What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan Rat

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hello to all, i figured it was time for the masters of malware & spyware to look over my hjt log. . i downloaded zone alarm pro, and it came up with a trojan and a rat. also there seems to be alot of processes (32) running at start up, most i do not use (messenger, scansoft, ipod, itunes, etc.)some i have no clue what they are, if i need too use a program i will retreive it. . i can not make any sense out of this? brewheadz



Logfile of HijackThis v1.99.1
Scan saved at 2:34:30 PM, on 4/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ResChanger 2005\ResChanger2005.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Verizon Online\Verizon Online Support Center\bin\mpbtn.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.a…mp;bm=ho_search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….&bm=ms_home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 206.46.230.73 cgi.verizon.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [TweakDUN] C:\Program Files\TweakDUN\tweakdun.exe splash
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ResChanger 2005] C:\Program Files\ResChanger 2005\ResChanger2005.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\Verizon Online Support Center\bin\matcli.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1172217096453
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #3
Hi brewheadz,

Great that Zone Alarm cleaned some bad stuff from your computer, but can you tell me any more about it found - like the name of the infection or the associated filenames?

I'm asking because if it really was a RAT, that probably means it was a Remote Access Trojan, which is a very bad type of infection. This is my standard warning for victims of this type of malware:

Your computer is infected by a backdoor trojan. This program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use a another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

So please check the Zone Alarm log for the details, you need to be aware of the implications if you are affected, but I don't want to worry you unnecessarily.

Your log currently looks OK so maybe Zone Alarm took care of it, we'll have a close look to make sure.
I'll give you some help with your startup programs after we've checked for malware.

Please do an online scan with Kaspersky:

Open Kaspersky Online Scanner in Internet Explorer

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT and then Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • The program will start to scan your system.
  • Once the scan is complete, click on the Save as Text button and save the file to your desktop
Please download F-Secure Blacklight (blbeta.exe):
https://europe.f-secure.com/blacklight/try.shtml
  • Click I ACCEPT and download the graphical user interface version to your Desktop
  • Double click the file to run it, choose I accept the agreement then press Scan
  • It will create the "fsbl-xxxxxxx.log" on your desktop.
  • The log will have a list of all items found.
  • Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
  • Exit Blacklight and post the contents of the log in your next reply.
Once complete, please post the Kaspersky log and the Blacklight log along with a new HijackThis log.
Post #4
hello silver, i want to thank you for your time and skill. you asked about zone alarm pro, but i can't say, because it dumped it automatically. i browsed your fourm and noticed i had two scanners running, so i removed z/a-pro, for the free version. i have had a few problems with the computer since updating latest security at microsoft.i had to go to restore to get up and running.blacklight did not show anything so no log, but here is the log from kaspersky. ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Tuesday, April 10, 2007 1:55:42 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 10/04/2007 Kaspersky Anti-Virus database records: 293465 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 38308 Number of viruses found: 1 Number of infected objects: 4 / 0 Number of suspicious objects: 0 Duration of the scan process: 00:17:13 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Wildbill\Application Data\MSN6\UserData\{19582E64-5722-01C7-0200-0000CEF45B4E}\favthumb.dbx Object is locked skipped C:\Documents and Settings\Wildbill\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Application Data\Microsoft\MSN\db30\wildbils-msn-com.c8/[From [removed]][Date Sun, 10 Apr 2005 01:46:39 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped C:\Documents and Settings\Wildbill\Local Settings\Application Data\Microsoft\MSN\db30\wildbils-msn-com.c8 Mail: infected - 1 skipped C:\Documents and Settings\Wildbill\Local Settings\Application Data\Microsoft\MSN\db30\wildbils-msn-com.ca/[From [removed]][Date Mon, 11 Apr 2005 08:47:20 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ib skipped C:\Documents and Settings\Wildbill\Local Settings\Application Data\Microsoft\MSN\db30\wildbils-msn-com.ca Mail: infected - 1 skipped C:\Documents and Settings\Wildbill\Local Settings\Application Data\Microsoft\MSN\db30\wildbils-msn-com.sdf Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\History\History.IE5\MSHist012007041020070411\index.dat Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Temp\fdr2964.fdr Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Temp\~DF8F74.tmp Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Temp\~DF9074.tmp Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Temp\~DFCAA5.tmp Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Wildbill\Local Settings\Temporary Internet Files\PhishingFilter\10278502-67BC-43EF-B0AA-BBF67795D5B0.dat Object is locked skipped C:\Documents and Settings\Wildbill\ntuser.dat Object is locked skipped C:\Documents and Settings\Wildbill\ntuser.dat.LOG Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\calendar.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\market.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\market32.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\miadv.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\mibas.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\micd.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\printing.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\qos.mar Object is locked skipped C:\Program Files\MSN\MSNCoreFiles\themedef32.mar Object is locked skipped C:\Program Files\MSN\MsnInstaller\install.mar Object is locked skipped C:\Program Files\MSN\MsnInstaller\Resources\MSNClientBrand\en\us\vz02\9.50.429.0\brand.mar Object is locked skipped C:\Program Files\Verizon\SmartBridge\AlertFilter.log Object is locked skipped C:\Program Files\Verizon\SmartBridge\log\httpclient.log Object is locked skipped C:\Program Files\Verizon\SmartBridge\SmartBridge.log Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{242C7838-F0C8-4491-8E4B-2BFD3892653B}\RP58\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\BILL.ldb Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\ZLT06c39.TMP Object is locked skipped C:\WINDOWS\Temp\ZLT06c3f.TMP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.
Post #7
this is current Logfile of HijackThis v1.99.1
Scan saved at 8:55:55 AM, on 4/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.a…mp;bm=ho_search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….&bm=ms_home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 206.46.230.73 cgi.verizon.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [TweakDUN] C:\Program Files\TweakDUN\tweakdun.exe splash
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ResChanger 2005] C:\Program Files\ResChanger 2005\ResChanger2005.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\Verizon Online Support Center\bin\matcli.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1172217096453
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #8
Hi brewheadz,

I apologize for the delay in responding to you, if anything has changed in the meantime which you think is relevant please let me know.

Regarding the possible RAT, if you don't have the relevant information about the malware which was removed by Ad-Aware, then I recommend you consider the advice I posted previously and take appropriate steps.

The item that Kaspersky found was an email which is somewhere in your MSN Mail folders, the date is probably just the date on the email so you can ignore that.

Please open MSN Mail and empty trash and bulk/spam folders, taking care not to open any emails from Ebay.
Please search your other folders for a message from EBay / Ebay Security Center / [removed] and delete it.
Please take care not to open it.

If you can't find it or have any difficulty with this, please let me know.

Your log now shows restrictions have been imposed on Internet Explorer's control panel settings. This is often done by protective software to help protect against unauthorized changes, but it can also be done by malware. I expect it has been done by Spyware Guard which you have installed.

If they have been put in place by protective software then I recommend you leave them alone, but if you know no reason why they should be there want want them removed, then you may do so with HijackThis:
Open HijackThis, choose Do a system scan only and place a check-mark next to the following line:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Then close all open windows apart from HijackThis, press Fix checked, OK the prompt, then close HijackThis.

You may have had some very serious malware on your computer so we'll do another couple of scans to see if there's anything further there.

Please download F-Secure Blacklight (blbeta.exe):
https://europe.f-secure.com/blacklight/try.shtml
  • Click I ACCEPT and download the graphical user interface version to your Desktop
  • Double click the file to run it, choose I accept the agreement then press Scan
  • It will create the "fsbl-xxxxxxx.log" on your desktop.
  • The log will have a list of all items found.
  • Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
  • Exit Blacklight and post the contents of the log in your next reply.
Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
  • Close ALL OTHER PROGRAMS.
  • Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
  • Now click the Run Scan button on the toolbar.
  • The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Post the log file in your next response.
It can be quite long, so please check once you have posted, and if the last line is not < End of Report > then the log is too big to fit into a single post and you will need to split it into multiple posts.

Once complete, please post the Blacklight log, the WinPFind3u log and a new HijackThis log. Also tell me how you got on with your email.
Post #9
hello silver, thought you were lost in the internet blackhole, :scratch: just kidding. zone alarm pro discovered the trojan but could do nothing. as i browsed hjt i noticed i was running two scanners so i dismissed zone alarm. it auto dumped the info you asked for anyways. you sent me to kaspersky which also detected the trojan, as you seen, i ended up getting kaspersky internet suite and running fireox. i ran it and found nothing. i tweaked the settings and got it to pop the trojan, but it could not disinfect it and they had no script to write it, but could delete it, which i did, since this scanner would not let me do anything else, locking down the machine. i do not know what that did to registry :scratch: . i went into the mail and discovered the two emails from ebay at those two paticular dates and times and forward them to microsoft as malicious. i am a little uneasy on the internet after this. i think i covered the questions you asked. blacklite showed nothing, so there is no log. also, thanks again for your time.
here are the logs WinPFind3 logfile created on: 4/18/2007 6:26:03 PM
WinPFind3U by OldTimer - Version 1.0.34 Folder = C:\Documents and Settings\Wildbill\My Documents\My Downloads\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)

1023.48 Mb Total Physical Memory | 685.89 Mb Available Physical Memory | 67.02% Memory free
2.40 Gb Paging File | 2.17 Gb Available in Paging File | 90.39% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 69.08 Gb Free Space | 92.71% Space Free
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: BILL
Current User Name: Wildbill
Logged in as Administrator.
Current Boot Mode: Normal


[Processes - Non-Microsoft Only]
avp.exe -> %ProgramFiles%\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -> Kaspersky Lab [Ver = 6.0.2.621 | Size = 200768 bytes | Modified Date = 3/9/2007 7:50:58 PM | Attr = ]
avp.exe -> %ProgramFiles%\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -> Kaspersky Lab [Ver = 6.0.2.621 | Size = 200768 bytes | Modified Date = 3/9/2007 7:50:58 PM | Attr = ]
motivesb.exe -> %ProgramFiles%\Verizon\SmartBridge\MotiveSB.exe -> Motive Communications, Inc. [Ver = 5.8.22.asst_classic.smartbridge.20060421_153000 | Size = 438359 bytes | Modified Date = 6/23/2006 12:33:02 PM | Attr = ]
opwarese4.exe -> %ProgramFiles%\ScanSoft\OmniPageSE4.0\OpwareSE4.exe -> ScanSoft, Inc. [Ver = 15.0 | Size = 75304 bytes | Modified Date = 10/11/2006 12:45:12 PM | Attr = ]
sgbhp.exe -> %ProgramFiles%\SpywareGuard\sgbhp.exe -> [Ver = 2.02.0001 | Size = 233472 bytes | Modified Date = 8/29/2003 11:14:58 AM | Attr = ]
sgmain.exe -> %ProgramFiles%\SpywareGuard\sgmain.exe -> [Ver = 2.02.0001 | Size = 360448 bytes | Modified Date = 8/29/2003 7:05:36 PM | Attr = ]
winpatrol.exe -> %ProgramFiles%\BillP Studios\WinPatrol\winpatrol.exe -> BillP Studios [Ver = 11, 2, 2007, 1 | Size = 271936 bytes | Modified Date = 4/3/2007 1:54:38 PM | Attr = ]
winpfind3u.exe -> %UserDocuments%\My Downloads\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.34.0 | Size = 318976 bytes | Modified Date = 4/10/2007 10:00:18 PM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(a2free) a-squared Free Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\a-squared Free\a2service.exe -> Emsi Software GmbH [Ver = 2.5.0.116 | Size = 424520 bytes | Modified Date = 4/11/2007 11:14:08 PM | Attr = ]
(AVP) Kaspersky Internet Security 6.0 [Win32_Own | Auto | Running] -> %ProgramFiles%\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -> Kaspersky Lab [Ver = 6.0.2.621 | Size = 200768 bytes | Modified Date = 3/9/2007 7:50:58 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 5:00:00 AM | Attr = ]
(iPod Service) iPod Service [Win32_Own | Disabled | Stopped] -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 500800 bytes | Modified Date = 3/14/2007 7:05:42 PM | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | On_Demand | Stopped] -> %System32%\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9147 | Size = 155715 bytes | Modified Date = 8/11/2006 10:42:50 PM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Alcmtr -> %SystemRoot%\Alcmtr.exe -> Realtek Semiconductor Corp. [Ver = 1.6.0.2 | Size = 69632 bytes | Modified Date = 5/3/2005 3:43:28 AM | Attr = R ]
AVP -> %ProgramFiles%\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -> Kaspersky Lab [Ver = 6.0.2.621 | Size = 200768 bytes | Modified Date = 3/9/2007 7:50:58 PM | Attr = ]
GBB36X Configure -> %System32%\JMRaidTool.exe -> Gigabyte Technology Corp. [Ver = 1.13.05g | Size = 356352 bytes | Modified Date = 7/12/2006 2:58:58 AM | Attr = R ]
iTunesHelper -> %ProgramFiles%\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 257088 bytes | Modified Date = 3/14/2007 7:05:48 PM | Attr = ]
Motive SmartBridge -> %ProgramFiles%\Verizon\SmartBridge\MotiveSB.exe -> Motive Communications, Inc. [Ver = 5.8.22.asst_classic.smartbridge.20060421_153000 | Size = 438359 bytes | Modified Date = 6/23/2006 12:33:02 PM | Attr = ]
NeroFilterCheck -> %CommonProgramFiles%\Ahead\Lib\NeroCheck.exe -> Nero AG [Ver = 1, 0, 0, 5 | Size = 155648 bytes | Modified Date = 1/12/2006 5:40:44 PM | Attr = ]
NvCplDaemon -> %System32%\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.9147 | Size = 7630848 bytes | Modified Date = 8/11/2006 10:43:02 PM | Attr = ]
NvMediaCenter -> %System32%\nvmctray.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit] -> NVIDIA Corporation [Ver = 6.14.10.9147 | Size = 86016 bytes | Modified Date = 8/11/2006 10:43:04 PM | Attr = ]
NWEReboot -> -> File not found
nwiz -> %System32%\nwiz.exe -> [Ver = | Size = 1519616 bytes | Modified Date = 8/11/2006 10:43:00 PM | Attr = ]
OpwareSE4 -> %ProgramFiles%\ScanSoft\OmniPageSE4.0\OpwareSE4.exe -> ScanSoft, Inc. [Ver = 15.0 | Size = 75304 bytes | Modified Date = 10/11/2006 12:45:12 PM | Attr = ]
QuickTime Task -> %ProgramFiles%\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.5 | Size = 282624 bytes | Modified Date = 2/16/2007 10:54:04 AM | Attr = ]
SkyTel -> %SystemRoot%\SkyTel.exe -> Realtek Semiconductor Corp. [Ver = 1.0.0.0 | Size = 2879488 bytes | Modified Date = 5/16/2006 3:04:26 AM | Attr = R ]
SSBkgdUpdate -> %CommonProgramFiles%\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -> Nuance Communications, Inc. [Ver = 5,0,0,0 | Size = 185896 bytes | Modified Date = 9/28/2006 1:16:20 PM | Attr = ]
TweakDUN -> %ProgramFiles%\TweakDUN\tweakdun.exe -> Patterson Design Systems [Ver = 3.00.0148 | Size = 720896 bytes | Modified Date = 9/19/2001 11:29:22 PM | Attr = ]
WinPatrol -> %ProgramFiles%\BillP Studios\WinPatrol\winpatrol.exe -> BillP Studios [Ver = 11, 2, 2007, 1 | Size = 271936 bytes | Modified Date = 4/3/2007 1:54:38 PM | Attr = ]
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ResChanger 2005 -> %ProgramFiles%\ResChanger 2005\ResChanger2005.exe -> EVGA CORP [Ver = 1.0.0.0 | Size = 885248 bytes | Modified Date = 5/26/2005 5:30:02 PM | Attr = ]
< Common Startup > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
%AllUsersStartup%\Verizon Online Support Center.lnk -> %ProgramFiles%\Verizon Online\Verizon Online Support Center\bin\matcli.exe -> Motive Communications, Inc. [Ver = 5.0.2.4.asst_classic.asst_matcli.20020806_105000 | Size = 204800 bytes | Modified Date = 8/6/2002 12:07:38 PM | Attr = ]
< User Startup > -> C:\Documents and Settings\Wildbill\Start Menu\Programs\Startup
%UserStartup%\MRU-Blaster Scheduler.lnk -> %ProgramFiles%\MRU-Blaster\scheduler.exe -> [Ver = 1.01.0001 | Size = 118784 bytes | Modified Date = 7/19/2003 4:48:42 PM | Attr = ]
%UserStartup%\MRU-Blaster Silent Clean.lnk -> %ProgramFiles%\MRU-Blaster\mrublaster.exe -> [Ver = 1.05.0009 | Size = 1216512 bytes | Modified Date = 3/28/2004 3:07:48 PM | Attr = ]
%UserStartup%\SpywareGuard.lnk -> %ProgramFiles%\SpywareGuard\sgmain.exe -> [Ver = 2.02.0001 | Size = 360448 bytes | Modified Date = 8/29/2003 7:05:36 PM | Attr = ]
< AppInit_DLLs [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls ->
C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll -> %ProgramFiles%\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll -> Kaspersky Lab [Ver = 6.0.2.621 | Size = 86080 bytes | Modified Date = 3/9/2007 7:49:30 PM | Attr = ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{81559C35-8464-49F7-BB0E-07A383BEF910} [HKLM] -> %ProgramFiles%\SpywareGuard\spywareguard.dll [SpywareGuard] -> [Ver = 2.02 | Size = 126976 bytes | Modified Date = 8/2/2003 11:20:58 PM | Attr = R ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
klogon -> %System32%\klogon.dll -> Kaspersky Lab [Ver = 6.0.2.621 | Size = 200768 bytes | Modified Date = 3/9/2007 7:52:52 PM | Attr = ]
< HOSTS File > (567707 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Start Page -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Bar -> http://cgi.verizon.net/bookmarks/bmredir.a…mp;bm=ho_search ->
HKCU: Search Page -> http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch ->
HKCU: Start Page -> http://wapp.verizon.net/bookmarks/bmredir….&bm=ms_home ->
HKCU: SearchAssistant -> http://ie.search.msn.com/en-us/srchasst/srchasst.htm ->
HKCU: ProxyEnable -> 0 ->
HKCU: ProxyOverride -> 127.0.0.1 ->
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
msn.com [ - ] -> ->
< Trusted Sites > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
turbotax.com [https] -> ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %ProgramFiles%\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] -> Adobe Systems Incorporated [Ver = 7.0.0.2004121400 | Size = 63136 bytes | Modified Date = 12/14/2004 1:56:50 AM | Attr = ]
{4A368E80-174F-4872-96B5-0B27DDD11DB2} [HKLM] -> %ProgramFiles%\SpywareGuard\dlprotect.dll [SpywareGuardDLBLOCK.CBrowserHelper] -> [Ver = 2.02 | Size = 192512 bytes | Modified Date = 8/2/2003 11:24:02 PM | Attr = R ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 2:04:00 AM | Attr = ]
{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} [HKLM] -> %ProgramFiles%\Canon\Easy-WebPrint\EWPBrowseLoader.dll [EWPBrowseObject Class] -> [Ver = 2, 6, 4, 1 | Size = 34304 bytes | Modified Date = 6/9/2006 2:37:54 PM | Attr = ]
< Internet Explorer ToolBars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} [HKLM] -> %ProgramFiles%\Canon\Easy-WebPrint\Toolband.dll [Easy-WebPrint] -> [Ver = 2, 6, 4, 1 | Size = 552960 bytes | Modified Date = 6/9/2006 2:39:38 PM | Attr = ]
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} -> Reg Data - Value does not exist [ButtonText: Web Anti-Virus statistics] -> File not found
< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\
Add to Anti-Banner -> %ProgramFiles%\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm -> [Ver = | Size = 1317 bytes | Modified Date = 3/9/2007 7:31:14 PM | Attr = ]
Easy-WebPrint Add To Print List -> %ProgramFiles%\Canon\Easy-WebPrint\Toolband.dll\RC_AddToList.htm -> File not found
Easy-WebPrint High Speed Print -> %ProgramFiles%\Canon\Easy-WebPrint\Toolband.dll\RC_HSPrint.htm -> File not found
Easy-WebPrint Preview -> %ProgramFiles%\Canon\Easy-WebPrint\Toolband.dll\RC_Preview.htm -> File not found
Easy-WebPrint Print -> %ProgramFiles%\Canon\Easy-WebPrint\Toolband.dll\RC_Print.htm -> File not found
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{ED94AF0C-7C1B-457F-A32A-86CC7F4EC090} -> (Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
{01113300-3E00-11D2-8470-0060089874ED} -> - CodeBase = https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab ->
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -> QuickTime Object - CodeBase = http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab ->
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -> CKAVWebScan Object - CodeBase = http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab ->
{6414512B-B978-451D-A0D8-FCFDF33E833C} -> WUWebControl Class - CodeBase = http://update.microsoft.com/windowsupdate/…b?1172217096453 ->
Microsoft XML Parser for Java -> - CodeBase = file://C:\WINDOWS\Java\classes\xmldso.cab ->


[Files/Folders - Created Within 30 days]
a8548678b72eb65056 -> %SystemDrive%\a8548678b72eb65056 -> [Folder | Created Date = 4/3/2007 10:46:08 PM | Attr = ]
boot.ini.comodofirewall -> %SystemDrive%\boot.ini.comodofirewall -> [Ver = | Size = 211 bytes | Created Date = 4/13/2007 10:42:42 AM | Attr = ]
Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Created Date = 4/3/2007 11:08:55 PM | Attr = ]
ff2f5fcb2bd6e07aedfa4796ad15407f -> %SystemDrive%\ff2f5fcb2bd6e07aedfa4796ad15407f -> [Folder | Created Date = 4/9/2007 5:17:08 PM | Attr = ]
hjt -> %SystemDrive%\hjt -> [Folder | Created Date = 4/9/2007 10:00:27 PM | Attr = ]
kav -> %SystemDrive%\kav -> [Folder | Created Date = 4/14/2007 3:46:02 PM | Attr = ]
VundoFix Backups -> %SystemDrive%\VundoFix Backups -> [Folder | Created Date = 4/13/2007 1:52:26 PM | Attr = ]
$NtUninstallKB925902$ -> %SystemRoot%\$NtUninstallKB925902$ -> [Folder | Created Date = 4/3/2007 10:46:20 PM | Attr = H ]
Downloaded Installations -> %SystemRoot%\Downloaded Installations -> [Folder | Created Date = 4/13/2007 6:40:21 AM | Attr = ]
Instlog.lyt -> %SystemRoot%\Instlog.lyt -> [Ver = | Size = 5438 bytes | Created Date = 4/2/2007 12:08:08 PM | Attr = ]
MAXLINK.INI -> %SystemRoot%\MAXLINK.INI -> [Ver = | Size = 416 bytes | Created Date = 3/22/2007 11:18:42 AM | Attr = ]
nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 0 bytes | Created Date = 4/6/2007 6:08:59 PM | Attr = ]
setup.iss -> %SystemRoot%\setup.iss -> [Ver = | Size = 165 bytes | Created Date = 3/22/2007 11:20:14 AM | Attr = ]
CanonIJ Uninstaller Information -> %System32%\CanonIJ Uninstaller Information -> [Folder | Created Date = 3/22/2007 11:15:58 AM | Attr = H ]
CNCC530.DLL -> %System32%\CNCC530.DLL -> CANON INC. [Ver = 2, 0, 0, 0 | Size = 194560 bytes | Created Date = 3/22/2007 11:15:55 AM | Attr = ]
CNCF2La.DLL -> %System32%\CNCF2La.DLL -> Canon Inc. [Ver = 7.1.0.7 | Size = 130048 bytes | Created Date = 3/22/2007 11:15:52 AM | Attr = ]
CNCFLaJP.DLL -> %System32%\CNCFLaJP.DLL -> Canon Inc. [Ver = 7.1.0.7 | Size = 2560 bytes | Created Date = 3/22/2007 11:15:52 AM | Attr = ]
CNCFLaUS.DLL -> %System32%\CNCFLaUS.DLL -> Canon Inc. [Ver = 7.1.0.7 | Size = 3072 bytes | Created Date = 3/22/2007 11:15:52 AM | Attr = ]
CNCFMSa.EXE -> %System32%\CNCFMSa.EXE -> Canon Inc. [Ver = 7.1.0.7 | Size = 49152 bytes | Created Date = 3/22/2007 11:15:52 AM | Attr = ]
CNCI530.DLL -> %System32%\CNCI530.DLL -> CANON INC. [Ver = 2, 0, 0, 0 | Size = 37888 bytes | Created Date = 3/22/2007 11:15:55 AM | Attr = ]
cncisco.dll -> %System32%\cncisco.dll -> Canon Inc. [Ver = 1.4 | Size = 106496 bytes | Created Date = 3/22/2007 11:15:56 AM | Attr = ]
CNCL530.DLL -> %System32%\CNCL530.DLL -> Canon Inc. [Ver = 1.00 | Size = 143360 bytes | Created Date = 3/22/2007 11:15:55 AM | Attr = ]
CNMLM7R.DLL -> %System32%\CNMLM7R.DLL -> CANON INC. [Ver = 2.00.4.13 | Size = 197632 bytes | Created Date = 3/22/2007 11:15:59 AM | Attr = ]
Color -> %System32%\Color -> [Folder | Created Date = 3/22/2007 11:19:41 AM | Attr = ]
InetClnt.dll -> %System32%\InetClnt.dll -> Intuit Inc. [Ver = 3, 1, 0, 11 | Size = 1716297 bytes | Created Date = 4/2/2007 12:10:10 PM | Attr = ]
IPPCPUID.DLL -> %System32%\IPPCPUID.DLL -> [Ver = | Size = 40960 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ippcv11.dll -> %System32%\ippcv11.dll -> Intel Corporation. [Ver = 1,1,4,21 | Size = 94208 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ippcva611.dll -> %System32%\ippcva611.dll -> Intel Corporation. [Ver = 1,1,4,21 | Size = 462848 bytes | Created Date = 3/22/2007 11:20:25 AM | Attr = ]
ippi11.dll -> %System32%\ippi11.dll -> Intel Corporation. [Ver = 1,1,11,28 | Size = 225280 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ippia611.dll -> %System32%\ippia611.dll -> Intel Corporation. [Ver = 1,1,11,28 | Size = 2428928 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ippj11.dll -> %System32%\ippj11.dll -> Intel Corporation. [Ver = 1,1,10,10 | Size = 65536 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ippja611.dll -> %System32%\ippja611.dll -> Intel Corporation. [Ver = 1,1,10,10 | Size = 151552 bytes | Created Date = 3/22/2007 11:20:25 AM | Attr = ]
ipps11.dll -> %System32%\ipps11.dll -> Intel Corporation. [Ver = 1,1,11,31 | Size = 176128 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ippsa611.dll -> %System32%\ippsa611.dll -> Intel Corporation. [Ver = 1,1,11,31 | Size = 1359872 bytes | Created Date = 3/22/2007 11:20:25 AM | Attr = ]
ippsr11.dll -> %System32%\ippsr11.dll -> Intel Corporation. [Ver = 1,1,38,0 | Size = 77824 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ippsra611.dll -> %System32%\ippsra611.dll -> Intel Corporation. [Ver = 1,1,38,0 | Size = 184320 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
Kaspersky Lab -> %System32%\Kaspersky Lab -> [Folder | Created Date = 4/13/2007 3:56:25 PM | Attr = ]
pmsbfn32.dll -> %System32%\pmsbfn32.dll -> [Ver = 1, 0, 0, 1 | Size = 11776 bytes | Created Date = 3/22/2007 11:20:09 AM | Attr = ]
streamhlp.dll -> %System32%\streamhlp.dll -> [Ver = | Size = 59392 bytes | Created Date = 4/13/2007 5:19:18 PM | Attr = R ]
UninstIPP.isu -> %System32%\UninstIPP.isu -> [Ver = | Size = 151566 bytes | Created Date = 3/22/2007 11:20:24 AM | Attr = ]
ZoneLabs(2) -> %System32%\ZoneLabs(2) -> [Folder | Created Date = 4/6/2007 7:40:54 PM | Attr = ]
ZoneLabs(4) -> %System32%\ZoneLabs(4) -> [Folder | Created Date = 4/9/2007 9:59:26 PM | Attr = ]
fidbox.dat -> %System32%\drivers\fidbox.dat -> [Ver = | Size = 1603872 bytes | Created Date = 4/15/2007 3:48:17 PM | Attr = HS]
fidbox.idx -> %System32%\drivers\fidbox.idx -> [Ver = | Size = 22412 bytes | Created Date = 4/15/2007 3:48:17 PM | Attr = HS]
fidbox2.dat -> %System32%\drivers\fidbox2.dat -> [Ver = | Size = 22560 bytes | Created Date = 4/15/2007 3:48:17 PM | Attr = HS]
fidbox2.idx -> %System32%\drivers\fidbox2.idx -> [Ver = | Size = 3092 bytes | Created Date = 4/15/2007 3:48:17 PM | Attr = HS]
klick.dat -> %System32%\drivers\klick.dat -> [Ver = | Size = 75932 bytes | Created Date = 4/15/2007 3:48:29 PM | Attr = ]
klin.dat -> %System32%\drivers\klin.dat -> [Ver = | Size = 74396 bytes | Created Date = 4/15/2007 3:48:29 PM | Attr = ]

[Files/Folders - Modified Within 30 days]
a8548678b72eb65056 -> %SystemDrive%\a8548678b72eb65056 -> [Folder | Modified Date = 4/3/2007 11:46:12 PM | Attr = ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 211 bytes | Modified Date = 4/13/2007 11:42:44 AM | Attr = HS]
boot.ini.comodofirewall -> %SystemDrive%\boot.ini.comodofirewall -> [Ver = | Size = 211 bytes | Modified Date = 3/22/2007 12:27:08 PM | Attr = ]
Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Modified Date = 4/15/2007 4:48:34 PM | Attr = ]
ff2f5fcb2bd6e07aedfa4796ad15407f -> %SystemDrive%\ff2f5fcb2bd6e07aedfa4796ad15407f -> [Folder | Modified Date = 4/9/2007 6:17:12 PM | Attr = ]
hjt -> %SystemDrive%\hjt -> [Folder | Modified Date = 4/9/2007 11:00:28 PM | Attr = ]
kav -> %SystemDrive%\kav -> [Folder | Modified Date = 4/14/2007 5:01:08 PM | Attr = ]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 4/16/2007 11:49:06 AM | Attr = ]
VundoFix Backups -> %SystemDrive%\VundoFix Backups -> [Folder | Modified Date = 4/13/2007 2:52:28 PM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 4/17/2007 4:41:08 PM | Attr = ]
$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Modified Date = 4/3/2007 11:45:58 PM | Attr = H ]
$NtUninstallKB925902$ -> %SystemRoot%\$NtUninstallKB925902$ -> [Folder | Modified Date = 4/9/2007 11:00:30 PM | Attr = H ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Modified Date = 4/18/2007 6:00:50 PM | Attr = S]
Debug -> %SystemRoot%\Debug -> [Folder | Modified Date = 4/15/2007 11:02:46 AM | Attr = ]
Downloaded Installations -> %SystemRoot%\Downloaded Installations -> [Folder | Modified Date = 4/13/2007 7:40:22 AM | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 4/15/2007 2:36:32 PM | Attr = S]
Fonts -> %SystemRoot%\Fonts -> [Folder | Modified Date = 4/2/2007 1:10:08 PM | Attr = R S]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 4/17/2007 2:05:44 PM | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 4/15/2007 4:48:32 PM | Attr = HS]
Instlog.lyt -> %SystemRoot%\Instlog.lyt -> [Ver = | Size = 5438 bytes | Modified Date = 4/2/2007 1:16:24 PM | Attr = ]
Internet Logs -> %SystemRoot%\Internet Logs -> [Folder | Modified Date = 4/13/2007 11:35:06 AM | Attr = ]
MAXLINK.INI -> %SystemRoot%\MAXLINK.INI -> [Ver = | Size = 416 bytes | Modified Date = 3/22/2007 12:18:44 PM | Attr = ]
Media -> %SystemRoot%\Media -> [Folder | Modified Date = 3/22/2007 12:22:12 PM | Attr = ]
NeroDigital.ini -> %SystemRoot%\NeroDigital.ini -> [Ver = | Size = 116 bytes | Modified Date = 4/15/2007 7:44:16 PM | Attr = ]
nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 0 bytes | Modified Date = 4/6/2007 7:09:00 PM | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 4/16/2007 3:31:38 PM | Attr = ]
pss -> %SystemRoot%\pss -> [Folder | Modified Date = 3/22/2007 12:27:04 PM | Attr = ]
Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 4/9/2007 10:37:12 PM | Attr = ]
setup.iss -> %SystemRoot%\setup.iss -> [Ver = | Size = 165 bytes | Modified Date = 3/22/2007 12:20:16 PM | Attr = ]
system -> %SystemRoot%\system -> [Folder | Modified Date = 4/14/2007 4:41:42 PM | Attr = ]
system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 227 bytes | Modified Date = 3/22/2007 12:27:08 PM | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 4/18/2007 6:14:48 PM | Attr = ]
Temp -> %SystemRoot%\Temp -> [Folder | Modified Date = 4/18/2007 6:21:28 PM | Attr = ]
twain_32 -> %SystemRoot%\twain_32 -> [Folder | Modified Date = 3/22/2007 12:16:00 PM | Attr = ]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 605 bytes | Modified Date = 4/7/2007 8:16:10 PM | Attr = ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 4/9/2007 11:00:28 PM | Attr = ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 4/16/2007 11:00:40 AM | Attr = H ]
CanonIJ Uninstaller Information -> %System32%\CanonIJ Uninstaller Information -> [Folder | Modified Date = 3/22/2007 12:16:00 PM | Attr = H ]
CatRoot -> %System32%\CatRoot -> [Folder | Modified Date = 4/10/2007 12:32:22 AM | Attr = ]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 4/18/2007 6:01:36 PM | Attr = ]
Color -> %System32%\Color -> [Folder | Modified Date = 3/22/2007 12:19:42 PM | Attr = ]
config -> %System32%\config -> [Folder | Modified Date = 4/9/2007 10:37:16 PM | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Modified Date = 4/9/2007 11:00:30 PM | Attr = RHS]
drivers -> %System32%\drivers -> [Folder | Modified Date = 4/15/2007 4:48:30 PM | Attr = ]
FNTCACHE.DAT -> %System32%\FNTCACHE.DAT -> [Ver = | Size = 107008 bytes | Modified Date = 4/9/2007 10:38:22 PM | Attr = ]
Kaspersky Lab -> %System32%\Kaspersky Lab -> [Folder | Modified Date = 4/13/2007 4:56:26 PM | Attr = ]
nvapps.xml -> %System32%\nvapps.xml -> [Ver = | Size = 81191 bytes | Modified Date = 4/18/2007 6:01:16 PM | Attr = ]
Restore -> %System32%\Restore -> [Folder | Modified Date = 4/4/2007 12:08:30 AM | Attr = ]
streamhlp.dll -> %System32%\streamhlp.dll -> [Ver = | Size = 59392 bytes | Modified Date = 4/13/2007 6:19:24 PM | Attr = R ]
UninstIPP.isu -> %System32%\UninstIPP.isu -> [Ver = | Size = 151566 bytes | Modified Date = 3/22/2007 12:20:26 PM | Attr = ]
wbem -> %System32%\wbem -> [Folder | Modified Date = 4/9/2007 10:37:12 PM | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 13646 bytes | Modified Date = 4/18/2007 6:02:00 PM | Attr = ]
zllictbl.dat -> %System32%\zllictbl.dat -> [Ver = | Size = 4212 bytes | Modified Date = 4/9/2007 11:19:14 PM | Attr = H ]
ZoneLabs(2) -> %System32%\ZoneLabs(2) -> [Folder | Modified Date = 4/9/2007 10:34:24 PM | Attr = ]
ZoneLabs(4) -> %System32%\ZoneLabs(4) -> [Folder | Modified Date = 4/9/2007 11:00:20 PM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Modified Date = 4/11/2007 10:10:04 PM | Attr = ]
fidbox.dat -> %System32%\drivers\fidbox.dat -> [Ver = | Size = 1603872 bytes | Modified Date = 4/18/2007 6:10:44 PM | Attr = HS]
fidbox.idx -> %System32%\drivers\fidbox.idx -> [Ver = | Size = 22412 bytes | Modified Date = 4/18/2007 11:06:10 AM | Attr = HS]
fidbox2.dat -> %System32%\drivers\fidbox2.dat -> [Ver = | Size = 22560 bytes | Modified Date = 4/18/2007 6:20:46 PM | Attr = HS]
fidbox2.idx -> %System32%\drivers\fidbox2.idx -> [Ver = | Size = 3092 bytes | Modified Date = 4/18/2007 11:06:10 AM | Attr = HS]
klick.dat -> %System32%\drivers\klick.dat -> [Ver = | Size = 75932 bytes | Modified Date = 4/15/2007 4:48:30 PM | Attr = ]
klin.dat -> %System32%\drivers\klin.dat -> [Ver = | Size = 74396 bytes | Modified Date = 4/15/2007 4:48:30 PM | Attr = ]

[File String Scan - Non-Microsoft Only]
PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41397 bytes | Modified Date = 8/4/2004 5:00:00 AM | Attr = ]
PEC2 , -> %System32%\Dwapilib.tlb -> [Ver = | Size = 197171 bytes | Modified Date = 2/14/1997 11:24:14 PM | Attr = ]
winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 8/4/2004 5:00:00 AM | Attr = ]
WSUD , UPX0 , -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Modified Date = 8/4/2004 5:00:00 AM | Attr = ]
qoologic , PTech , SAHAgent , abetterinternet.com , web-nex , ad-w-a-r-e.com , -> %System32%\drivers\etc\HOSTS -> [Ver = | Size = 567707 bytes | Modified Date = 4/8/2007 2:07:52 AM | Attr = ]

< End of report >
Logfile of HijackThis v1.99.1
Scan saved at 6:55:11 PM, on 4/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.a…mp;bm=ho_search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….&bm=ms_home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [TweakDUN] C:\Program Files\TweakDUN\tweakdun.exe splash
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ResChanger 2005] C:\Program Files\ResChanger 2005\ResChanger2005.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\Verizon Online Support Center\bin\matcli.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1172217096453
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

how do you turn off msn messenger? :rant2:
Post #10
Hi brewheadz,

It sounds like Kaspersky deleted the malware and your scans are fine so I think your machine is now clean of malware :)

With regard to suspect/infected emails, some bad emails can infect your machine simply by being opened, and forwarding a message is very similar to opening it, as all the original contents are copied into a new message. For this reason, I strongly recommend you to never forward, open or do anything with suspect emails other than delete them because it's not worth the risk to your machine.

You are using WinPatrol which is an excellent program for protecting your system and managing your startup programs, but for many programs the best way to prevent auto-starting is from within the program itself.

For MSN Messenger, try turning off auto-start within the program first and see if that works - just double-click the tray icon, choose Tools->Options, select the Preferences tab and uncheck Run Windows Messenger when Windows starts and see if that sorts it. There are other ways too, so if this doesn't work let me know.

With regard to the other startup programs, try to find similar options from within the application, or use WinPatrol to disable the startup entry to see if this boosts performance.

Your security software is in good shape to keep your machine safe, however please make sure all programs are set to automatically update.

I don't know if you are using the trial version or the full version of Kaspersky, but if you have already or do choose to purchase the full version I think you will find it good value. If however you choose not to purchase it, at the end of the trial please take care to ensure you always have one antivirus and firewall operating.

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs also automatically update as often as practical.

IESPYADS helps protect you from malicious websites by placing a list of known bad websites in Internet Explorer's Restricted Zone. This Zone limits the capabilities of these websites including preventing them from installing software. This will compliment your security software and I recommend you install it:
http://www.spywarewarrior.com/uiuc/resource.htm

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Find out how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know how you got on, and if there are any further issues.
Post #11
hello silver, in reply to forwarding the e-mail, i want to thank you for your advice/knowledge, the trojan was disinfected/deleted. i am in question about when kaspersky deleted those particular infected lines on the log, i fogot to tell you there was a (ca) certificate of authenticity involved with the deletion, and the machine wanted to install another, but as i started to research it, it disappeared, with out me prompting it to. :scratch: i have done all you asked, but that annoying, :rant2: msn messenger will not let you sign off, and then there was two :rant2: on the bar. otherwise everything got good. :thumbup: thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI