Spyware / Malware / Virus Removal

Laptop driving me mad

21 min read

Looking for the outcome? Ask AI

Bloop?! Topic Starter

Post #1January 17, 2007, 3:24 PM UTC last edited January 17, 2007, 4:05 PM UTC

Hello,

Lately my Toshiba Sateillite has been experiencing a lot of problems, including:

*VERY* annoying 'Microsoft Visual C++…something' error for 'capfsem.exe' that comes up repeatedly, sometimes every couple of seconds.
Not shutting down occasionally- freezing at 'Windows is shutting down…' screen.
Blue Screen Errors, just had another one: 'IRQL not less or equal'.
Not starting up occasionally- gets past User login page then freezes with black screen.
IE working normally one minute, then becoming *infuriatingly* slow the next (took 10 minutes to get onto these forums).
Small programs such as Windows Media Player taking up 60+ % of CPU capacity (total usage always close to 100%), making use of the computer very difficult.
IE constantly re-setting homepage to 'about:blank'.
Fan continuously spinning at max speed even when running no programs.
AVG Anti-Virus detecting 'no internet connection'.

Plus I just got over a 'secure32.html' infection that I think damaged CA Security Centre…

Here is my HJT log, please could somebody have a look and tell me what I should do (step-by-step). Any help would be appreciated. Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 15:45:34, on 17/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfaem.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\cliohozf.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\sammy\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfaem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfaem.exe
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKLM\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lmjvservc] cliohozf.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://tohellwiththeusa.spaces.live.com//P…ad/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal…eck_1_0_0_5.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal…0_15_Silent.cab
O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal…sal_1_0_0_3.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…603/mcfscan.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

tim s

Post #2January 17, 2007, 9:07 PM UTC last edited January 17, 2007, 9:13 PM UTC

Hello Bloop,

Welcome to the Tomcoyote forum! I'll be glad to help you with your computer problems.
HijackThis logs can take some time to research, so please be patient with me. I know that you need
your computer working as quickly as possible, and I will work hard to help see that happens.

In order to help me help you, please observe the following while we work:

If you don't know, stop and ask! Don't continue, we don't want to start all over again!
Understand that cleaning your computer can sometimes take multiple passes/posts,
and it's important to follow the steps as listed including re-running scans as listed
Please reply to this thread, do not start another.

If you can do those three things, everything should go smoothly

——————————————————

Plus I just got over a 'secure32.html' infection that I think damaged CA Security Centre.

You must take care of this first.

Anti-virus programs and Firewall programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two or more anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash. They can conflict with each other which leaves you open to infection.

AVG Anti-Virus (free for personal use only available) unless it has changed does not come with a Firewall it has to be installed separately
the same goes for Avast

You must have a Firewall program. Here are some you can choose from to run with Anti-Virus program listed above:
Firewall protection programs: (free for personal use only available)
ZoneAlarm: http://www.zonelabs.com/store/content/cata….jsp?lid=nav_za
Outpost : http://www.agnitum.com/products/outpostfree/index.php

CA Security Centre has both. Is this a paid for version? and is it still up-to-date?

If you have more than one antivirus program installed, you must narrow it down to only one. Please choose one that is currently capable of receiving updates of virus definitions. If you have an antivirus program that no longer has an active subscription to antivirus updates, it cannot protect your system from malware.

You must decide and uninstall all others.

———————————————–

Your log does show signs of infection. I need you to decide which protection program you want to have your computer first before we can start cleaning infection.

When you have uninstalled the programs you don't want reboot computer and come back to this thread and post a new HiJackThis log for me to check.

Bloop?!

Post #3January 17, 2007, 10:23 PM UTC

tim s,

Thanks for your quick reply.

1.) Choice between CA, AVG or Avast. All of them are being funny…

I chose Avast because out of the three I had, because it worked the most. The real-time protection works well, but when I select the scan option, nothing comes up.

CA's Virus component is useless because it detected but couln't delete a load of infections a couple of days ago, including that 'secure32.html'. The Spyware component didn't work at all, and the Firewall part kept giving me a 'Runtime' error (and it expires in 16 days anyway)…so I uninstalled most of it, but what's left keeps insisting that I need to log in as administrator or something and I can't get rid of it. <_<

As for AVG, the system scan wouldn't work properly, and it wouldn't even allow me to enable the Resident Shield. So bye-bye to that too.

2.) Firewall.

Between the time I posted and you replied I downloaded and installed Kerio Personal Firewall, because it was recommended on an internet security guide that I read. Is this one as good as Outpost and ZoneAlarm? It seems to be working fine…

Here is the new HJT log you asked for, and sorry if there are too many problems…

Logfile of HijackThis v1.99.1
Scan saved at 23:22:27, on 17/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\cliohozf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\amcxlss.exe
C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
C:\WINDOWS\system32\mmcvwli.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashAvast.exe
C:\Documents and Settings\sammy\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lmjvservc] cliohozf.exe
O4 - HKLM\..\Run: [{9070C848-06C1-1033-0609-05050609002c}] "C:\Program Files\Common Files\{9070C848-06C1-1033-0609-05050609002c}\Update.exe" te-110-12-0000245
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [lvcdmsys] C:\WINDOWS\system32\amcxlss.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [mdwinllm3] C:\WINDOWS\system32\mmcvwli.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://tohellwiththeusa.spaces.live.com//P…ad/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal…eck_1_0_0_5.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal…0_15_Silent.cab
O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal…sal_1_0_0_3.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…603/mcfscan.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000245 (file missing)
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

tim s

Post #4January 17, 2007, 10:37 PM UTC

Between the time I posted and you replied I downloaded and installed Kerio Personal Firewall, because it was recommended on an internet security guide that I read. Is this one as good as Outpost and ZoneAlarm? It seems to be working fine…

Yes that is fine.

Did you uninstall CA's Virus program it is still showing in your log?

Bloop?!

Post #5January 17, 2007, 10:43 PM UTC

Yes. The only part that remains is the Firewall component. It's completely locked in C:/, can't get rid of it even with Tune Up Utilities and Unlocker.

tim s

Post #6January 17, 2007, 10:45 PM UTC

Hi Bloop?! Don't try anything yet let me check on a few things and I will post back as soon as I can.

tim s

Post #7January 17, 2007, 11:57 PM UTC

Hello Bloop?!,

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Please disable programs that can interfere with fix:
Disable SpywareDoctor's realtime protection.

Open Spyware Doctor
Click the "OnGuard" button on the left side.
Uncheck "Activate OnGuard".
Exit the program.

Please disable Windows Defender Real Time Protection as it may interfere with the fix.

To disable Windows Defender:

Open Windows Defender
Click Tools
Click Options
You will have to Scroll down this screen until you see Real Time Protection Options
Uncheck Use Use Real Time Protection (recommended)
Click on the save button
Close Windows Defender

Once your log is clean you can re-enable Windows Defender Real Time Protection.
————————————————-

This is next:
To enable the viewing of Hidden files follow these steps:

Close all programs so that you are at your desktop.
Click Start, then select My Computer)
Select the Tools (at top of opened screen in menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and shutdown My Computer.
Now your computer is configured to show all hidden files.

————————————————-

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

————————————————-
Ok This is next we are going to try this way first.
Now lets stop a system process

Go to the start menu - Select run, type in services.msc
Look down the list of services until you see one called COM+ Messages
Double click on the service name to open up the properties box
Look where it says "Service Status" and select Stop
Now from the Startup-type select Disabled from the menu
Next click on the apply button then click on the ok button

This will bring you back to the list of services
now repeat the above actions for the following other services
Service name:

CA Pest Patrol Realtime Protection Service (ITMRTSVC) HIPS Event Manager (UmxAgent)
HIPS Configuration Interpreter (UmxCfg)
HIPS Firewall Helper (UmxFwHlp)
HIPS Policy Manager (UmxPol)
————————————————-

Reboot computer here back into safe mode again.

————————————————-

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000245 (file missing)
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

————————————————–

Still in safemode
Use Explorer to navigate to and delete the following file and folder (if they are present) just what is in red:

Files:

C:\WINDOWS\system32\svchosts.exe <<<< Important look at spelling do not I repeat do not delete this one svchost.exe no s after t that is a legit file. If not found move to next one.

Folders:

C:\Program Files\CA

———————————————————

Now reboot back to normal mode and post a new HiJackthis log for me to check.

Bloop?!

Post #8January 18, 2007, 1:25 PM UTC

I had to stop and disable the 4 system processes in services.msc in normal mode, because in safe mode the properties menu for each one wouldn't come up when I selected it. Other than that I followed the other steps as you instructed.

The CA folder has re-appeared in C:/Programs even after I deleted it in safe mode, but now it is empty, and its start menu entries give me a 'Missing Shortcut: Browsing Manually' warning. So it looks like we are getting there…

(Just to let you know before the next step/s, I have enabled run-time protection on Windows Defender and Spyware Doc). Thanks for your continued time and patience…

New log:

Logfile of HijackThis v1.99.1
Scan saved at 14:13:24, on 18/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\cliohozf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\amcxlss.exe
C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\mmcvwli.exe
C:\WINDOWS\system32\RAMASST.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\sammy\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lmjvservc] cliohozf.exe
O4 - HKLM\..\Run: [{9070C848-06C1-1033-0609-05050609002c}] "C:\Program Files\Common Files\{9070C848-06C1-1033-0609-05050609002c}\Update.exe" te-110-12-0000245
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [lvcdmsys] C:\WINDOWS\system32\amcxlss.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [mdwinllm3] C:\WINDOWS\system32\mmcvwli.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://tohellwiththeusa.spaces.live.com//P…ad/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal…eck_1_0_0_5.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal…0_15_Silent.cab
O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal…sal_1_0_0_3.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…603/mcfscan.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

Bloop?!

Post #9January 18, 2007, 3:53 PM UTC

Update: I used Tune Up Utilities to delete the start menu entries and Unlocker to get rid of the empty program file in C:/. Registry Mechanic mopped up the residue junk. Its all gone

tim s

Post #10January 19, 2007, 2:43 AM UTC

Hello Bloop?!

Thanks for posting logs and Good job. This is next:

I will need you to disabe these again they will interfere with scans. Run-time protection on Windows Defender and Spyware Doc.

Please do the followng:

Download SmitfraudFix (by S!Ri) make sure to click the Save button not Run button and save to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a 'RiskTool'; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between 'good' and 'malicious' use of such programs, therefore they may alert the user.
————————————————————————

Make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1.Start HijackThis

[external image: Posted Image]

2. Click on the Open the Misc tool section button
3. Click on the Misc Tools button

[external image: Posted Image]

4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

[external image: Posted Image]

5. Click on the Save list… button and specify where you would like to save this file. When you press Save list button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply. Note: please uncheck word wrap under format in notepad

Post HJT Uninstall list in next reply
———————————————–

Please post in your next reply:
SmitfraudFix rapport.txt
HJT uninstall list
new HJT log

Bloop?!

Post #11January 19, 2007, 10:52 AM UTC

SmitFraudFix rapport.txt:

SmitFraudFix v2.132

Scan done at 11:44:14.21, 19/01/2007
Run from C:\Documents and Settings\sammy\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\autosys.exe FOUND !
C:\WINDOWS\system32\ot.ico FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\sammy

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\sammy\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\sammy\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

pe386 detected, use a Rootkit scanner

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

HJT uninstall_list.txt:

Ad-Aware SE Personal
Adobe Acrobat - Reader 6.0.2 Update
Adobe Flash Player 9 ActiveX
Adobe Reader 6.0.1
Adobe Shockwave Player
ALPS Touch Pad Driver
Ares 1.8.1
Atheros Wireless LAN MiniPCI card Driver
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
avast! Antivirus
BitTorrent 4.22.1
CA Pest Patrol Realtime Protection
CD/DVD Drive Acoustic Silencer
CleanUp!
DAEMON Tools
DivX
DivX Player
DVD Shrink 3.2
DVD-RAM Driver
Far Cry
GameSpy Arcade
HijackThis 1.99.1
Hotfix for Windows XP (KB915865)
hp deskjet 5550 series
hp deskjet 5550 series (Remove only)
hp print screen utility
InterVideo WinDVD for TOSHIBA
iPod for Windows 2005-03-23
IsoBuster 1.9.1
J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 9
Macromedia Flash Player
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office OneNote 2003
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)
Mozilla Firefox (2.0.0.1)
MSN Messenger 7.5
MSXML 4.0 SP2 (KB927978)
NeroVision Express 3
Paint.NET v2.6
Paltalk Messenger
QuickTime
Realtek AC'97 Audio
REALTEK Gigabit and Fast Ethernet NIC Driver
Registry Mechanic 6.0
Samsung PC Studio 2.1
Samsung USB Driver (MCCI 4.24)
SD Secure Module
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB926255)
SMSC IrCC V5.1.3600.5 SP2
Sonic RecordNow!
Spybot - Search & Destroy 1.4
Spyware Doctor 4.0
Sunbelt Kerio Personal Firewall
TeamSpeak 2 RC2
Texas Instruments PCIxx21/x515 drivers.
TOSHIBA Accessibility
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Controls
TOSHIBA Hardware Setup
TOSHIBA Hotkey Utility
TOSHIBA Manuals
TOSHIBA PC Diagnostic Tool
TOSHIBA Power Saver
TOSHIBA SD Memory Card Format
TOSHIBA Software Modem
TOSHIBA Supervisor Password
TOSHIBA Virtual Sound
TOSHIBA Zooming Utility
Touch and Launch
TouchPad On/Off Utility
TuneUp Utilities 2006
Unlocker 1.8.3
upapp
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
WinAVIVideoConverter
Windows Defender
Windows Defender Signatures
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Safety Scanner
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885855
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB889673
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
X-Cleaner Freeware
Yahoo! Messenger

New HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:48:39, on 19/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\cliohozf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\amcxlss.exe
C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
C:\WINDOWS\system32\mmcvwli.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\sammy\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lmjvservc] cliohozf.exe
O4 - HKLM\..\Run: [{9070C848-06C1-1033-0609-05050609002c}] "C:\Program Files\Common Files\{9070C848-06C1-1033-0609-05050609002c}\Update.exe" te-110-12-0000245
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [lvcdmsys] C:\WINDOWS\system32\amcxlss.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [mdwinllm3] C:\WINDOWS\system32\mmcvwli.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://tohellwiththeusa.spaces.live.com//P…ad/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal…eck_1_0_0_5.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal…0_15_Silent.cab
O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal…sal_1_0_0_3.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…603/mcfscan.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

tim s

Post #12January 19, 2007, 12:54 PM UTC

Hello Bloop?!

Thanks for posting logs.
This Add or Remove Programs entry corresponds to a program that is either malware, installs malware, or is bundled with malware.
Paltalk Messenger

This one needs to be removed
Add/Remove Programs

Click Start
Go to Control Panel
Go to Add/Remove Programs
Find and click Remove for the following:

Paltalk Messenger

You will need to reboot computer to complete uninstall.
—————————————————–

These programs still have to be disabled Run-time protection on Windows Defender and Spyware Doc.

——————————————————
I will need you to download these tools but do not run them yet.

Download the Killbox.
Unzip it to the desktop

NEXT THIS ONE
*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!

Download CCleaner from here It will start to download automatically. If ask if you want to download let it. Save to your Desktop.
Note: If you get and Error page from this link.
Try again you will see this message Your download of CCleaner will automatically start in 5 seconds. Click here if it does not do not wait go ahead and click on it.

Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Follow prompts to install finish to complete installation.

Close Ccleaner with running yet.
——————————————————————–

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Here we are going to just make sure this tool is setup correctly Do not run scan yet.
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to the words Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
- Click on Scanner on the toolbar at top of this screen.
- Click on the Settings tab.
  - Under How to act?
  - Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
  - All checkboxes should be ticked.
- Under Possibly unwanted software:
  - All checkboxes should be ticked.
- Under Reports:
  - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
  - Select Scan every file.
Close AVG Anti-Spyware without running yet.

Now disable (turn off AVG Anti-Spyware)

Right-click the AVG Anti-Spyware Tray Icon (Bottom right corner of computer screen near clock) and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon again and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update AVG Anti-Spyware.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

______________________________

Double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Check to make sure that even in safemode that these processes are not running.
Press Control-Alt-Del to enter the Task Manager.

Click on the Processes tab and end the following processes if found:

cliohozf.exe
amcxlss.exe
mmcvwli.exe
Exit the Task Manager when finished.
————————————————-

Still in safemode here:
Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O4 - HKLM\..\Run: [lmjvservc] cliohozf.exe
O4 - HKCU\..\Run: [lvcdmsys] C:\WINDOWS\system32\amcxlss.exe
O4 - HKCU\..\Run: [mdwinllm3] C:\WINDOWS\system32\mmcvwli.exe

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

—————————————————

Start Killbox place a tick next to [+]Delete on reboot Press the ALL Files button <<<< This is important to hit the ALL FILES button
Copy this whole list into the windows clipboard, all the Bold below.

C:\WINDOWS\system32\cliohozf.exe
C:\WINDOWS\system32\amcxlss.exe
C:\WINDOWS\system32\mmcvwli.exe

Back in Killbox go > file (Top left corner) > choose from drop down menu paste from clipboard.,
Click the red highlighted X button and say NO to the prompt to restart the pc.
Exit Killbox and restart Your PC into normal mode.

______________________________

Double click the CCleaner shortcut on the desktop to start the program.

On the Windows tab, under Internet Explorer,
All Boxes should have a check mark. (You will need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).

On the Windows tab, under Windows Explorer,
All Boxes should have a check mark.

On the Windows tab, under System,
All Boxes should have a check mark.

On the Windows tab, under Advanced,
NO check marks

If you use either the Firefox or Mozilla browsers, the box to put check in for "Cookies" is on the Applications tab, under Firefox/Mozilla. If already checked move to next step.
Click on the "Options" icon at the left side of the window, then click on "Advanced."
deselect "Only delete files in Windows Temp folders older than 48 hours."
Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.
You will need to reboot here if not ask to do so. Again you will have to reboot back into safemode.

_______________________________

Run this in safemode
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Note: If AVG Anti-Spyware screen does not fit your monitor screen Hold down the Alt button on keyboard then tap spacebar, menu should pop up then choose maximize. AVG Anti-Spyware screen should fix screen a little better.

Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.

[external image: Posted Image]

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.

Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button.(3)

When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot to normal mode.
______________________________

Please post:

c:\rapport.txt
AVG Anti-Spyware log
A new HijackThis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

Bloop?!

Post #13January 20, 2007, 8:58 PM UTC

Sorry for the slow reply, I had a piece of work to do that needed constant use of the computer today and yesterday evening.

Just 2 incidents this time: I had to run Killbox in normal mode because it wouldn't start up in safe mode, and CCleaner closed automatically…when i got back to the computer there was no result report, nothing…so I don't know if it even finished properly.

But here are the 3 logs you asked for:

SmitFraudFix rapport.txt:

SmitFraudFix v2.132

Scan done at 17:21:30.89, 19/01/2007
Run from C:\Documents and Settings\sammy\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\autosys.exe Deleted
C:\WINDOWS\system32\ot.ico Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

AVG Anti-Spyware Report:

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 21:17:29 20/01/2007

+ Scan result:

C:\Program Files\Common Files\{3070C848-06C0-1033-0609-05050609002c}\Bar888.dll -> Adware.Softomate : Cleaned.
C:\Program Files\Common Files\{9070C848-06C0-1033-0609-05050609002c}\Update.exe -> Adware.Softomate : Cleaned.
C:\Program Files\Common Files\{9070C848-06C1-1033-0609-05050609002c}\Update.exe -> Adware.Softomate : Cleaned.
C:\System Volume Information\_restore{95C8BA23-7DEC-40CD-A7C2-1ABB11423E47}\RP429\A0043383.exe -> Dropper.Agent.bbp : Cleaned.
:mozilla.78:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.79:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.80:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.69:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.46:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Co : Cleaned.
:mozilla.47:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Co : Cleaned.
:mozilla.152:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.118:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.119:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.120:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.121:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.39:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.65:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.66:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.67:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.68:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.12:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.99:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.13:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.14:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.15:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.16:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.17:C:\Documents and Settings\sammy\Application Data\Mozilla\Firefox\Profiles\e6xjxgtk.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{95C8BA23-7DEC-40CD-A7C2-1ABB11423E47}\RP430\A0044432.exe -> Trojan.Small : Cleaned.
C:\Program Files\Ares\My Shared Folder\avg antivirus pro crack.zip/avg antivirus pro crack.exe/td.exe -> Worm.Agent.v : Cleaned.
C:\Program Files\Ares\My Shared Folder\avg antivirus pro crack.zip/avg antivirus pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
C:\System Volume Information\_restore{95C8BA23-7DEC-40CD-A7C2-1ABB11423E47}\RP425\A0035971.exe/td.exe -> Worm.Agent.v : Cleaned.
C:\System Volume Information\_restore{95C8BA23-7DEC-40CD-A7C2-1ABB11423E47}\RP425\A0035971.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\007 spy software crack.zip/007 spy software crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\007 spy software crack.zip/007 spy software crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\3ds max 7 crack.zip/3ds max 7 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\3ds max 7 crack.zip/3ds max 7 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\3gp converter crack.zip/3gp converter crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\3gp converter crack.zip/3gp converter crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Abakus UIQ3 crack.zip/Abakus UIQ3 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Abakus UIQ3 crack.zip/Abakus UIQ3 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Adobe Acrobat Pro crack.zip/Adobe Acrobat Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Adobe Acrobat Pro crack.zip/Adobe Acrobat Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\CamStudio crack.zip/CamStudio crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\CamStudio crack.zip/CamStudio crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Cash Cow crack.zip/Cash Cow crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Cash Cow crack.zip/Cash Cow crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\DVD Cloner IV crack.zip/DVD Cloner IV crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\DVD Cloner IV crack.zip/DVD Cloner IV crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\EMPIRE EARTH 2 crack.zip/EMPIRE EARTH 2 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\EMPIRE EARTH 2 crack.zip/EMPIRE EARTH 2 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\EasyBoot crack.zip/EasyBoot crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\EasyBoot crack.zip/EasyBoot crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\FLASHFXP crack.zip/FLASHFXP crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\FLASHFXP crack.zip/FLASHFXP crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\FinePrint crack.zip/FinePrint crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\FinePrint crack.zip/FinePrint crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Kaspersky Anti-Virus Personal Pro crack.zip/Kaspersky Anti-Virus Personal Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Kaspersky Anti-Virus Personal Pro crack.zip/Kaspersky Anti-Virus Personal Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Macromedia Flash 8 crack.zip/Macromedia Flash 8 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Macromedia Flash 8 crack.zip/Macromedia Flash 8 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Magic Photo Editor crack.zip/Magic Photo Editor crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Magic Photo Editor crack.zip/Magic Photo Editor crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\MagicLines crack.zip/MagicLines crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\MagicLines crack.zip/MagicLines crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\MagicMatch crack.zip/MagicMatch crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\MagicMatch crack.zip/MagicMatch crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Mpeg crack.zip/Mpeg crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Mpeg crack.zip/Mpeg crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Mystic Inn crack.zip/Mystic Inn crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Mystic Inn crack.zip/Mystic Inn crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Outpost Firewall Pro crack.zip/Outpost Firewall Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Outpost Firewall Pro crack.zip/Outpost Firewall Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Perpetual Disco Screen Saver crack.zip/Perpetual Disco Screen Saver crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Perpetual Disco Screen Saver crack.zip/Perpetual Disco Screen Saver crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Pinball Arcade crack.zip/Pinball Arcade crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Pinball Arcade crack.zip/Pinball Arcade crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Pinnacle Studio Plus Titanium Edition v10.6 crack.zip/Pinnacle Studio Plus Titanium Edition v10.6 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Pinnacle Studio Plus Titanium Edition v10.6 crack.zip/Pinnacle Studio Plus Titanium Edition v10.6 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Poker Superstars crack.zip/Poker Superstars crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Poker Superstars crack.zip/Poker Superstars crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Quick time crack.zip/Quick time crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Quick time crack.zip/Quick time crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\R-Studio crack.zip/R-Studio crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\R-Studio crack.zip/R-Studio crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Simply Calenders crack.zip/Simply Calenders crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Simply Calenders crack.zip/Simply Calenders crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Sothink SWF Decompiler 3.4 build 60912 crack.zip/Sothink SWF Decompiler 3.4 build 60912 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Sothink SWF Decompiler 3.4 build 60912 crack.zip/Sothink SWF Decompiler 3.4 build 60912 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\System Mechanic 6.0u crack.zip/System Mechanic 6.0u crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\System Mechanic 6.0u crack.zip/System Mechanic 6.0u crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\System Mechanic 7 Pro crack.zip/System Mechanic 7 Pro crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\System Mechanic 7 Pro crack.zip/System Mechanic 7 Pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Universal Shield crack.zip/Universal Shield crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Universal Shield crack.zip/Universal Shield crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Video Edit Magic v4.21 crack.zip/Video Edit Magic v4.21 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\Video Edit Magic v4.21 crack.zip/Video Edit Magic v4.21 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\VirusRescue crack.zip/VirusRescue crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\VirusRescue crack.zip/VirusRescue crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\WIN ZIP crack.zip/WIN ZIP crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\WIN ZIP crack.zip/WIN ZIP crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\acronis true image crack.zip/acronis true image crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\acronis true image crack.zip/acronis true image crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\adult crack.zip/adult crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\adult crack.zip/adult crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\agnitum crack.zip/agnitum crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\agnitum crack.zip/agnitum crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\anyplace control 3.2 crack.zip/anyplace control 3.2 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\anyplace control 3.2 crack.zip/anyplace control 3.2 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\autodesk inventor crack.zip/autodesk inventor crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\autodesk inventor crack.zip/autodesk inventor crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\avira crack.zip/avira crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\avira crack.zip/avira crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\betrapped crack.zip/betrapped crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\betrapped crack.zip/betrapped crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\black crack.zip/black crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\black crack.zip/black crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\boris crack.zip/boris crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\boris crack.zip/boris crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\canopus crack.zip/canopus crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\canopus crack.zip/canopus crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\cuteftp 8 crack.zip/cuteftp 8 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\cuteftp 8 crack.zip/cuteftp 8 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\digitando crack.zip/digitando crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\digitando crack.zip/digitando crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\diskkeeper crack.zip/diskkeeper crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\diskkeeper crack.zip/diskkeeper crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\divx pro 5.2.1 crack.zip/divx pro 5.2.1 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\divx pro 5.2.1 crack.zip/divx pro 5.2.1 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\dreamweaver 6 crack.zip/dreamweaver 6 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\dreamweaver 6 crack.zip/dreamweaver 6 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\dvd-cloner crack.zip/dvd-cloner crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\dvd-cloner crack.zip/dvd-cloner crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\eltima crack.zip/eltima crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\eltima crack.zip/eltima crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\far cry crack.zip/far cry crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\far cry crack.zip/far cry crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\garmin crack.zip/garmin crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\garmin crack.zip/garmin crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\holiday lights crack.zip/holiday lights crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\holiday lights crack.zip/holiday lights crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\ice clock 3d crack.zip/ice clock 3d crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\ice clock 3d crack.zip/ice clock 3d crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\icoo crack.zip/icoo crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\icoo crack.zip/icoo crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\illustrator crack.zip/illustrator crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\illustrator crack.zip/illustrator crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\internet download manager 5.05 crack.zip/internet download manager 5.05 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\internet download manager 5.05 crack.zip/internet download manager 5.05 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\intervideo windvr crack.zip/intervideo windvr crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\intervideo windvr crack.zip/intervideo windvr crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\karu crack.zip/karu crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\karu crack.zip/karu crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\keygen nero 7 crack.zip/keygen nero 7 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\keygen nero 7 crack.zip/keygen nero 7 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\luxor amun rising crack.zip/luxor amun rising crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\luxor amun rising crack.zip/luxor amun rising crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\magic dvd crack.zip/magic dvd crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\magic dvd crack.zip/magic dvd crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\magix music maker crack.zip/magix music maker crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\magix music maker crack.zip/magix music maker crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\mahjong quest crack.zip/mahjong quest crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\mahjong quest crack.zip/mahjong quest crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\mathcad crack.zip/mathcad crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\mathcad crack.zip/mathcad crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\media center crack.zip/media center crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\media center crack.zip/media center crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\memoriesontv crack.zip/memoriesontv crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\memoriesontv crack.zip/memoriesontv crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\milkshape crack.zip/milkshape crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\milkshape crack.zip/milkshape crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\ms office 2007 crack.zip/ms office 2007 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\ms office 2007 crack.zip/ms office 2007 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\mystery crack.zip/mystery crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\mystery crack.zip/mystery crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\n-track studio v5.0.2 crack.zip/n-track studio v5.0.2 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\n-track studio v5.0.2 crack.zip/n-track studio v5.0.2 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\nero 6 crack.zip/nero 6 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\nero 6 crack.zip/nero 6 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\nero 7 ultra crack.zip/nero 7 ultra crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\nero 7 ultra crack.zip/nero 7 ultra crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\office 2003 small business crack.zip/office 2003 small business crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\office 2003 small business crack.zip/office 2003 small business crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\operation flashpoint crack.zip/operation flashpoint crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\operation flashpoint crack.zip/operation flashpoint crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\partition manager crack.zip/partition manager crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\partition manager crack.zip/partition manager crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\pc cillin crack.zip/pc cillin crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\pc cillin crack.zip/pc cillin crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\pc-cillin 2007 crack.zip/pc-cillin 2007 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\pc-cillin 2007 crack.zip/pc-cillin 2007 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\power DVD 7.0 crack.zip/power DVD 7.0 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\power DVD 7.0 crack.zip/power DVD 7.0 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\privacy guardian crack.zip/privacy guardian crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\privacy guardian crack.zip/privacy guardian crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\pro crack.zip/pro crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\pro crack.zip/pro crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\real player crack.zip/real player crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\real player crack.zip/real player crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\red alert crack.zip/red alert crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\red alert crack.zip/red alert crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\route 66 crack.zip/route 66 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\route 66 crack.zip/route 66 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\setup factory crack.zip/setup factory crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\setup factory crack.zip/setup factory crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\simcity 3000 crack.zip/simcity 3000 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\simcity 3000 crack.zip/simcity 3000 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\sims 2 pets crack.zip/sims 2 pets crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\sims 2 pets crack.zip/sims 2 pets crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\spin it again crack.zip/spin it again crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\spin it again crack.zip/spin it again crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\super ad blocker crack.zip/super ad blocker crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\super ad blocker crack.zip/super ad blocker crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\swf decompiler crack.zip/swf decompiler crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\swf decompiler crack.zip/swf decompiler crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\switch crack.zip/switch crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\switch crack.zip/switch crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\switch v 1.11 crack.zip/switch v 1.11 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\switch v 1.11 crack.zip/switch v 1.11 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\system mechanic 7 professional crack.zip/system mechanic 7 professional crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\system mechanic 7 professional crack.zip/system mechanic 7 professional crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\toast crack.zip/toast crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\toast crack.zip/toast crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\tuneup utilities2006 crack.zip/tuneup utilities2006 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\tuneup utilities2006 crack.zip/tuneup utilities2006 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\uninstall tool crack.zip/uninstall tool crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\uninstall tool crack.zip/uninstall tool crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\viewletcam crack.zip/viewletcam crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\viewletcam crack.zip/viewletcam crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\winrar 361 crack.zip/winrar 361 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\winrar 361 crack.zip/winrar 361 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\wm recorder 11 crack.zip/wm recorder 11 crack.exe/td.exe -> Worm.Agent.v : Cleaned.
D:\My Shared Folder\wm recorder 11 crack.zip/wm recorder 11 crack.exe/zgo.exe -> Worm.Agent.v : Cleaned.
C:\Program Files\Ares\My Shared Folder\avg antivirus pro crack.zip/avg antivirus pro crack.exe/run.exe -> Worm.VB.njc : Cleaned.
C:\System Volume Information\_restore{95C8BA23-7DEC-40CD-A7C2-1ABB11423E47}\RP425\A0035971.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\007 spy software crack.zip/007 spy software crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\3ds max 7 crack.zip/3ds max 7 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\3gp converter crack.zip/3gp converter crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Abakus UIQ3 crack.zip/Abakus UIQ3 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Adobe Acrobat Pro crack.zip/Adobe Acrobat Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\CamStudio crack.zip/CamStudio crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Cash Cow crack.zip/Cash Cow crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\DVD Cloner IV crack.zip/DVD Cloner IV crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\EMPIRE EARTH 2 crack.zip/EMPIRE EARTH 2 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\EasyBoot crack.zip/EasyBoot crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\FLASHFXP crack.zip/FLASHFXP crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\FinePrint crack.zip/FinePrint crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Kaspersky Anti-Virus Personal Pro crack.zip/Kaspersky Anti-Virus Personal Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Macromedia Flash 8 crack.zip/Macromedia Flash 8 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Magic Photo Editor crack.zip/Magic Photo Editor crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\MagicLines crack.zip/MagicLines crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\MagicMatch crack.zip/MagicMatch crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Mpeg crack.zip/Mpeg crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Mystic Inn crack.zip/Mystic Inn crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Outpost Firewall Pro crack.zip/Outpost Firewall Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Perpetual Disco Screen Saver crack.zip/Perpetual Disco Screen Saver crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Pinball Arcade crack.zip/Pinball Arcade crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Pinnacle Studio Plus Titanium Edition v10.6 crack.zip/Pinnacle Studio Plus Titanium Edition v10.6 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Poker Superstars crack.zip/Poker Superstars crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Quick time crack.zip/Quick time crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\R-Studio crack.zip/R-Studio crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Simply Calenders crack.zip/Simply Calenders crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Sothink SWF Decompiler 3.4 build 60912 crack.zip/Sothink SWF Decompiler 3.4 build 60912 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\System Mechanic 6.0u crack.zip/System Mechanic 6.0u crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\System Mechanic 7 Pro crack.zip/System Mechanic 7 Pro crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Universal Shield crack.zip/Universal Shield crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\Video Edit Magic v4.21 crack.zip/Video Edit Magic v4.21 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\VirusRescue crack.zip/VirusRescue crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\WIN ZIP crack.zip/WIN ZIP crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\acronis true image crack.zip/acronis true image crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\adult crack.zip/adult crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\agnitum crack.zip/agnitum crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\anyplace control 3.2 crack.zip/anyplace control 3.2 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\autodesk inventor crack.zip/autodesk inventor crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\avira crack.zip/avira crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\betrapped crack.zip/betrapped crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\black crack.zip/black crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\boris crack.zip/boris crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\canopus crack.zip/canopus crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\cuteftp 8 crack.zip/cuteftp 8 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\digitando crack.zip/digitando crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\diskkeeper crack.zip/diskkeeper crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\divx pro 5.2.1 crack.zip/divx pro 5.2.1 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\dreamweaver 6 crack.zip/dreamweaver 6 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\dvd-cloner crack.zip/dvd-cloner crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\eltima crack.zip/eltima crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\far cry crack.zip/far cry crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\garmin crack.zip/garmin crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\holiday lights crack.zip/holiday lights crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\ice clock 3d crack.zip/ice clock 3d crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\icoo crack.zip/icoo crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\illustrator crack.zip/illustrator crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\internet download manager 5.05 crack.zip/internet download manager 5.05 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\intervideo windvr crack.zip/intervideo windvr crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\karu crack.zip/karu crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\keygen nero 7 crack.zip/keygen nero 7 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\luxor amun rising crack.zip/luxor amun rising crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\magic dvd crack.zip/magic dvd crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\magix music maker crack.zip/magix music maker crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\mahjong quest crack.zip/mahjong quest crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\mathcad crack.zip/mathcad crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\media center crack.zip/media center crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\memoriesontv crack.zip/memoriesontv crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\milkshape crack.zip/milkshape crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\ms office 2007 crack.zip/ms office 2007 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\mystery crack.zip/mystery crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\n-track studio v5.0.2 crack.zip/n-track studio v5.0.2 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\nero 6 crack.zip/nero 6 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\nero 7 ultra crack.zip/nero 7 ultra crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\office 2003 small business crack.zip/office 2003 small business crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\operation flashpoint crack.zip/operation flashpoint crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\partition manager crack.zip/partition manager crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\pc cillin crack.zip/pc cillin crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\pc-cillin 2007 crack.zip/pc-cillin 2007 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\power DVD 7.0 crack.zip/power DVD 7.0 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\privacy guardian crack.zip/privacy guardian crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\pro crack.zip/pro crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\real player crack.zip/real player crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\red alert crack.zip/red alert crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\route 66 crack.zip/route 66 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\setup factory crack.zip/setup factory crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\simcity 3000 crack.zip/simcity 3000 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\sims 2 pets crack.zip/sims 2 pets crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\spin it again crack.zip/spin it again crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\super ad blocker crack.zip/super ad blocker crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\swf decompiler crack.zip/swf decompiler crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\switch crack.zip/switch crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\switch v 1.11 crack.zip/switch v 1.11 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\system mechanic 7 professional crack.zip/system mechanic 7 professional crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\toast crack.zip/toast crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\tuneup utilities2006 crack.zip/tuneup utilities2006 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\uninstall tool crack.zip/uninstall tool crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\viewletcam crack.zip/viewletcam crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\winrar 361 crack.zip/winrar 361 crack.exe/run.exe -> Worm.VB.njc : Cleaned.
D:\My Shared Folder\wm recorder 11 crack.zip/wm recorder 11 crack.exe/run.exe -> Worm.VB.njc : Cleaned.

::Report end

HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 21:44:46, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\sammy\Desktop\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://tohellwiththeusa.spaces.live.com//P…ad/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal…eck_1_0_0_5.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal…0_15_Silent.cab
O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal…sal_1_0_0_3.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…603/mcfscan.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: PFW - C:\WINDOWS\SYSTEM32\UmxWnp.Dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

tim s

Post #14January 21, 2007, 2:34 AM UTC

Hi Bloop?!

Thanks for posting logs. Good job

Your version of Java is now outdated. Java vulnerabilites are commonly exploited by viruses. You need to update.

Download the latest version of Java Runtime Environment (JRE) 6

Scroll down to where it says "Java Runtime Environment (JRE) 6".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Click Start then Control Panel > then Add/Remove Programs and remove all older versions of Java.
Remove any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed to complete uninstall.
Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.

———————————————————–

Let me know how your computer is running now.

Bloop?!

Post #15January 21, 2007, 1:27 PM UTC

Thanks for all your help tim. Laptop is definitely a lot faster now, before it was nearly un-usable. But I still get Blue screen errors (usually at start-up) and windows explorer errors occasionally. Internet still quite slow for a 4mb connection but I suppose that can't be helped… Also I think I have way too much spyware and registry-cleaning software installed, I'd be grateful if you could point out the ones I dont need: Spyware programs: Spyware Doctor, Spybot S&D, Windows Defender, AVG Anti-Spyware, Ad-Aware Cleaning tools: Tune Up Utilities, CCleaner, CleanUp, Registry Cleaner, X-Cleaner I also still have Smitfraud, Killbox…I'm guessing I should keep these two in case I need to use these forums in the future? Once again thanks for the help and patience, it is really appreciated.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Laptop driving me mad

✨ Ask AI

Ask AI