine.
  - When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    - Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    - At the bottom of the window click on the Apply all Actions button. (3)
      [external image: Posted Image]
  - When done, click the Save Scan Report button. (4)
    - Click the Save Report as button.
    - Save the report to your Desktop.
  - Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
  Reboot in Normal Mode.
  
  =========================================
  
  Open the SmitfraudFix folder and double-click smitfraudfix.cmd
  Select option #3 - Delete Trusted zone by typing 3 and press Enter.
  Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.
  
  Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
  
  ============================================
  
  Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.
  
  ============================================
  
  Download Combofix to your desktop.
  Doubleclick combofix.exe
  Follow the prompts.
  Don't click on the window while the fix is running, because that will cause your system to hang.
  
  When finished and after reboot, it should open a log, combofix.txt.
  Post this log in your next reply.
  ============================================
  
  Please post back:
  
  rapport.txt
  AVG Anti Spyware log
  Combofix.txt
  a fresh HijackThis log You might have to use several posts if too long.

Tim777

Post #3December 5, 2006, 2:49 PM UTC

Sorry for the late reply, but was gone and then actually had a program on here blocking me from going to your site, (thesafetytool.com and all stuff that comes with it). Also, in AVG, I couldn't quarantine one file but only delete, with right click I couldn't select quarantine. Here are the logs.

SmitFraudFix v2.127

Scan done at 16:00:37.82, Mon 12/04/2006
Run from C:\Documents and Settings\Tim Kalis\Desktop
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 3:00:30 PM 12/5/2006

+ Scan result:

C:\System Volume Information\_restore{AB1ACA1C-7140-4974-89DB-A0EA8C357E80}\RP861\A0058393.dll -> Downloader.Zlob.bbv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB1ACA1C-7140-4974-89DB-A0EA8C357E80}\RP861\A0058400.dll -> Downloader.Zlob.bbv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB1ACA1C-7140-4974-89DB-A0EA8C357E80}\RP863\A0058510.dll -> Downloader.Zlob.bbv : Cleaned with backup (quarantined).
C:\Documents and Settings\Tim Kalis\Cookies\tim [removed][1].txt -> TrackingCookie.Burstnet : Cleaned.

::Report end

Tim Kalis - 06-12-05 15:31:01.54 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Tim Kalis\My Documents\Setups"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe

((((((((((((((((((((((((((((((( Files Created from 2006-11-05 to 2006-12-05 ))))))))))))))))))))))))))))))))))

2006-12-04 16:07 dr-h—– C:\Documents and Settings\Tim Kalis\Recent
2006-12-04 15:43 d——– C:\bfu
2006-12-04 14:17 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-04 14:17 d——– C:\Program Files\Grisoft
2006-12-04 13:55 3,366 –a—— C:\WINDOWS\system32\tmp.reg
2006-12-04 12:42 1,152 –a—— C:\WINDOWS\system32\windrv.sys
2006-12-04 12:41 d——– C:\Program Files\SpyNoMore
2006-11-30 15:46 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2006-11-30 13:32 78,336 –a—— C:\WINDOWS\system32\drivers\ssi.sys
2006-11-30 13:32 102,912 –a—— C:\WINDOWS\system32\islzma.dll
2006-11-28 15:19 d——– C:\HJT
2006-11-28 14:53 d——– C:\Program Files\Lavasoft
2006-11-28 13:17 d——– C:\Program Files\Security Task Manager
2006-11-28 13:17 d——– C:\Documents and Settings\All Users\Application Data\SecTaskMan
2006-11-27 22:49 d——– C:\Program Files\CCleaner
2006-11-27 22:18 d——– C:\WINDOWS\system32\ActiveScan
2006-11-27 22:02 d——– C:\Documents and Settings\Tim Kalis\.housecall6.6
2006-11-27 21:31 1,886 –a—— C:\WINDOWS\system32\cset.exe
2006-11-27 21:31 d——– C:\WINDOWS\McAfee.com
2006-11-26 05:30 98,304 –a—— C:\WINDOWS\system32\msir3jp.dll
2006-11-26 05:30 838,144 –a—— C:\WINDOWS\system32\chtbrkr.dll
2006-11-26 05:30 70,656 –a—— C:\WINDOWS\system32\korwbrkr.dll
2006-11-26 05:30 1,677,824 –a—— C:\WINDOWS\system32\chsbrkr.dll
2006-11-26 05:29 9,216 –a—— C:\WINDOWS\system32\kbdnecAT.dll
2006-11-26 05:29 8,704 –a—— C:\WINDOWS\system32\kbdjpn.dll
2006-11-26 05:29 8,192 –a—— C:\WINDOWS\system32\kbdkor.dll
2006-11-26 05:29 7,680 –a—— C:\WINDOWS\system32\kbdnecNT.dll
2006-11-26 05:29 7,168 –a—— C:\WINDOWS\system32\kbdnec95.dll
2006-11-26 05:29 7,168 –a—— C:\WINDOWS\system32\kbdibm02.dll
2006-11-26 05:29 7,168 –a—— C:\WINDOWS\system32\f3ahvoas.dll
2006-11-26 05:29 6,656 –a—— C:\WINDOWS\system32\kbdlk41a.dll
2006-11-26 05:29 6,656 –a—— C:\WINDOWS\system32\c_is2022.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbdlk41j.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbdax2.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbd106n.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbd106.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbd101c.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbd101b.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbd101a.dll
2006-11-26 05:29 6,144 –a—— C:\WINDOWS\system32\kbd101.dll
2006-11-26 05:29 5,632 –a—— C:\WINDOWS\system32\kbd103.dll
2006-11-26 05:29 218,112 –a—— C:\WINDOWS\system32\c_g18030.dll
2006-11-16 10:38 d–hs—- C:\FOUND.002

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-11-27 19:45 52240 –a—— C:\Documents and Settings\Tim Kalis\Application Data\GDIPFONTCACHEV1.DAT
2006-10-18 21:58 8704 –a—— C:\WINDOWS\system32\wdfmgr.exe
2006-10-18 21:58 8704 –a—— C:\WINDOWS\system32\uwdf.exe
2006-10-18 21:47 99840 –a—— C:\WINDOWS\system32\wmpshell.dll
2006-10-18 21:47 991744 –a—— C:\WINDOWS\system32\drmv2clt.dll
2006-10-18 21:47 937984 –a—— C:\WINDOWS\system32\WMNetMgr.dll
2006-10-18 21:47 8231936 –a—— C:\WINDOWS\system32\wmploc.dll
2006-10-18 21:47 767488 ——— C:\WINDOWS\system32\WMVSENCD.dll
2006-10-18 21:47 757248 –a—— C:\WINDOWS\system32\WMADMOD.dll
2006-10-18 21:47 7168 –a—— C:\WINDOWS\system32\asferror.dll
2006-10-18 21:47 656896 ——— C:\WINDOWS\system32\WMVXENCD.dll
2006-10-18 21:47 63488 –a—— C:\WINDOWS\system32\wpdmtpus.dll
2006-10-18 21:47 629760 –a—— C:\WINDOWS\system32\wpd_ci.dll
2006-10-18 21:47 613376 ——— C:\WINDOWS\system32\wmpmde.dll
2006-10-18 21:47 603648 –a—— C:\WINDOWS\system32\WMSPDMOD.dll
2006-10-18 21:47 542720 –a—— C:\WINDOWS\system32\blackbox.dll
2006-10-18 21:47 535040 ——— C:\WINDOWS\system32\wmdrmsdk.dll
2006-10-18 21:47 429056 –a—— C:\WINDOWS\system32\WMDRMdev.dll
2006-10-18 21:47 414208 –a—— C:\WINDOWS\system32\msscp.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmvdmoe2.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmvdmod.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\WMVADVE.DLL
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\WMVADVD.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmsdmoe2.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmsdmod.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wdfapi.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MPG4DMOD.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MP4SDMOD.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MP43DMOD.dll
2006-10-18 21:47 38400 ——— C:\WINDOWS\system32\wpdshextres.dll
2006-10-18 21:47 37376 –a—— C:\WINDOWS\system32\wmdmps.dll
2006-10-18 21:47 35840 –a—— C:\WINDOWS\system32\wpdconns.dll
2006-10-18 21:47 356352 –a—— C:\WINDOWS\system32\wpdsp.dll
2006-10-18 21:47 348672 –a—— C:\WINDOWS\system32\WMDRMNet.dll
2006-10-18 21:47 33792 –a—— C:\WINDOWS\system32\wmdmlog.dll
2006-10-18 21:47 321536 –a—— C:\WINDOWS\system32\mswmdm.dll
2006-10-18 21:47 317440 ——— C:\WINDOWS\system32\MP4SDECD.dll
2006-10-18 21:47 314880 –a—— C:\WINDOWS\system32\wmpdxm.dll
2006-10-18 21:47 295936 ——— C:\WINDOWS\system32\wmpeffects.dll
2006-10-18 21:47 284160 –a—— C:\WINDOWS\system32\PortableDeviceApi.dll
2006-10-18 21:47 276992 –a—— C:\WINDOWS\system32\Audiodev.dll
2006-10-18 21:47 27136 –a—— C:\WINDOWS\system32\MsPMSNSv.dll
2006-10-18 21:47 2603008 –a—— C:\WINDOWS\system32\WpdShext.dll
2006-10-18 21:47 259072 –a—— C:\WINDOWS\system32\MPG4DECD.dll
2006-10-18 21:47 259072 ——— C:\WINDOWS\system32\MP43DECD.dll
2006-10-18 21:47 2450944 –a—— C:\WINDOWS\system32\wmvcore.dll
2006-10-18 21:47 242688 –a—— C:\WINDOWS\system32\wmpasf.dll
2006-10-18 21:47 229376 –a—— C:\WINDOWS\system32\cewmdm.dll
2006-10-18 21:47 227328 –a—— C:\WINDOWS\system32\wmerror.dll
2006-10-18 21:47 222208 –a—— C:\WINDOWS\system32\WMASF.dll
2006-10-18 21:47 212992 –a—— C:\WINDOWS\system32\MFPLAT.dll
2006-10-18 21:47 211456 –a—— C:\WINDOWS\system32\qasf.dll
2006-10-18 21:47 204288 –a—— C:\WINDOWS\system32\wmpsrcwp.dll
2006-10-18 21:47 199168 ——— C:\WINDOWS\system32\PortableDeviceWMDRM.dll
2006-10-18 21:47 179712 –a—— C:\WINDOWS\system32\msnetobj.dll
2006-10-18 21:47 175616 –a—— C:\WINDOWS\system32\MsPMSP.dll
2006-10-18 21:47 166912 –a—— C:\WINDOWS\system32\PortableDeviceTypes.dll
2006-10-18 21:47 1661440 –a—— C:\WINDOWS\system32\wmpencen.dll
2006-10-18 21:47 1574912 ——— C:\WINDOWS\system32\WMVENCOD.dll
2006-10-18 21:47 157184 –a—— C:\WINDOWS\system32\wmidx.dll
2006-10-18 21:47 154624 –a—— C:\WINDOWS\system32\wpdmtp.dll
2006-10-18 21:47 1543680 ——— C:\WINDOWS\system32\WMVDECOD.dll
2006-10-18 21:47 1382912 ——— C:\WINDOWS\system32\WMVSDECD.dll
2006-10-18 21:47 133632 –a—— C:\WINDOWS\system32\WPDShServiceObj.dll
2006-10-18 21:47 1329152 –a—— C:\WINDOWS\system32\WMSPDMOE.dll
2006-10-18 21:47 132096 ——— C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
2006-10-18 21:47 130048 ——— C:\WINDOWS\system32\wmpps.dll
2006-10-18 21:47 11264 –a—— C:\WINDOWS\system32\LAPRXY.dll
2006-10-18 21:47 1117696 –a—— C:\WINDOWS\system32\WMADMOE.dll
2006-10-18 21:47 101888 ——— C:\WINDOWS\system32\PortableDeviceClassExtension.dll
2006-10-18 20:03 100864 –a—— C:\WINDOWS\system32\logagent.exe
2006-10-18 20:00 38528 –a—— C:\WINDOWS\system32\drivers\wpdusb.sys
2006-10-18 20:00 249856 ——— C:\WINDOWS\system32\drmupgds.exe
2006-10-18 20:00 17408 ——— C:\WINDOWS\system32\wpdshextautoplay.exe
2006-10-13 13:35 142336 –a—— C:\WINDOWS\system32\nwprovau.dll
2006-10-02 15:28 312128 ——— C:\WINDOWS\system32\MSDelta.dll
2006-09-28 20:13 95344 ——— C:\WINDOWS\system32\WUDFCoinstaller.dll
2006-09-28 18:56 55808 ——— C:\WINDOWS\system32\WudfSvc.dll
2006-09-28 18:56 316416 ——— C:\WINDOWS\system32\WUDFx.dll
2006-09-28 18:56 165376 ——— C:\WINDOWS\system32\WudfPlatform.dll
2006-09-28 18:56 146432 ——— C:\WINDOWS\system32\WudfHost.exe
2006-09-25 17:58 23856 –a—— C:\WINDOWS\system32\spupdsvc.exe
2006-09-13 07:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msrr.exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Hcontrol"="C:\\WINDOWS\\ATK0100\\Hcontrol.exe"
"SoundMan"="SOUNDMAN.EXE"
"Power_Gear"="C:\\Progra~1\\ASUS\\Power4 Gear\\BatteryLife.exe 1"
"SiS Tray"="C:\\WINDOWS\\System32\\sistray.EXE"
"SiS KHooker"="C:\\WINDOWS\\System32\\khooker.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"WebDriveTray"="C:\\Program Files\\NetDrive\\netdrive.exe /trayicon"
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"VirusScan Online"="C:\\Program Files\\McAfee.com\\VSO\\mcvsshld.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="C:\\PROGRA~1\\mcafee.com\\agent\\mcupdate.exe"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"SNM"="C:\\Program Files\\SpyNoMore\\SNM.exe /startup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsnMsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20061204-154836-853
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Tim Kalis\winstall.exe
backup-20061128-160920-894
O3 - Toolbar: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{383D2~1\888Bar.dll
backup-20061128-160920-665
O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{383D2~1\888Bar.dll

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Scannen via McAfee.com - Mijn computer (CP493953-A-Tim Kalis).job

Completion time: 06-12-05 15:31:51.59
C:\ComboFix.txt … 06-12-05 15:31

Logfile of HijackThis v1.99.1
Scan saved at 3:44:29 PM, on 12/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\NetDrive\wdService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\NetDrive\netdrive.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\SpyNoMore\SNM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msrr.exe
C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
C:\PROGRA~1\MICROS~3\Office10\OUTLOOK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by @Home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\en-us\msntb.dll
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WebDriveTray] C:\Program Files\NetDrive\netdrive.exe /trayicon
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msrr.exe" /background
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://cache.hyves.nl/statics/Aurigma/ImageUploader.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…902/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exe

amateur

Post #4December 5, 2006, 10:47 PM UTC

Hi Tim777,

The log is clean. SpyNomore used to be a rogue program and it has recently been de-listed. There are better altrnatives. If you'd like to remove it, go to Start>Control Panel>Add/Remove programs and remove it. Then navigateto the following folder and remove that too.

C:\\Program Files\\SpyNoMore.

I see some entries relating to Japanese Keyboard Layout, installed around October 26th. I just would like to clarify if indeed it was installed by you as the file locations are different than the usual.

Do you still have the "thesafetytool.com" problem?

Tim777

Post #5December 6, 2006, 1:55 AM UTC

Hi

I deleted Spynomore. Thesafetytoolproblem is gone, as far as I know. I looked it up on other sites and actually had to do some of the stuff I had to do from you, smitfraud and AVG scanner and the site cleared, only I couldn't download the updates from AVG without your info. Yes, the japanese thing is strange, it was from a, big company site http://www.bestway-northamerica.com/first.htm, but after I had to install this, now everytime I open an MS office program or MS Outlook the windows installer pops up which is very annoying. I actually looked up how to delete that, but then I also have to reinstall all the programs.

Thanks very much for the help, all the way from Rhode Island, very glad the computer looks clean

amateur

Post #6December 11, 2006, 2:40 AM UTC

Hi Tim777,

Sorry, I did not get the notification that you've posted for some reason.

You can go to this link and download Windows Install Cleanup. It will list all the programs that use Windows Installer. Select from the list the program for which you are getting the Windows Installation popup. Click remove, and then reinstall the same program (if you still want to use it). The Remove button does not remove the program. It removes the install configuration. You should reinstall the program in the same folder where you originally installed it. This prevents duplication of files on your hard disk or disks.

Now that your system seems to be clean, you can go ahead and delete the following, if you haven't already:

ComboFix
SmitFraud Fix
c:\BFU

Create a new System Restore point to prevent reinfection from old restore points.

Click Start>Run - type sysdm.cpl & press Enter
* Select the System Restore Tab
* Check "Turn off System Restore on all drives"
* Click Apply
* Then uncheck the same checkbox & click OK

You can also find instructions on how to disable and re enable system restore here:
Windows XP System Restore Guide

And that's all. But to help protect you against further infections, and also to help prevent criminals using your computer to infect other people's computers on the web, I recommend the following: (You may already have some of the items)

Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Avoid illegal sites, because that's where most malware is present.

* Don't click on links inside popups.
* Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware.
* Download free software only from sites you know and trust. Because a lot of free software can bundle other software, including spyware.

Keep your antivirus-program up-to-date and do regular scans with it. Please make sure that you have only one active antivirus program on your system.
If you haven't got an antivirus, you can download and install one of the following ones wh;ich are free for personal use: Make sure that you have only ONE antivirus running on your computer as more than one would cause conflict and render the computer vulnerable.

AVG Free here
AntiVir here
Avast here

It is essential to keep the anti-virus program fully updated.
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site <http://windowsupdate.microsoft.com/> to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site <http://office.microsoft.com/officeupdate/maincatalog.aspx?lc=en-us> and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

Keep your pestware-scanners up-to-date and do regular scans with them.

To keep your computer free of Spyware, Adware, Hijackers etc., download and install the following free pestware-scanners (if you haven't installed them already):
AdAware here
Spybot here Remember to "immunize" after each update
Windows Defender here

Install realtime pestware-scanners and keep them up-to-date.

The following free realtime pestscanners prevent a number of malware-variants from entering your computer, in the first place:

SpywareBlaster here Remember to "enable all protection" after each update.
SpywareGuard here

If you haven't got one, already, install a firewall and keep it up-to-date. Please make sure that you have only one active firewall on your system.

A firewall will prevent unauthorized contact between your computer and internet.
If there is no firewall installed on your computer, you can download and install one of the following free firewalls:
ZoneAlarm here
Sygate here
Kerio Personal Firewall here
Outpost here
Important: (Windows XP only) If you install a firewall, be sure to turn off the WinXP-firewall!

Test your firewall here to make sure that it's working properly

Install these programs, to make surfing with Internet Explorer safer:

A popup-blocker, f.e. Google Toolbar here: A popup-blocker prevents popup-windows from opening, when you come along a websites that uses them, during internet-surfing.

IE-SPYAD here: This utility adds a long list of known bad sites to Internet Explorer's Restricted Sites zone. This prevents those sites from executing their malicious programs on your computer.

SiteHound by Firetrust
here:

Firetrust introduces the SiteHound Toolbar - the safe way to browse the Internet. With SiteHound, when you browse the Internet, you're shown a warning page every time you go to a site which is a known scam, potentially loads viruses or spyware on to your computer, has questionable content or anything you would not consider reasonable. You are shown a warning page with information about that site. From there you can choose to enter the site or go back. SiteHound is a free add-on to Internet Explorer.
SiteHound will alert you when you enter a site which is known to contain:
· Fraudulent claims or scams
· Offensive material
· Security vulnerabilities
· Spyware or Adware
· Spam related material
· or other content deemed to be unsafe
Specifically, SiteHound blocks these categories:

o Adult o Spyware o Spam Advertising o Phishing o Possible scam or fraud o Misleading or False Advertising
o Pharming o Rogue or Suspect Product o Adware o Malware or Virus

Install and use an alternative browser to surf on the internet.

Because Internet Explorer is the most-used browser on the planet, most of the hijackers, adware and spyware are made to abuse your computer thru Internet Explorer.
Here are some good alternative browsers:
Mozilla Suite here
Mozilla Firefox here
Opera here
Netscape here
Important: You can not uninstall Internet Explorer.
First of all, it's part of Windows and you'll need it to download and install Windows Updates.
Secondly, There are some sites that are only accessable with Internet Explorer, e.g. most of the Online Malware-scanners.

But above all, keep all your software UP-TO-DATE at all time!!

Also, I would recommend reading the excellent advice by Tony Klein: So how did I get infected in the first place

Happy and safe surfing.

amateur

Post #7December 30, 2006, 10:47 PM UTC

Since your problem appears to be resolved, this thread will now be closed. If you need this topic reopened, please PM me with the address of the thread, and we will reopen it for you. This applies only to the original topic starter. Everyone else please begin a New Topic.

LDTate

Post #8December 30, 2006, 10:59 PM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please help me with this HJ log

✨ Ask AI

Ask AI