What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

about:blank

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Is that last scan from Safe Mode? I don't see your AVG running.

Try the online scan:
Please go HERE and do a online scan.
Let me know what is found.

After scan, reboot and post a new HijackThis log

Also let me know how the computer is running now.
Post #18

Get a copy of winsockxpfix.exe in case you lose your internet connect during the fix. You just run it and things should work OK after it reboots your system.

http://www.snapfiles.com/get/winsockxpfix.html



Logfile of HijackThis v1.99.1
Scan saved at 12:19:10 PM, on 1/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\InetCntrl\InetCntrl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\system32\InetCntrl\InetCntrl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Broken Internet access because of LSP provider 'inetcntrl0003.dll' missing
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k42037/sb028.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_1_5_0.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by111fd.bay111.hotmail.msn.com/activex/HMAtchmt.ocx
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe

I did what you said, The scan will still not run. When I ran the winsock program it could not back up my registry. Now every time I try to go to a new website I get the message: Do you want to allow active x controls and plug-ins to run! Although the machine is running faster.
Post #19
With IE open: Click Tools> Internet Optioms> Securty> Custom Level ActiveX controls and plug-ins * Download signed ActiveX controls (Prompt) * Download unsigned ActiveX controls (Disable) * Initialize and script ActiveX controls not marked as safe (Disable) * Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX) * Script ActiveX controls marked safe for scripting (Prompt) Now try that online scan again.
Post #20

With IE open: Click Tools> Internet Optioms> Securty> Custom Level

ActiveX controls and plug-ins

* Download signed ActiveX controls (Prompt)
* Download unsigned ActiveX controls (Disable)
* Initialize and script ActiveX controls not marked as safe (Disable)
* Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
* Script ActiveX controls marked safe for scripting (Prompt)

Now try that online scan again.




The program will not run because it says I have insufficient rights and that I need to be the administrator. But I am the administrator!!
Post #21 last edited
Can you login as administrator?

Or try this one:
Trend Micro-Free online Scan: http://housecall.trendmicro.com/
set it to autoclean, if it cannot tell it to delete found files,,
Copy its report back here if its unable to please.
Post #22

Can you login as administrator?

Or try this one:
Trend Micro-Free online Scan: http://housecall.trendmicro.com/
set it to autoclean, if it cannot tell it to delete found files,,
Copy its report back here if its unable to please.



I tried to run the scan twice but the machine locked up after about four hours. I checked the user program in control panel and it says all the accounts are computer administrator except for guest that was shut off. There was also another account with just a file name that I never seen before. I also can't play any music or videos like you get on you tube. An activex warning always comes on right underneath my browser constantly. I think my registry has been corrupted, Is their anyway to retore or fix a registry or even find out if it is corrupted?
Post #23


Can you login as administrator?

Or try this one:
Trend Micro-Free online Scan: http://housecall.trendmicro.com/
set it to autoclean, if it cannot tell it to delete found files,,
Copy its report back here if its unable to please.



I tried to run the scan twice but the machine locked up after about four hours. I checked the user program in control panel and it says all the accounts are computer administrator except for guest that was shut off. There was also another account with just a file name that I never seen before. I also can't play any music or videos like you get on you tube. An activex warning always comes on right underneath my browser constantly. I think my registry has been corrupted, Is their anyway to retore or fix a registry or even find out if it is corrupted?




I forgot to mention that all the virus scans that I try they all find this virus W32/Rbot-FVY if that means anything to you. I tried to download internet explorer 7 but it would not allow it, It seems like something is trying to stop me from fixing this system!!
Post #24
* Download Combofix to your desktop.
Doubleclick combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.


Please use the [external image: Posted Image] Button below to reply.
Post #25
Owner - 07-01-08 20:18:13.20 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Owner\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\tracert.com
C:\Program Files\outlook


((((((((((((((((((((((((((((((( Files Created from 2006-12-08 to 2007-01-08 ))))))))))))))))))))))))))))))))))


2007-01-07 12:47 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-01-07 12:46 d——– C:\Documents and Settings\Owner\.housecall6.6
2007-01-06 10:37 d——– C:\ERDNT
2007-01-06 10:36 1,445,888 –a—— C:\WinsockxpFix.exe
2007-01-05 19:36 d——– C:\EmergencyUtils
2007-01-05 19:35 d——– C:\xp_emergencyutil
2007-01-05 17:36 121,856 ——— C:\WINDOWS\system32\xmllite.dll
2007-01-05 17:35 d——– C:\WINDOWS\network diagnostic
2007-01-05 17:28 64,896 –a—— C:\WINDOWS\system32\drivers\BSafFltr.sys
2007-01-05 17:28 23,343 –a—— C:\WINDOWS\system32\drivers\bsofrwl.sys
2007-01-05 17:28 135,168 –a—— C:\WINDOWS\system32\InetCntrl0003.dll
2007-01-05 17:27 11,867,704 –a—— C:\AtlanticBb.exe
2007-01-04 21:15 d——– C:\Program Files\Windows Defender
2007-01-01 14:56 47,104 –a—— C:\ATF-Cleaner.exe
2007-01-01 14:17 d——– C:\backups
2007-01-01 14:07 d——– C:\WINDOWS\SxsCaPendDel
2006-12-31 12:40 218,112 –a—— C:\hijackthis.exe
2006-12-30 17:27 dr-h—– C:\$VAULT$.AVG
2006-12-30 11:23 d——– C:\Documents and Settings\Owner\Application Data\AVG7
2006-12-30 11:21 d——– C:\Program Files\Grisoft
2006-12-30 11:21 d——– C:\Documents and Settings\All Users\Application Data\avg7
2006-12-29 19:12 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2006-12-29 19:11 d——– C:\Documents and Settings\All Users\Application Data\Google
2006-12-24 15:25 d——– C:\Program Files\MySpyProtector
2006-12-16 17:04 d——– C:\Documents and Settings\Owner\Shared
2006-12-16 17:03 d——– C:\Program Files\LimeWire
2006-12-16 17:02 d——– C:\Documents and Settings\Owner\.limewire
2006-12-13 18:29 d——– C:\Program Files\Windows Media Connect 2


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-07 12:47 ——– d——– C:\Program Files\Internet Explorer
2007-01-06 13:40 ——– d——– C:\Program Files\Adobe
2007-01-05 17:18 ——– d—s—- C:\Documents and Settings\Owner\Application Data\Microsoft
2007-01-01 14:18 ——– d——– C:\Program Files\Spybot - Search & Destroy
2007-01-01 10:32 ——– d——– C:\Program Files\Google
2006-12-30 19:47 ——– d——– C:\Documents and Settings\Owner\Application Data\LimeWire
2006-12-29 19:25 ——– d——– C:\Documents and Settings\Owner\Application Data\AdobeUM
2006-12-28 19:10 ——– d——– C:\Program Files\Yahoo!
2006-12-25 13:21 ——– d-a—— C:\Program Files\Toolbar
2006-12-23 17:10 ——– d——– C:\Program Files\IrfanView
2006-12-23 17:09 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-12-23 17:03 ——– d——– C:\Program Files\The Weather Channel FW
2006-12-23 12:05 ——– d——– C:\Documents and Settings\Owner\Application Data\MSN6
2006-12-22 10:07 ——– d-a—— C:\Program Files\MyWay
2006-12-21 11:36 ——– d——– C:\Program Files\Ares
2006-12-13 18:46 1640 –a—— C:\Documents and Settings\Owner\Application Data\AdobeDLM.log
2006-12-13 18:46 0 –a—— C:\Documents and Settings\Owner\Application Data\dm.ini
2006-12-13 18:34 ——– d——– C:\Program Files\Windows Media Player
2006-12-13 06:41 ——– d——– C:\Program Files\Outlook Express
2006-12-07 21:35 ——– d——– C:\Program Files\QuickTime
2006-11-30 12:05 21290704 –a—— C:\Program Files\AdbeRdr708_en_US.exe
2006-11-30 12:04 7050552 –a—— C:\Program Files\psa30se_en_us.exe
2006-11-23 19:50 ——– d——– C:\Program Files\KODAK
2006-11-16 06:40 ——– d——– C:\Program Files\MSXML 4.0
2006-11-11 14:31 ——– d——– C:\Program Files\iWin.com
2006-11-08 00:06 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-11-04 14:14 1245696 –a—— C:\WINDOWS\system32\msxml4.dll
2006-10-19 08:56 713216 –a—— C:\WINDOWS\system32\sxs.dll
2006-10-18 21:58 8704 –a—— C:\WINDOWS\system32\wdfmgr.exe
2006-10-18 21:58 8704 –a—— C:\WINDOWS\system32\uwdf.exe
2006-10-18 21:47 99840 –a—— C:\WINDOWS\system32\wmpshell.dll
2006-10-18 21:47 991744 –a—— C:\WINDOWS\system32\drmv2clt.dll
2006-10-18 21:47 937984 –a—— C:\WINDOWS\system32\WMNetMgr.dll
2006-10-18 21:47 8231936 –a—— C:\WINDOWS\system32\wmploc.dll
2006-10-18 21:47 767488 ——— C:\WINDOWS\system32\WMVSENCD.dll
2006-10-18 21:47 757248 –a—— C:\WINDOWS\system32\WMADMOD.dll
2006-10-18 21:47 7168 –a—— C:\WINDOWS\system32\asferror.dll
2006-10-18 21:47 656896 ——— C:\WINDOWS\system32\WMVXENCD.dll
2006-10-18 21:47 63488 –a—— C:\WINDOWS\system32\wpdmtpus.dll
2006-10-18 21:47 629760 –a—— C:\WINDOWS\system32\wpd_ci.dll
2006-10-18 21:47 613376 ——— C:\WINDOWS\system32\wmpmde.dll
2006-10-18 21:47 603648 –a—— C:\WINDOWS\system32\WMSPDMOD.dll
2006-10-18 21:47 542720 –a—— C:\WINDOWS\system32\blackbox.dll
2006-10-18 21:47 535040 ——— C:\WINDOWS\system32\wmdrmsdk.dll
2006-10-18 21:47 429056 ——— C:\WINDOWS\system32\wmdrmdev.dll
2006-10-18 21:47 414208 –a—— C:\WINDOWS\system32\msscp.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmvdmoe2.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmvdmod.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmsdmoe2.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wmsdmod.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\wdfapi.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MPG4DMOD.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MP4SDMOD.dll
2006-10-18 21:47 4096 –a—— C:\WINDOWS\system32\MP43DMOD.dll
2006-10-18 21:47 4096 ——— C:\WINDOWS\system32\WMVADVE.DLL
2006-10-18 21:47 4096 ——— C:\WINDOWS\system32\WMVADVD.dll
2006-10-18 21:47 38400 ——— C:\WINDOWS\system32\wpdshextres.dll
2006-10-18 21:47 37376 –a—— C:\WINDOWS\system32\wmdmps.dll
2006-10-18 21:47 35840 –a—— C:\WINDOWS\system32\wpdconns.dll
2006-10-18 21:47 356352 –a—— C:\WINDOWS\system32\wpdsp.dll
2006-10-18 21:47 348672 ——— C:\WINDOWS\system32\wmdrmnet.dll
2006-10-18 21:47 33792 –a—— C:\WINDOWS\system32\wmdmlog.dll
2006-10-18 21:47 321536 –a—— C:\WINDOWS\system32\mswmdm.dll
2006-10-18 21:47 317440 ——— C:\WINDOWS\system32\MP4SDECD.dll
2006-10-18 21:47 314880 –a—— C:\WINDOWS\system32\wmpdxm.dll
2006-10-18 21:47 295936 ——— C:\WINDOWS\system32\wmpeffects.dll
2006-10-18 21:47 284160 –a—— C:\WINDOWS\system32\portabledeviceapi.dll
2006-10-18 21:47 276992 ——— C:\WINDOWS\system32\audiodev.dll
2006-10-18 21:47 27136 –a—— C:\WINDOWS\system32\mspmsnsv.dll
2006-10-18 21:47 2603008 ——— C:\WINDOWS\system32\WpdShext.dll
2006-10-18 21:47 259072 ——— C:\WINDOWS\system32\MPG4DECD.dll
2006-10-18 21:47 259072 ——— C:\WINDOWS\system32\MP43DECD.dll
2006-10-18 21:47 2450944 –a—— C:\WINDOWS\system32\wmvcore.dll
2006-10-18 21:47 242688 –a—— C:\WINDOWS\system32\wmpasf.dll
2006-10-18 21:47 229376 –a—— C:\WINDOWS\system32\cewmdm.dll
2006-10-18 21:47 227328 –a—— C:\WINDOWS\system32\wmerror.dll
2006-10-18 21:47 222208 –a—— C:\WINDOWS\system32\WMASF.dll
2006-10-18 21:47 212992 –a—— C:\WINDOWS\system32\mfplat.dll
2006-10-18 21:47 211456 –a—— C:\WINDOWS\system32\qasf.dll
2006-10-18 21:47 204288 ——— C:\WINDOWS\system32\wmpsrcwp.dll
2006-10-18 21:47 199168 ——— C:\WINDOWS\system32\PortableDeviceWMDRM.dll
2006-10-18 21:47 179712 –a—— C:\WINDOWS\system32\msnetobj.dll
2006-10-18 21:47 175616 –a—— C:\WINDOWS\system32\mspmsp.dll
2006-10-18 21:47 166912 –a—— C:\WINDOWS\system32\portabledevicetypes.dll
2006-10-18 21:47 1661440 ——— C:\WINDOWS\system32\wmpencen.dll
2006-10-18 21:47 1574912 ——— C:\WINDOWS\system32\WMVENCOD.dll
2006-10-18 21:47 157184 –a—— C:\WINDOWS\system32\wmidx.dll
2006-10-18 21:47 154624 –a—— C:\WINDOWS\system32\wpdmtp.dll
2006-10-18 21:47 1543680 ——— C:\WINDOWS\system32\WMVDECOD.dll
2006-10-18 21:47 1382912 ——— C:\WINDOWS\system32\WMVSDECD.dll
2006-10-18 21:47 133632 –a—— C:\WINDOWS\system32\wpdshserviceobj.dll
2006-10-18 21:47 1329152 –a—— C:\WINDOWS\system32\WMSPDMOE.dll
2006-10-18 21:47 132096 ——— C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
2006-10-18 21:47 130048 ——— C:\WINDOWS\system32\wmpps.dll
2006-10-18 21:47 11264 –a—— C:\WINDOWS\system32\LAPRXY.dll
2006-10-18 21:47 1117696 –a—— C:\WINDOWS\system32\WMADMOE.dll
2006-10-18 21:47 101888 ——— C:\WINDOWS\system32\PortableDeviceClassExtension.dll
2006-10-18 20:03 100864 –a—— C:\WINDOWS\system32\logagent.exe
2006-10-18 20:00 249856 ——— C:\WINDOWS\system32\drmupgds.exe
2006-10-18 20:00 17408 ——— C:\WINDOWS\system32\wpdshextautoplay.exe
2006-10-13 07:35 142336 –a—— C:\WINDOWS\system32\nwprovau.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"InetCntrl"="C:\\WINDOWS\\system32\\InetCntrl\\InetCntrl.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="http://active.ieplugin.com/active/?16764334"
"SubscribedURL"="http://active.ieplugin.com/active.cdf"
"FriendlyName"="Intelligent Explorer[ieplugin.com] OnScreen Portal"
"Flags"=dword:00004002
"Position"=hex:2c,00,00,00,82,01,00,00,42,00,00,00,f4,01,00,00,e5,01,00,00,ea,\
03,00,00,00,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,0c,02,00,00,12,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=dword:00000001
"AllowUnhashedWebView"=dword:00000001
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
"location"="Common Startup"
"item"="GStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center UI.lnk]
"location"="Common Startup"
"item"="hp center UI"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center.lnk]
"location"="Common Startup"
"item"="hp center"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Kodak EasyShare software.lnk"
"backup"="C:\\WINDOWS\\pss\\Kodak EasyShare software.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\KODAK\\KODAKE~1\\bin\\EASYSH~1.EXE -hx"
"item"="Kodak EasyShare software"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Picture Transfer Software.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Kodak\\KODAKP~2\\pts.exe "
"item"="KODAK Picture Transfer Software"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Quicken\\bagent.exe "
"item"="Quicken Scheduled Updates"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^kids^Start Menu^Programs^StartUp^PowerReg Scheduler V3.exe]
"location"="Startup"
"item"="PowerReg Scheduler V3"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^kids^Start Menu^Programs^StartUp^Webshots.lnk]
"location"="Startup"
"command"="C:\\PROGRA~1\\Webshots\\Launcher.exe /t"
"item"="Webshots"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^kids^Start Menu^Programs^StartUp^WordWeb.lnk]
"location"="Startup"
"item"="WordWeb"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
"path"="C:\\Documents and Settings\\Owner\\Start Menu\\Programs\\Startup\\LimeWire On Startup.lnk"
"backup"="C:\\WINDOWS\\pss\\LimeWire On Startup.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\LimeWire\\LimeWire.exe -startup"
"item"="LimeWire On Startup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Zeno.lnk]
"location"="Startup"
"item"="Zeno"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ALCXMNTR"
"hkey"="HKLM"
"command"="ALCXMNTR.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ares"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ber]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ber"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ccApp"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpsysdrv"
"hkey"="HKLM"
"command"="c:\\windows\\system\\hpsysdrv.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="KBD"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnappau"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCLEPCI]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PPE"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PSDrvCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\prjtect]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="prjtect"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ps2"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\ps2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioEngineUtility]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="EngUtil"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpgs2wnd"
"hkey"="HKLM"
"command"="c:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SOUNDMAN"
"hkey"="HKLM"
"command"="SOUNDMAN.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SpyHunter"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="swdoctor"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_05\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sgtray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wcmdmgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wcmdmgrl"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="coloreal"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Coloreal\\coloreal.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Weather"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="whsurvey"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XFLYCJ]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="XFLYCJ"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll"



~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job

Completion time: 07-01-08 20:27:12.85
C:\ComboFix.txt … 07-01-08 20:27

Logfile of HijackThis v1.99.1
Scan saved at 8:29:57 PM, on 1/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\InetCntrl\InetCntrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\InetCntrl\Maint\ControlCenter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\notepad.exe
C:\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\system32\InetCntrl\InetCntrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Broken Internet access because of LSP provider 'inetcntrl0003.dll' missing
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k42037/sb028.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/…ebio5_1_5_0.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by111fd.bay111.hotmail.msn.com/activex/HMAtchmt.ocx
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe

Here are the logs you asked for, finally something worked.
Post #26
Click the HERE and Save, Install, Update and run a full scan. Let me know what it finds.

Delete thos File if listed unless you know what they are;
C:\AtlanticBb.exe


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment
Post #27
I ran the virus protection and got 38121 files infected with this spyware, any suggestions!! Search our siteSkip navigation Products Support Security information Threat analyses Spyware and adware Hoaxes Best practice White papers Top 10 viruses Email notification Podcasts Hot topic About us Press office Partners Skip navigation In this section Home Security information Threat analyses W32/Rbot-FVY Spyware Worm Summary Summary Description Recovery Prevalence: low high Name W32/Rbot-FVY Type Spyware Worm How it spreads Network shares Affected operating systems Windows Side effects Allows others to access the computer Downloads code from the internet Records keystrokes Installs itself in the Registry Exploits system or software vulnerabilities Used in DOS attacks Aliases Backdoor.Win32.EggDrop.v WORM_SPYBOT.IS Protection Download virus identity (IDE) file Protection available since 17 November 2006 11:42:17 (GMT) Detected by All versions of Sophos Anti-Virus Included in our products from January 2007 (4.13) More information on IDE files What are IDE files? How to use IDE files Get the latest IDE files Description Summary Description Recovery This section helps you to understand how it behaves W32/Rbot-FVY is a network worm with IRC backdoor functionality. W32/Rbot-FVY runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. W32/Rbot-FVY spreads to other network computers by: - exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011) and RPC-DCOM (MS04-012) - networks protected by weak passwords Recovery Summary Description Recovery This section tells you how to remove the threat. Please follow the instructions for removing worms. |Get reports on the latest virus threats delivered to your computer © 1997-2007 Sophos Plc. Company Number: 2096520. All rights reserved. Legal | Privacy | RSS and Atom feeds Contact us
Post #28

I ran the virus protection and got 38121 files infected with this spyware, any suggestions!!

What virus protection? Did it clean them?

That's why I asked you to download, install and run Grisoft's free anti-virus program. It will clean what it finds.


Did you know what this file was?
C:\AtlanticBb.exe
Post #29
C:\AtlanticBb.exe Is a file associated with my service provider Atlantic broadband. and that's who I have virus protection through. I tried to run the free scan you hooked me up with but it won't finish. I will shut down my protection and try again if you think it will help!
Post #30

C:\AtlanticBb.exe Is a file associated with my service provider Atlantic broadband. and that's who I have virus protection through. I tried to run the free scan you hooked me up with but it won't finish. I will shut down my protection and try again if you think it will help!

Thanks for the info on AtlanticBb.exe.
The scan you ran concerns me in that it didn't list the infected files or if it removed them.

I'd like for you to try the online scan again and if you need to shutdown the protection you have now in order to run it, please do so.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI