What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware Issue (ie6 And Wallpaper Issue As After Effects)

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

I was referred by Paws to open a new topic in this thread and describe my problem
http://forums.tomcoyote.org/Desktop_Wallpa…sue_t79842.html
My current problem is I am not able to set my desktop wallpaper (even after making regedit changes). To give you a little more background I was recently attacked by a slew of spywares and I think I have got rid of (going by the fact that the incessant pop-ups and new windows opening at every click has stopped). My hjtlog as of today is being given below.
Please help me ascertain if there are still some malwares left which is causing the wallper and IE6 issues.

Thanks!
Ranit

Logfile of HijackThis v1.99.1
Scan saved at 9:23:30 PM, on 5/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Simple Star\PhotoShow Print & Share\OurPictures.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\All Users\Desktop\Microsoft Keyboard\cleaning up\HIjackthis-DSKTOP\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Band Class - {0007522A-2297-43C1-8EB1-C90B0FF20DA5} - C:\WINDOWS\enhtb.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - C:\PROGRA~1\Ofb11\Ofb11.dll (file missing)
O2 - BHO: (no name) - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [bwprnmon.exe] C:\BITWARE\NT\bwprnmon.exe
O4 - HKLM\..\Run: [Cosmi Firewall] C:\Program Files\Cosmi\Firewall\firewall.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe
O4 - HKLM\..\Run: [Spyware X-terminator Control Center] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [iut75] c:\windows\system32\drivers\uzcx.exe
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Enh Win Updt] C:\WINDOWS\enhupdt.exe
O4 - HKCU\..\Run: [OurPictures] "C:\Program Files\Simple Star\PhotoShow Print & Share\OurPictures.exe" /AutoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\hcm.exe" -w
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm414YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.49ers.com
O15 - Trusted Zone: *.adorons.com
O15 - Trusted Zone: *.citibank.com
O15 - Trusted Zone: *.members-access.com
O15 - Trusted Zone: *.mozilla.org
O15 - Trusted Zone: *.mywebsearch.com
O15 - Trusted Zone: *.pluginfeeds.com
O15 - Trusted Zone: *.topix.net
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.anandabazar.com/wfplayer/tdserver.cab
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O20 - Winlogon Notify: A3dxq - C:\WINDOWS\system32\a3dxx.dll (file missing)
O20 - Winlogon Notify: rpcc1 - C:\WINDOWS\system32\rpcc1.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AFSEGTGF Windows Service - Unknown owner - C:\WINDOWS\system32\dsuca.exe (file missing)
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi66255.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
Post #2 last edited
Ranit :D

Welcome, let me tell ya, you have some major malware issues here. I am scratching my head trying to figure out how your computer even starts up. :rant2:


You may want to print this out because this is a mouthful. You need to take your time and read this through. We are not just fixing one virus, you have many many infections on this computer.


We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.




Go to Start > Run and type in Notepad
Notepad will open
Copy and paste the following inside the Quote Box into NotePad

sc stop AFSEGTGF Windows Service
sc delete AFSEGTGF Windows Service
sc stop Microsoft ASPI Manager
sc delete Microsoft ASPI Manager

  • Click File > Save as >type in cmd.bat
  • Under "Save as type" Select All files
  • Save it to your Desktop
  • Close Notepad
  • The cmd.bat file should now appear on your Desktop
  • Double Click cmd.bat
  • Reboot your Computer
Make sure you follow these instructions correctly to Remove or Quarantine what it finds and also to save the report, without me seeing the report my hands are tied.
Download and install the 30 day trial of AVG Anti-Spyware 7.5 to your desktop. It's very important that I see the report so make sure you follow the instructions and save the log.
  • Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware 7.5 <– Do not run the scan yet.
Open HijackThis > Do a System Scan Only, close your browser and all open windows, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
O2 - BHO: Band Class - {0007522A-2297-43C1-8EB1-C90B0FF20DA5} - C:\WINDOWS\enhtb.dll (file missing)
O2 - BHO: ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - C:\PROGRA~1\Ofb11\Ofb11.dll (file missing)
O2 - BHO: (no name) - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - (no file)

O4 - HKLM\..\Run: [iut75] c:\windows\system32\drivers\uzcx.exe
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Enh Win Updt] C:\WINDOWS\enhupdt.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm414YYUS

O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe

O20 - Winlogon Notify: A3dxq - C:\WINDOWS\system32\a3dxx.dll (file missing)
O20 - Winlogon Notify: rpcc1 - C:\WINDOWS\system32\rpcc1.dll (file missing)
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll (file missing)



Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
Tutorial if you need it How to boot into Safemode


IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system <–Don't forget this
  • make sure to remember where you saved that file, this is important, I need to see that log.
  • Close AVG Anti-Spyware 7.5
Still in Safemode, delete these files.

C:\Program Files\MyWebSearch
C:\Program Files\Ofb11

C:\WINDOWS\enhtb.dll
C:\WINDOWS\enhupdt.exe
C:\WINDOWS\satmat.exe

C:\WINDOWS\system32\a3dxx.dll
C:\WINDOWS\system32\aspi66255.exe
C:\WINDOWS\system32\dsuca.exe
C:\WINDOWS\system32\rpcc1.dll

c:\windows\system32\drivers\uzcx.exe

C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll


Reboot and run this system cleaner.


Download and Install CCleaner
If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
* Click on Run Cleaner
* Run the Issues Scan < – After it scans your system, when you click on the Fix button and it asks you to backup the Registry..Say Yes
Tutorial for CCleaner


Download: DelDomains and save it to the desktop.
  • Close all open windows and your browser
  • Right Click DelDomains.inf and select > Install
  • Reboot your computer
I need to see the AVG Log and a New HJT log. There will be more to do, some of those entries in HJT point to other infections that we have no covered yet, can't do it all at once or you will be overwhelmed.

Ken :D
Post #3
Hey Ken,

Thanks for your detailed instructions!
I followed the instructions to the best of my ability and here's what we got–

A brand new issue :My pc has turned immensely slow in fact typing this post took me an hour, it starts clocking after every third keystroke. Any relation with the spyware issues?


Couple of things though I couldn't do as I didn't find the opitions
1) O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe – I didn't see this in the HJT scan
2)
Instead I found something like O4- HKCYU\…\Run:[spc-w]"C:\Program Files\NZ Search\hcm.exe"-W
3) a3dxx.dll, rpcc1.dll and winsys2f.dll are not there in the HJT scan (see the last two logs)
4) Post-AVG scan, out of the files mentioned in your post I could only find C:\Program Files\Ofb11 and deleted it. And also a folder called NZ search.

Starting from the last step and going backwards–
HJT log after all the steps:-
Logfile of HijackThis v1.99.1
Scan saved at 10:37, on 6/6/07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\All Users\Desktop\Microsoft Keyboard\cleaning up\HIjackthis-DSKTOP\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [bwprnmon.exe] C:\BITWARE\NT\bwprnmon.exe
O4 - HKLM\..\Run: [Cosmi Firewall] C:\Program Files\Cosmi\Firewall\firewall.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe
O4 - HKLM\..\Run: [Spyware X-terminator Control Center] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [OurPictures] "C:\Program Files\Simple Star\PhotoShow Print & Share\OurPictures.exe" /AutoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.anandabazar.com/wfplayer/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AFSEGTGF Windows Service - Unknown owner - C:\WINDOWS\system32\dsuca.exe (file missing)
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\system32\aspi66255.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

******************************************************************

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 10:09 6/6/07

+ Scan result:



C:\Program Files\Spyware Nuker 2004 -> Adware.RogueSuspect : Cleaned with backup (quarantined).
C:\Program Files\Spyware Nuker 2004\Spyware Nuker 2 Log File.txt -> Adware.RogueSuspect : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AppID\{90A52F08-64AC-4DC6-9D7D-4516670275D3} -> Adware.RogueSuspect : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\TypeLib\{90A52F08-64AC-4DC6-9D7D-4516670275D3} -> Adware.RogueSuspect : Cleaned with backup (quarantined).
HKU\S-1-5-21-1715567821-1202660629-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} -> Adware.RogueSuspect : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\WINDOWS\159x.exe -> Downloader.Agent.bnn : Cleaned with backup (quarantined).
:mozilla.87:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.212:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.213:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.214:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.263:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.386:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.426:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.428:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.149:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.151:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.152:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.153:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.154:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.155:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.93:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.94:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.95:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.96:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.97:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\julio\Cookies\julio@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.20:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\julio\Cookies\julio@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.265:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.244:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.243:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.226:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.227:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.228:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.229:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.230:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.321:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
:mozilla.210:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.299:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.300:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.301:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.302:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.411:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned.
:mozilla.23:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\julio\Cookies\julio@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.248:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.249:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.250:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.251:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.128:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.156:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.322:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.323:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.324:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.356:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.141:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.142:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.177:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.178:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.179:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.69:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.110:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.125:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.64:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.65:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.66:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.113:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.103:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.104:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.105:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.106:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.107:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.157:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.158:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.159:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\julio\Cookies\julio@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.276:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.277:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.278:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.395:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.396:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.147:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.148:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.150:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.232:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.233:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.234:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.235:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.236:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.237:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.238:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.239:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.240:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.241:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.242:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.42:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.43:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.45:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.46:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.245:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.246:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.88:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.89:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.90:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.91:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.92:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.425:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tracking101 : Cleaned.
:mozilla.29:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.343:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.344:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.345:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.346:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.347:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.348:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.163:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.282:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.355:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.357:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.199:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.200:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.201:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.202:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.58:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.59:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.60:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.61:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.62:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.63:C:\Documents and Settings\julio\Application Data\Mozilla\Firefox\Profiles\aqn77ign.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\julio\Local Settings\Temp\$50BC3BB1.t$m -> Trojan.Susear.a : Cleaned with backup (quarantined).
C:\WINDOWS\system32\windev-42b-1827.sys -> Trojan.Tibs.ab : Cleaned with backup (quarantined).


::Report end


thanks!
Ranit
Post #4
Ranit,

Sorry your still having problems. At what point in the fix did you notice your computer slowing down?

Those two bad services are still running, we need to fix them.


Do this..
  • Go to Start> Run and type in services.msc then press Enter
  • Scroll down to AFSEGTGF Windows Service
  • Double Click that service to open it.
  • Click on Stop Service.
  • Then change the Startup Type to Disabled.
  • OK your way out of the program.
Do the same thing for
Microsoft ASPI Manager <– Make sure it starts with Microsoft



Download Pocket Killbox to your desktop.
Highlight all the files with the complete path inside the quote and press Ctrl C on your keyboard.

  • C:\WINDOWS\system32\aspi66255.exe
    C:\WINDOWS\system32\dsuca.exe

  • Open Pocket Killbox
  • Go to File > Paste from clipboard
  • Set it to Delete on Reboot
  • Tick the box that says End Explorer shell while killing file
  • If its not greyed out..Click the radio button that say Unregister .dll before deleting.
  • Make sure ALL Files is selected
  • Click on the Red circle with the white X
  • It will ask you to confirm the deletion…Say yes
  • It will ask you to reboot, say yes
If you get a message "pending operations has been stopped by external process!" then reboot the computer manually.


Post a new HJT log and let me know if things improved
Post #5
Hi,

The computer became slow after running all the steps you suggested in the first email. Things are better now, but I didn't have to do anything it just got better by itself. Not sure how

This is the new HJT log

and one more thing.. my screen sometimes turn black along the borders (only) and makes a
beep sound and then everything gets back to normal. The sound resembles the sound produced by some anti-virus programs when it catches an issue.


Logfile of HijackThis v1.99.1
Scan saved at 08:38, on 6/10/07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\All Users\Desktop\Microsoft Keyboard\cleaning up\HIjackthis-DSKTOP\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [bwprnmon.exe] C:\BITWARE\NT\bwprnmon.exe
O4 - HKLM\..\Run: [Cosmi Firewall] C:\Program Files\Cosmi\Firewall\firewall.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe
O4 - HKLM\..\Run: [Spyware X-terminator Control Center] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [OurPictures] "C:\Program Files\Simple Star\PhotoShow Print & Share\OurPictures.exe" /AutoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.anandabazar.com/wfplayer/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

Thanks!
Ron
Post #6
Ranit,

I am glad you are somewhat back to normal, you had so many bad files and malicious programs on your computer it was a wonder it ran at all. I am sure removing it all may have slowed your system down temporarily, but it appears fine now as does your HJT log.

I would post back to PAWS with your other problems as they may be windows related, it looks like all the bad stuff is gone.

How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • Tom Coyote
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • Geeks To Go
  • Dslreports



Here are some free programs to install, don't leave home without them
  • Spybot Search and Destroy 1.4
    Check for Updates/ Immunize and run a Full System Scan on a regular basis.
  • Ad-Aware SE Personal 1.06
    Check for Updates and run a Full System Scan on a regular basis.
  • Spyware Blaster It will prevent most spyware from ever being installed.
  • Spyware Guard It offers realtime protection from spyware installation attempts.
  • Win Patrol This program will warn you when any changes are being made to your system and give you the option to deny the change.
  • IE-Spyad
    IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 2.0 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
  • Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.
I will leave this open for you for a week or so in case theres a need to post back.

Ken
Post #7
Hi Ken, I cannot thank you enough for helping me clean up my pc. I was under a severe attack by malwares as I understand but you know what the most amazing thing is it happened when I was accessing a standard website. (www.dlink.com) So there's no escape from this scum even when one is accessing safe websites. This forum is great! Thanks again! Ron
Post #8
Ron,

You didn't get infected from dlink, you had stuff on your system already. I have all the tools that I listed for you installed on my system, my wife uses IE7 and I use Firefox, we are both online quite a bit and have never gotten anything so those tools do help.

Keep in mind that one piece of malware installed acts like a magnet to install other garbage, stay out of the file sharing sites. Reputable anti spyware programs won't pop up in your browser and offer a free scan, if they do and you go for it you will be infected.


Safe Surfin
Ken545
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI