What a difference a day makes!!
After downloading all of your previous suggested files to my usb flash drive, I was able to successfully copy them to a folder on my hard drive.
Then I activated the execution files , ran the scans, and saved the log reports, all in normal mode. The browser hijacker or cws variant did not interfear since there was no internet connection involved!!
After running cwshredder version 2.19 and all of your suggested process killers, I feel convinced that the variants have been removed and I have regained control of my computer!!!
I would also like to show you a list of my anti spyware software and see if there is some redundancy in software packages that are doing the same things and can be eliminated.
Is this the right forum for that?
Here are most of the log reports you requested:
Logfile of HijackThis v1.99.1
Scan saved at 7:49:02 PM, on 1/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\AOL\1137632844\ee\AOLSoftware.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5746\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137632844\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5746\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?f5d38ff0ac994bbdab39ab39de9b775c
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?f5d38ff0ac994bbdab39ab39de9b775c
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) -
https://www-secure.symantec.com/techsupp/as…rl/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} (Rite Aid One Hour Photo Online Control) -
https://photos.riteaid.com/control/RiteAidO…PhotoOnline.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3050E54C-D2C9-4C4F-BCDA-B04380738C35}: NameServer = 192.168.1.1,4.2.2.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
Ibprocman log
Process list saved on 5:05:40 PM, on 1/24/2007
Platform: WinNT 5.01.2600 SP2
[pid] [full path to filename] [file version] [company name]
1172 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
1496 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
1540 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation
1552 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
1724 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1820 C:\Program Files\Windows Defender\MsMpEng.exe 1.1.1593.0 Microsoft Corporation
1860 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
512 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 103.5.7.3 Symantec Corporation
540 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 103.5.7.3 Symantec Corporation
768 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2696 Microsoft Corporation
112 C:\WINDOWS\Explorer.EXE 6.0.2900.2180 Microsoft Corporation
624 C:\Program Files\Symantec AntiVirus\DefWatch.exe 10.0.2.2002 Symantec Corporation
832 C:\Program Files\ewido anti-spyware 4.0\guard.exe 4.0.0.172 Anti-Malware Development a.s.
872 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
884 C:\Program Files\Symantec AntiVirus\Rtvscan.exe 10.0.2.2002 Symantec Corporation
1256 C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe 6.5.737.0 Zone Labs, LLC
2456 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe 5.0.60.5 Sun Microsystems, Inc.
2500 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe 3.0.0.0 CyberLink Corp.
2572 C:\Program Files\Dell\Media Experience\PCMService.exe 1.0.0.1611 CyberLink Corp.
2580 C:\Program Files\Real\RealPlayer\RealPlay.exe 6.0.9.584 RealNetworks, Inc.
1108 C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe 1.0.0.1 TODO:
2660 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe 8.20.2.51 Musicmatch, Inc.
868 C:\WINDOWS\system32\dla\tfswctrl.exe 1.4.8.0 Sonic Solutions
1972 C:\Program Files\Analog Devices\Core\smax4pnp.exe 5.2.0.5 Analog Devices, Inc.
2744 C:\Program Files\Common Files\AOL\1137632844\ee\AOLSoftware.exe 1.4.16.3 America Online, Inc.
2876 C:\WINDOWS\system32\hkcmd.exe 3.0.0.4396 Intel Corporation
3068 C:\WINDOWS\system32\igfxpers.exe 3.0.0.4396 Intel Corporation
3120 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe 2.133.0.0 HP
3156 C:\Program Files\Common Files\Symantec Shared\ccApp.exe 103.5.7.3 Symantec Corporation
3228 C:\PROGRA~1\SYMANT~1\VPTray.exe 10.0.2.2002 Symantec Corporation
3404 C:\Program Files\iTunes\iTunesHelper.exe 7.0.2.16 Apple Computer, Inc.
3456 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe 3.0.0.-15721 Adobe Systems Incorporated
3704 C:\Program Files\QuickTime\qttask.exe 7.1.5.58 Apple Computer, Inc.
3816 C:\Program Files\Windows Defender\MSASCui.exe 1.1.1593.0 Microsoft Corporation
3880 C:\Program Files\Dell Support\DSAgnt.exe 1.1.0.73 Gteko Ltd.
3904 C:\Program Files\iPod\bin\iPodService.exe 7.0.2.16 Apple Computer, Inc.
3992 C:\Program Files\MSN Messenger\MsnMsgr.Exe 8.0.812.0 Microsoft Corporation
4020 C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe 2.11.1.5 Plaxo, Inc.
4088 C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5746\GoogleToolbarNotifier.exe 1.2.908.5746 Google Inc.
4080 C:\WINDOWS\system32\ctfmon.exe 5.1.2600.2180 Microsoft Corporation
948 C:\Program Files\Digital Line Detect\DLG.exe 1.0.0.1
2092 C:\Program Files\InterMute\SpySubtract\SpySub.exe 3.0.0.29 InterMute, Inc.
2220 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
3576 C:\DOCUME~1\Grays\LOCALS~1\Temp\Temporary Directory 1 for ibprocman.zip\IBProcMan.exe 1.4.0.0 Soeperman Enterprises Ltd.
2344 C:\WINDOWS\system32\cmd.exe 5.1.2600.2180 Microsoft Corporation
ComboFix log
"Grays" - 07-01-24 16:46:39 Service Pack 2
ComboFix 07-01-23.2 - Running from: "C:\Program Files\ComboFix"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\oozrkie\winlogon.ini
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\oozrkie\winlogon.exe
((((((((((((((((((((((((((((((( Files Created from 2006-12-24 to 2007-01-24 ))))))))))))))))))))))))))))))))))
2007-01-24 16:48 d——– C:\WINDOWS\erdnt
2007-01-24 16:44 d——– C:\Program Files\ComboFix
2007-01-24 16:39 d——– C:\Program Files\CleanX-II
2007-01-24 16:22 d——– C:\Program Files\CWShredder ver2.19
2007-01-22 22:48 d——– C:\Program Files\InterMute
2007-01-17 16:27 d——– C:\Program Files\QuickTime
2007-01-09 15:04 d——– C:\WINDOWS\ie7updates
2006-12-30 21:53 0 -rahs—- C:\MSDOS.SYS
2006-12-30 21:53 0 -rahs—- C:\IO.SYS
2006-12-30 21:40 d–hs—- C:\WINDOWS\SYSTEM32\oozrkie
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-01-24 16:51 ——– d——– C:\Program Files\symantec antivirus
2007-01-24 16:07 ——– d——– C:\Program Files\plaxo
2007-01-23 17:06 ——– d——– C:\Program Files\hijackthis
2007-01-22 17:16 ——– d——– C:\Program Files\ewido anti-spyware 4.0
2007-01-19 17:07 28667 –a—— C:\Program Files\ibprocman.zip
2007-01-18 16:53 ——– d——– C:\Program Files\windows defender
2007-01-17 16:48 ——– d——– C:\Program Files\morpheusbar
2007-01-17 16:26 ——– d——– C:\Program Files\itunes
2007-01-16 17:27 ——– d——– C:\Program Files\spywareguard
2007-01-15 19:03 900 –ahs—- C:\WINDOWS\SYSTEM32\kgygaavl.sys
2007-01-07 22:04 ——– d——– C:\Documents and Settings\Grays\Application Data\adobeum
2007-01-03 22:10 ——– d——– C:\Documents and Settings\Grays\Application Data\apple computer
2006-12-31 18:19 ——– d—s—- C:\Documents and Settings\Grays\Application Data\microsoft
2006-12-07 17:02 2174976 –a—— C:\WINDOWS\SYSTEM32\wmvcore.dll
2006-11-28 21:38 ——– d——– C:\Documents and Settings\Grays\Application Data\adobeaum
2006-11-28 21:38 ——– d——– C:\Documents and Settings\Grays\Application Data\adobe
2006-11-28 21:37 1565 –a—— C:\Documents and Settings\Grays\Application Data\adobedlm.log
2006-11-28 21:37 0 –a—— C:\Documents and Settings\Grays\Application Data\dm.ini
2006-11-28 21:35 ——– d——– C:\Program Files\yahoo!
2006-11-08 00:06 679424 –a—— C:\WINDOWS\SYSTEM32\inetcomm.dll
2006-11-07 21:03 6049280 ——— C:\WINDOWS\SYSTEM32\ieframe.dll
2006-11-07 21:03 50688 ——— C:\WINDOWS\SYSTEM32\msfeedsbs.dll
2006-11-07 21:03 458752 ——— C:\WINDOWS\SYSTEM32\msfeeds.dll
2006-11-07 21:03 413696 –a—— C:\WINDOWS\SYSTEM32\vbscript.dll
2006-11-07 21:03 231424 –a—— C:\WINDOWS\SYSTEM32\webcheck.dll
2006-11-07 21:03 180736 ——— C:\WINDOWS\SYSTEM32\ieui.dll
2006-11-07 21:03 156160 –a—— C:\WINDOWS\SYSTEM32\msls31.dll
2006-11-07 03:27 382976 –a—— C:\WINDOWS\SYSTEM32\iedkcs32.dll
2006-11-07 03:27 229376 –a—— C:\WINDOWS\SYSTEM32\ieaksie.dll
2006-11-07 03:26 71680 –a—— C:\WINDOWS\SYSTEM32\admparse.dll
2006-11-07 03:26 55296 –a—— C:\WINDOWS\SYSTEM32\iesetup.dll
2006-11-07 03:26 54784 –a—— C:\WINDOWS\SYSTEM32\ie4uinit.exe
2006-11-07 03:26 43008 –a—— C:\WINDOWS\SYSTEM32\iernonce.dll
2006-11-07 03:26 152064 –a—— C:\WINDOWS\SYSTEM32\ieakeng.dll
2006-11-07 03:26 13312 –a—— C:\WINDOWS\SYSTEM32\ieudinit.exe
2006-11-07 03:26 123904 –a—— C:\WINDOWS\SYSTEM32\advpack.dll
2006-11-07 03:25 161792 –a—— C:\WINDOWS\SYSTEM32\ieakui.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"PlaxoUpdate"="C:\\Program Files\\Plaxo\\2.11.1.5\\PlaxoHelper.exe -a"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5746\\GoogleToolbarNotifier.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe"
"MMTray"="C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mm_tray.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"SoundMAXPnP"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1137632844\\ee\\AOLSoftware.exe"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb06.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="SpySubtract Shell Extension"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ
http://www.google.com/intl/en/images/logo.gif
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source REG_SZ http://www.processlibrary.com/graphics/title.gif
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
C:\WINDOWS\tasks\CHKDSK.job
C:\WINDOWS\tasks\CLEANMGR.job
C:\WINDOWS\tasks\DFRG.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
Completion time: 07-01-24 16:51:22
I didn't run the GMER.zip file so as to avoid crashing my computer.
Thanks soo much for being there and giving me the confidence to keep persevering with this problem.
Whoever writes these viruses are the real terrorists and they should be put in Gitanamo Bay Prison.
