What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Apparently Lots Of Different Trojans, Each Scan Brings New R

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
So far no symptoms, but Spybot and Windows Defender and BitDefender Online Scanner all came up with a myriad of problems. None, of course, could be cleaned up properly. Thanks for your help!

Logfile of HijackThis v1.99.1
Scan saved at 11:04:54 AM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\HT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (removed this and the corresponding file)
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2K0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Base frag grid bows] C:\Documents and Settings\All Users\Application Data\Cast ping base frag\mapi axis.exe (removed this and the corresponding file)
O4 - HKLM\..\Run: [Bird Fork Eq Bows] C:\Documents and Settings\All Users\Application Data\Manager Thunk Bows Cast\funk aim dupe.exe (removed this and the corresponding file)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1164054995015
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Post #2
OK this is after a reboot, seeing I made changes:

Logfile of HijackThis v1.99.1
Scan saved at 11:15:25 AM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HT\HijackThis.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trillian\trillian.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2K0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1164054995015
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Post #3 last edited
Hi spamgirl,

Please download NoLop to your desktop from here or here
  • Close any other programs you have running as this will require a reboot
  • Double click NoLop.exe to run it
  • Now click the button labelled "Search and Destroy"
    Your computer will now be scanned for infected files
  • When scanning is finished you will be prompted to reboot only if infected, Click OK
  • Now click the "REBOOT" Button.
  • A message should popup from NoLop. If not, double click the program again and it will finish
  • Please post the contents of C:\NoLop.log in your next response
If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx and copy it into your C:\WINDOWS\system32 folder then rerun the program.

Download Deckard's System Scanner (DSS)
  • Close all applications and windows.
  • Double-click on dss.exe to run it, and follow the prompts.
  • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
  • Make sure Format->Word Wrap is unchecked
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply
Once complete, please post the NoLop log and both DSS logs, you won't need to produce a new HijackThis log as DSS produces one for you. The logs may not fit into one post so please check that they are complete and use multiple posts if necessary.
Post #4
NoLop! Log by Skate_Punk_21 Fix running from: C:\Documents and Settings\[removed]\Desktop [8/1/2007] [9:45:06 AM] —Infection Files Found/Removed— C:\WINDOWS\tasks\F686D173C76943F3.job Beginning Removal… Rebooting… Removing Lop's Leftover Files/Folders… Editing Registry… **Fix Complete!** —Listing AppData sub directories— C:\Documents and Settings\All Users\Application Data\Adobe C:\Documents and Settings\All Users\Application Data\Ahead C:\Documents and Settings\All Users\Application Data\Apple C:\Documents and Settings\All Users\Application Data\Apple Computer C:\Documents and Settings\All Users\Application Data\Ati Mmc C:\Documents and Settings\All Users\Application Data\Avg7 C:\Documents and Settings\All Users\Application Data\Grisoft C:\Documents and Settings\All Users\Application Data\Installshield C:\Documents and Settings\All Users\Application Data\Ipswitch C:\Documents and Settings\All Users\Application Data\Microsoft C:\Documents and Settings\All Users\Application Data\Nvidia C:\Documents and Settings\All Users\Application Data\Nview_profiles – EMPTY Directory C:\Documents and Settings\All Users\Application Data\Quicktime C:\Documents and Settings\All Users\Application Data\Smartsound Software Inc C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy C:\Documents and Settings\All Users\Application Data\Ulead Systems C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage C:\Documents and Settings\All Users\Application Data\X10 Settings C:\Documents and Settings\Default User\Application Data\Microsoft C:\Documents and Settings\Gamer\Application Data\Adobe C:\Documents and Settings\Gamer\Application Data\Ahead C:\Documents and Settings\Gamer\Application Data\Apple Computer C:\Documents and Settings\Gamer\Application Data\Avg7 C:\Documents and Settings\Gamer\Application Data\Azureus C:\Documents and Settings\Gamer\Application Data\Dvdcss C:\Documents and Settings\Gamer\Application Data\Identities C:\Documents and Settings\Gamer\Application Data\Ipswitch C:\Documents and Settings\Gamer\Application Data\Limewire C:\Documents and Settings\Gamer\Application Data\Macromedia C:\Documents and Settings\Gamer\Application Data\Microsoft C:\Documents and Settings\Gamer\Application Data\Mozilla C:\Documents and Settings\Gamer\Application Data\Qualcomm C:\Documents and Settings\Gamer\Application Data\Real C:\Documents and Settings\Gamer\Application Data\Sun C:\Documents and Settings\Gamer\Application Data\Ulead Systems C:\Documents and Settings\Gamer\Application Data\Vlc C:\Documents and Settings\Localservice\Application Data\Avg7 – EMPTY Directory C:\Documents and Settings\Localservice\Application Data\Microsoft C:\Documents and Settings\Networkservice\Application Data\Microsoft
Post #5
Deckard's System Scanner v20070729.57
Run by [removed] on 2007-08-01 at 09:49:18
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
89: 2007-08-01 13:49:21 UTC - RP327 - Deckard's System Scanner Restore Point
88: 2007-08-01 06:08:33 UTC - RP326 - Software Distribution Service 3.0
87: 2007-07-31 23:51:20 UTC - RP325 - System Checkpoint
86: 2007-07-30 22:40:44 UTC - RP324 - Windows Defender Checkpoint
85: 2007-07-30 08:40:05 UTC - RP323 - System Checkpoint


– First Restore Point –
1: 2007-05-09 22:20:11 UTC - RP239 - System Checkpoint


Backed up registry hives.

Performed disk cleanup.


– HijackThis (run as Gamer.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 9:50:43 AM, on 8/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trillian\trillian.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Gamer\Desktop\dss.exe
C:\PROGRA~1\HT\Gamer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2K0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: NoLop.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1164054995015
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


– HijackThis Fixed Entries (C:\PROGRA~1\HT\backups\) ————————–

backup-20070731-110907-181 O4 - HKLM\..\Run: [Bird Fork Eq Bows] C:\Documents and Settings\All Users\Application Data\Manager Thunk Bows Cast\funk aim dupe.exe
backup-20070731-110907-214 O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
backup-20070731-110907-786 O4 - HKLM\..\Run: [Base frag grid bows] C:\Documents and Settings\All Users\Application Data\Cast ping base frag\mapi axis.exe

– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys
Post #6
Deckard's System Scanner v20070729.57
Extra logfile - please post this as an attachment with your post.
——————————————————————————–

– System Information ———————————————————-

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon™ 64 Processor 3200+
Percentage of Memory in Use: 25%
Physical Memory (total/avail): 2047.48 MiB / 1516.86 MiB
Pagefile Memory (total/avail): 3940.52 MiB / 3551.82 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1958.35 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 146.48 GiB total, 97.4 GiB free.
D: is CDROM (No Media)
J: is Fixed (NTFS) - 132.99 GiB total, 121.2 GiB free.


– Security Center ————————————————————-

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.

AV: AVG 7.5.476 v7.5.476 (GRISOFT)

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"


– Environment Variables ——————————————————-

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Gamer\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=GAME
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
GMAXLOC=C:\gmax\
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Gamer
LOGONSERVER=\\GAME
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Ulead Systems\MPEG;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f02
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Gamer\LOCALS~1\Temp
TMP=C:\DOCUME~1\Gamer\LOCALS~1\Temp
USERDOMAIN=GAME
USERNAME=Gamer
USERPROFILE=C:\Documents and Settings\Gamer
windir=C:\WINDOWS


– User Profiles —————————————————————

Gamer (admin)


– Add/Remove Programs ———————————————————

–> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\WS_FTP Pro\uninst.isu"
–> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 9 ActiveX –> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 8.1.0 –> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Adobe Shockwave Player –> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Adobe® Photoshop® Album Starter Edition 3.0 –> MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
Apple Mobile Device Support –> MsiExec.exe /I{A43B2A2F-1DB5-47F9-A608-F11A4835D7CB}
Apple Software Update –> MsiExec.exe /I{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D}
Auran Trainz GMAX Gamepack –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{936AE64F-F744-4013-99EF-16B86474D6D7}\Setup.exe"
AVG Free Edition –> C:\Program Files\Grisoft\AVG Free\setup.exe /UNINSTALL
AVS DVD Player version 2.2 –> "C:\Program Files\AVSMedia\DVDPlayer\unins000.exe"
Azureus –> C:\Program Files\Azureus\Uninstall.exe
DAO –> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{C88E49AA-41C5-4420-A08D-BE1B6C5A3A74}
Eudora –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime91\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5EAE7954-AA75-4F70-A7B2-46E2DBA77E1B}\setup.exe" -l0x9
Francesco's optional new items/creatures 3.3d –> "C:\Program Files\Bethesda Softworks\Oblivion\data\Francesco's mod\Unistall data\unins000.exe"
GameShadow –> MsiExec.exe /I{D50BB830-3961-48EB-83D9-03A04C63534F}
gmax –> MsiExec.exe /X{3FA7A919-87DA-42B1-814B-86DE8DCA17C2}
Hijackthis 1.99.1 –> "C:\Program Files\HT\unins000.exe"
HijackThis 1.99.1 –> C:\Program Files\HT\HijackThis.exe /uninstall
Hitman Blood Money –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A804B134-F03D-4EFD-9BC0-DCD257AA1B22}\setup.exe" -l0x9 -removeonly
Hotfix for Windows Media Format 11 SDK (KB929399) –> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Photo & Imaging 3.1 –> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 3.0 –> "C:\Program Files\HP\Digital Imaging\{F38FA38A-7E5A-4209-88ED-4DE21CD20EEF}\setup\hpzscr01.exe" -datfile hposcr03.dat
HP Software Update –> MsiExec.exe /X{CC0A24CB-87C9-4F1C-A1F2-F87D8D4DDCAF}
iPod for Windows –> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{44A537A5-859C-43A6-8285-C0668142A090}
Ipswitch WS_FTP Pro –> C:\WINDOWS\ISUNINST.EXE -f"C:\PROGRA~1\WS_FTP~1\uninst.isu" -c"C:\PROGRA~1\WS_FTP~1\FTPInstUtils.dll"
IrfanView (remove only) –> C:\Program Files\IrfanView\iv_uninstall.exe
iTunes –> MsiExec.exe /I{9357AE3A-B2ED-4138-BB9B-0564352C3F0A}
J2SE Runtime Environment 5.0 Update 10 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 9 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java™ SE Runtime Environment 6 Update 1 –> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
LimeWire 4.12.11 –> "C:\Program Files\LimeWire\uninstall.exe"
Logitech QuickCam Software –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime91\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x9
Logitech® Camera Driver –> "C:\Program Files\Common Files\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
Memories Disc Creator 2.0 –> MsiExec.exe /X{2E132061-C78A-48D4-A899-1D13B9D189FA}
Microsoft Compression Client Pack 1.0 for Windows XP –> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Standard Edition 2003 –> MsiExec.exe /I{90120409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0 –> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Modula City 2004 –> C:\WINDOWS\unins000.exe
Modula City 2004 Update v1.1 –> C:\WINDOWS\unins001.exe
Mozilla Firefox (2.0.0.5) –> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
My Global Search Bar –> rundll32 C:\PROGRA~1\MYGLOB~1\bar\1.bin\mgsBar.dll,O
neroxml –> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers –> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Oblivion –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x9 -removeonly
Paint Shop Pro 7 –> MsiExec.exe /I{D6DE02C7-1F47-11D4-9515-00105AE4B89A}
QuickTime –> MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
RealPlayer –> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x9 -removeonly
RollerCoaster Tycoon 2 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{72DF62BD-FF36-424E-AA5F-D89BAFF2C249}\Setup.exe" -l0x9
Security Update for CAPICOM (KB931906) –> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) –> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
SmartSound Quicktracks Plugin –> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}
Spybot - Search & Destroy 1.4 –> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Trainz Paint Shed –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime91\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6202DCFE-2F03-445C-9885-CB54B062BC0F}\setup.exe" -l0x9
Trillian –> C:\Program Files\Trillian\trillian.exe /uninstall
TRS2004 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDE1289F-4025-41A5-AD17-101DB4D82CA7}\Setup.exe" -l0x9
TRS2006 –> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime91\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5ED9E38C-9A96-49D8-89B3-92E278003FCF}\Setup.exe" -l0x9
Tweak UI –> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
VideoLAN VLC media player 0.8.5 –> C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp (remove only) –> "C:\Program Files\Winamp\UninstWA.exe"
Windows Defender –> MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Media Encoder 9 Series –> msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series –> MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Format 11 runtime –> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
WinRAR archiver –> C:\Program Files\WinRAR\uninstall.exe
Xvid 1.1.2 final uninstall –> "C:\Program Files\Xvid\unins000.exe"


– End of Deckard's System Scanner: finished at 2007-08-01 at 09:51:05 ———
Post #7
Hi spamgirl,

Looking a bit better :) however there are still a few things to take care of:

Please print/save a copy of these instructions because we will be using Safe Mode, during which time you won't have access to the internet.

Next there are some uninstalls to do, please open Start->Control Panel->Add/Remove Programs and remove these:
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 9
Java™ SE Runtime Environment 6 Update 1
My Global Search Bar

The Java installations are out of date and are now a security risk, you can get the latest version (version 6 update 2) from here.

You have LimeWire and Azureus, P2P file sharing programs installed on your computer. These programs do not come bundled with malware as some similar programs do, but peer-to-peer file sharing networks are one of the biggest sources of malware we see. Anything downloaded from them cannot be trusted to be clean, because even if the file appears to be what it claims to be, it can have malware embedded in it.
I recommend you remove it, but of course the choice is yours.
You can remove these via Add/Remove Programs.

Next, please use Windows Explorer to delete this folder if you have not done so already:
C:\Program Files\MyGlobalSearch

Then, download HostXpert.
  • Unzip HostsXpert.zip
  • Double click on HostsXpert.exe
  • Click Backup/Restore->Create Backup to back up your existing hosts file
  • Then click on Restore Original Hosts and OK the prompt to restore your Hosts file to the default
  • Click on Make Hosts Read Only to secure it against changes
  • Close program when complete.
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Press OK and Yes to confirm

Then, download, install, and update AVG Anti-Spyware 7.5
Download the installer from this page:
http://www.ewido.net/en/download/
  • Save the installer to desktop
  • Double click the installer, select your language, and then select OK
  • Click through to install the program and once you press Finish the main screen will open
  • Next to Resident Shield, click Change state so that active changes to inactive
  • Right-click the AVG Antispyware tray icon, select Start with Windows to remove the check-mark and OK the prompt
  • Click the Update tab at the top, an update should be under way, if not, then under Manual Update click Start update.
  • After the update finishes the status bar at the bottom will display Update successful
  • If for any reason you cannot update from within the program, download and install the full database package from here: http://www.ewido.net/en/download/updates/
  • Close AVG Anti-Spyware. Do not run a scan yet.
Reboot your computer into Safe Mode
To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads.
Select Safe Mode at the top, on the screen that appears.
Sign in with your normal user account

Once in safe mode:
  • Run AVG Anti-Spyware 7.5 and click on the Scanner tab at the top
  • Click the Settings tab and under How to act, change Recommended actions to Quarantine and under Reports select Do not automatically generate reports
  • Click back to the Scan tab and then click on Complete System Scan.
  • This scan can take quite a while to run, so be prepared.
  • AVG Anti-Spyware 7.5 will list any infections found on the left hand side.
  • When the scan is complete, make sure Set all elements to: is set to Quarantine, if not, click the setting and choose Quarantine
  • Click the Apply all actions button. AVG Anti-Spyware 7.5 will display All actions have been applied on the right hand side.
  • Click on Save Report, then Save Report As. This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Now reboot your computer normally

Once complete, please post the AVG Antispyware log along with a new HijackThis log
Post #8
Done, the only thing there was in AVGS was tracking cookies. ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 5:55:40 PM 8/1/2007 + Scan result: :mozilla.307:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.377:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.461:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.56:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.57:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.58:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.59:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.60:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.61:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.62:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.63:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.64:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.65:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.66:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.67:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.68:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.69:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.70:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.71:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.72:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.73:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.74:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.75:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.76:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.77:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.78:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.79:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.80:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.81:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.82:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.83:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.84:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.85:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.86:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.87:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.88:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.89:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.90:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Gamer\Cookies\gamer@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Gamer\Cookies\gamer@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Gamer\Cookies\gamer@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. :mozilla.115:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.116:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.117:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.124:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.125:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.32:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.632:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned. :mozilla.200:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.201:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.222:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.223:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.224:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.225:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.226:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.227:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.228:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.229:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.7:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.230:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Dealtime : Cleaned. :mozilla.231:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Dealtime : Cleaned. :mozilla.232:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Dealtime : Cleaned. :mozilla.250:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.251:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.252:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.253:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.145:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.146:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.147:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.148:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.651:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.652:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.653:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.654:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.655:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.656:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.657:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.658:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.659:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.660:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.661:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.662:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.322:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.323:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.592:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.337:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned. C:\Documents and Settings\Gamer\Cookies\[removed][1].txt -> TrackingCookie.Live : Cleaned. :mozilla.589:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.590:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.578:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned. :mozilla.545:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Matchcraft : Cleaned. :mozilla.546:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Matchcraft : Cleaned. :mozilla.547:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Matchcraft : Cleaned. :mozilla.43:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Netflame : Cleaned. :mozilla.44:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Netflame : Cleaned. C:\Documents and Settings\Gamer\Cookies\[removed][1].txt -> TrackingCookie.Netflame : Cleaned. :mozilla.400:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.401:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.402:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.410:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.409:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned. :mozilla.719:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.34:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.35:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.36:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.37:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.38:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.39:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.40:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.42:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. C:\Documents and Settings\Gamer\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.426:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.427:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. C:\Documents and Settings\Gamer\Cookies\gamer@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Documents and Settings\Gamer\Cookies\[removed][1].txt -> TrackingCookie.Real : Cleaned. C:\Documents and Settings\Gamer\Cookies\gamer@real[2].txt -> TrackingCookie.Real : Cleaned. C:\Documents and Settings\Gamer\Cookies\[removed][1].txt -> TrackingCookie.Real : Cleaned. :mozilla.433:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.434:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.435:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned. :mozilla.439:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.10:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.11:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.12:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.13:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.17:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.18:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.19:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.23:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.24:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.25:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.26:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.29:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.8:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Gamer\Cookies\gamer@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\Gamer\Cookies\gamer@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.120:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.121:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.122:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.123:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.470:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.471:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.472:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.473:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.474:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.482:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.483:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.484:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.495:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.506:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Weborama : Cleaned. :mozilla.579:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\Gamer\Cookies\[removed][1].txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.533:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.534:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.535:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.536:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.537:C:\Documents and Settings\Gamer\Application Data\Mozilla\Firefox\Profiles\t3qowy5t.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end
Post #9
Logfile of HijackThis v1.99.1
Scan saved at 5:59:11 PM, on 8/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2K0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1164054995015
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Post #12
Hi spamgirl,

Good to hear that things are running OK and I think your machine is now clean :)

Here are some important final steps:

You should now delete NoLop.exe, dss.exe, HostsXpert.zip and the HostsXpert folder.

You can also uninstall AVG Antispyware if you wish, although it is an excellent program.

Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close

Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up… and say Yes to the prompt
Press OK and Yes to confirm

Some tips to help you keep your computer clean:

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs are set to automatically update daily.

You should consider installing a Personal Firewall program. Even if you are behind a NAT router, I recommend you use firewall software as it will improve the security of your computer by monitoring and controlling outbound connections to the internet as well as inbound. There are various free packages available, such as Sunbelt Personal Firewall and Zone Alarm:
http://www.sunbelt-software.com/Home-Home-…sonal-Firewall/
http://www.zonelabs.com/

Spywareblaster is a free program which prevents the download and installation of Internet Explorer ActiveX based malware by immunizing your system against it. You can download Spywareblaster from here and a tutorial to help you get started is available here.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Find out more about how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know that you have read this, and if there are any further issues.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI