What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Help Wanted,virus Infections,adwares Etc.

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:rant2: :rant: I had a Cid problem,I deleted my user acc, and make a new one.OK no CID.I have McAfee internet suit,microsoft defender,spybot,adware,now have agv(anti spy,anty virus,rootkit)System mechanic,and hijack.with all that security and have a problems with trojan horse "DROPPER GENERIC. KXN" in system volume,trojan horse BHO. AMN trojan horse AJM, in Windows \system32 and a virus Worm\Generic.AJW
I never haved problem but now I have a lot of problems. IHope some body can help me,here is the Hijack this log


Logfile of HijackThis v1.99.1
Scan saved at 12:13:24 AM, on 8/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\keyhook.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {633938a8-385b-41e9-9e67-f6d0ad7c411d} - C:\WINDOWS\system32\imagx3j.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmpB.tmp.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SaveKeepDeafSixth] C:\Documents and Settings\All Users\Application Data\HEARTPINGSAVEKEEP\4 Roam.exe
O4 - HKLM\..\Run: [Online chin internet bolt] C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin\SAFE FIND.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab55579.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: c:\windows\system32\jkhfebc.dll
O20 - Winlogon Notify: imagx3j - imagx3j.dll (file missing)
O20 - Winlogon Notify: mcianfg - mcianfg.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe


Thanks
Elloquito26
Post #2
Hi Elloquito26 and welcome to the forums.

My name is Dave. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can sometimes take a while to research so please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Before we start working on your infections I have one major observation. You appear to have two Anti-virus programs running, McAfee and AVG. This can cause all kinds of issues including system slowdown, conflicts, errors, and false positives. Please remove one of them or at least disable real time protection on one. I would do that ASAP.

You appear to have a Vundo infection and LOP from what I can see. So let's start there.

Please download
VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click Yes
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from Click the Scan for Vundo button when VundoFix appears at reboot.


We are going to use HJT to create a list of your currently installed programs.1. Open HijackThis and click on the Config… button in the "Other stuff" section (lower right hand corner).
2. Click on the Misc Tools button.
3. Click on the Open Uninstall Manager… button.
4. Click on the Save list… button.
5. Save the file uninstall_list.txt to a convinient location. This should open Notepad with the list.
6. Please Copy and Paste the list into your next reply.
So I need the Vundo log, the installed programs, and a new HJT log.
Post #3
Hi Dave, I do everything you said and here are the logs from Vundo and Hjs

"VUNDO"
C:\WINDOWS\system32\tmpB.tmp.dll

"Hijck this"
Logfile of HijackThis v1.99.1
Scan saved at 9:13:29 PM, on 8/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\keyhook.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Windows Defender\MSASCui.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\windows\system32\lqdsrngo.exe
C:\Program Files\Messenger\msmsgs.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {633938a8-385b-41e9-9e67-f6d0ad7c411d} - C:\WINDOWS\system32\imagx3j.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SaveKeepDeafSixth] C:\Documents and Settings\All Users\Application Data\HEARTPINGSAVEKEEP\4 Roam.exe
O4 - HKLM\..\Run: [Online chin internet bolt] C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin\SAFE FIND.exe
O4 - HKLM\..\Run: [{0B-BE-E5-57-ZN}] C:\windows\system32\lqdsrngo.exe CHA001
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\lqdsrngo.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab55579.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: imagx3j - imagx3j.dll (file missing)
O20 - Winlogon Notify: mcianfg - mcianfg.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe


Here the uninstall list from hjs

3D Home Architect Home Design Deluxe 6
Ad-Aware 2007
Adobe Flash Player 9 ActiveX
Adobe Reader 8.1.0
Adobe® Photoshop® Album Starter Edition 3.0
Adobe® Photoshop® Album Starter Edition 3.0.1
Anti-Spy Yahoo!
AnyDVD
ArcSoft PhotoImpression 4
AVG Anti-Rootkit Free
AVG Anti-Spyware 7.5
BootSkin
CloneCD
CloneDVD2
C-Media 3D Audio
DivX
D-Link VGA Webcam
DVD Decoder Pak for Windows XP
DVD Decrypter (Remove Only)
DVD Shrink 3.2
Form Fill (Windows Live Toolbar)
getPlus®_ocx
Google Earth
Google Toolbar for Internet Explorer
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
InterVideo WinDVD Recorder 5
iolo technologies' System Mechanic Professional 6
J2SE Runtime Environment 5.0 Update 3
Lexmark 3100 Series
LimeWire PRO 4.12.3
Map Button (Windows Live Toolbar)
MathPlayer
McAfee Uninstall Wizard
Mega Pixel Camera (8105 SXGA)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Outlook Connector for MSN
Microsoft Office XP Professional with FrontPage
Microsoft Picture It! Express 9
Microsoft Picture It! Library 9
Microsoft SQL Server Desktop Engine
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Windows XP Video Decoder Checkup Utility
MSN
MSN Encarta Plus Support Files
MSN Messenger 7.5
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 6.0 Parser (KB927977)
OneCare Advisor (Windows Live Toolbar)
Popup Blocker (Windows Live Toolbar)
Roxio Content 9
Roxio Drag-to-Disc
Roxio Easy Media Creator 9 Suite
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
SiS 661FX_760_741_M661FX_M760_M741
Smart Menus (Windows Live Toolbar)
Tabbed Browsing (Windows Live Toolbar)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
URGE
Verizon Online Help & Support
Viewpoint Media Player
Windows Defender
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Favorites for Windows Live Toolbar
Windows Live Outlook Toolbar (Windows Live Toolbar)
Windows Live Toolbar
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Vista Upgrade Advisor
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinZip
Xingtone Ringtone Maker
Yahoo! Install Manager
Yahoo! Messenger
Yahoo! Messenger Explorer Bar
Yahoo! Toolbar
Zuma Deluxe RA


If you see in the last list I try to uninstall Verizon support( I don't have Verizon anymore)but I can't to do it
Well I'm here waithing for your next step. thanks
Post #6
There should be more than that. Is there a file named vundofix.txt located directly on your C: drive? C:\vundofix.txt? If so open that and copy/paste the contents here. If not we'll just go from there. Let me know.
Post #7
Hi Dave, well that is the only stuff that vundo find,I scan again and now nothing appear in the scan but now when I try tocheck my emails in yahoo,if I don't do inmediately whe IE opens, I need to close IE and start again, the same with the yahoo antispy when I hit that botton the spot of the scan remain opens untils I log off and start again, Like I told you before this is the first time I have problems like that, my big problem is that I don't find my disc of XP if I have, I reinstall and start from 0. but I need to work in that for that reason. C:\WINDOWS\system32\tmpB.tmp.dll but now is empty nad the scan no find nothing,I don't know what happen here
Post #8
OK no problem, we'll just go from there. You still have some infections present so it's no surprise you are still having trouble. Let's tackle LOP next.

Please Download NoLop to your desktop from one of the links below…
Link 1
Link 2
Link 3
  • First close any other programs you have running as this will require a reboot
  • Double click NoLop.exe to run it
  • Now click the button labelled "Search and Destroy"
    <>
  • When scanning is finished you will be prompted to reboot only if infected, Click OK
  • Now click the "REBOOT" Button.
  • A Message should popup from NoLop. If not, double click the program again and it will finish. Please Post the contents of C:\NoLop.log along with a fresh HijackThis log
–If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program.–
Post #9
Here is the log from nolop:

NoLop! Log by Skate_Punk_21

Please Note: any existing old logs will have now been renamed to NoLop!OLD.log

Fix running from: C:\Documents and Settings\[removed]\Desktop
[8/13/2007]
[9:35:49 PM]

—Infection Files Found/Removed—
NO INFECTION FILES FOUND - Cleaning Aborted.

—Listing AppData sub directories—

C:\Documents and Settings\Administrator\Application Data\Adobe
C:\Documents and Settings\Administrator\Application Data\Lavasoft
C:\Documents and Settings\Administrator\Application Data\Mcafee.com Personal Firewall
C:\Documents and Settings\Administrator\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Ahead
C:\Documents and Settings\All Users\Application Data\Aim Download Bolt Bags – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Arcsoft
C:\Documents and Settings\All Users\Application Data\Avg7 – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Dvd Shrink
C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
C:\Documents and Settings\All Users\Application Data\Google
C:\Documents and Settings\All Users\Application Data\Grisoft
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Intervideo
C:\Documents and Settings\All Users\Application Data\Iolo – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Lavasoft
C:\Documents and Settings\All Users\Application Data\Mcafee
C:\Documents and Settings\All Users\Application Data\Mcafee.com
C:\Documents and Settings\All Users\Application Data\Mcafee.com Personal Firewall
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Microsoft Corporation – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Motive
C:\Documents and Settings\All Users\Application Data\Msn6
C:\Documents and Settings\All Users\Application Data\Popcap
C:\Documents and Settings\All Users\Application Data\Roxio
C:\Documents and Settings\All Users\Application Data\Slysoft
C:\Documents and Settings\All Users\Application Data\Sonic
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Temp – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
C:\Documents and Settings\All Users\Application Data\Yahoo!
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion(2)
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Google – EMPTY Directory
C:\Documents and Settings\Localservice\Application Data\Help – EMPTY Directory
C:\Documents and Settings\Localservice\Application Data\Macromedia
C:\Documents and Settings\Localservice\Application Data\Mcafee.com Personal Firewall
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Roxio
C:\Documents and Settings\Localservice\Application Data\Symantec
C:\Documents and Settings\Matos.matos-4769e8a7c\Application Data\Adobe
C:\Documents and Settings\Matos.matos-4769e8a7c\Application Data\Leadertech
C:\Documents and Settings\Matos.matos-4769e8a7c\Application Data\Macromedia
C:\Documents and Settings\Matos.matos-4769e8a7c\Application Data\Microsoft
C:\Documents and Settings\Matos.matos-4769e8a7c\Application Data\Roxio
C:\Documents and Settings\Mike's\Application Data\Adobe
C:\Documents and Settings\Mike's\Application Data\Arcsoft
C:\Documents and Settings\Mike's\Application Data\Google
C:\Documents and Settings\Mike's\Application Data\Help – EMPTY Directory
C:\Documents and Settings\Mike's\Application Data\Identities
C:\Documents and Settings\Mike's\Application Data\Leadertech
C:\Documents and Settings\Mike's\Application Data\Limewire
C:\Documents and Settings\Mike's\Application Data\Macromedia
C:\Documents and Settings\Mike's\Application Data\Mcafee.com Personal Firewall
C:\Documents and Settings\Mike's\Application Data\Microsoft
C:\Documents and Settings\Mike's\Application Data\Yahoo!
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Roxio
C:\Documents and Settings\Sandie\Application Data\Adobe
C:\Documents and Settings\Sandie\Application Data\Adobeum
C:\Documents and Settings\Sandie\Application Data\Arcsoft
C:\Documents and Settings\Sandie\Application Data\Browse Body Ace – EMPTY Directory
C:\Documents and Settings\Sandie\Application Data\Google
C:\Documents and Settings\Sandie\Application Data\Help – EMPTY Directory
C:\Documents and Settings\Sandie\Application Data\Identities
C:\Documents and Settings\Sandie\Application Data\Intervideo
C:\Documents and Settings\Sandie\Application Data\Lavasoft
C:\Documents and Settings\Sandie\Application Data\Leadertech
C:\Documents and Settings\Sandie\Application Data\Limewire
C:\Documents and Settings\Sandie\Application Data\Macromedia
C:\Documents and Settings\Sandie\Application Data\Mcafee.com Personal Firewall
C:\Documents and Settings\Sandie\Application Data\Microsoft
C:\Documents and Settings\Sandie\Application Data\Motive – EMPTY Directory
C:\Documents and Settings\Sandie\Application Data\Msn6 – EMPTY Directory
C:\Documents and Settings\Sandie\Application Data\Msninstaller
C:\Documents and Settings\Sandie\Application Data\Playfirst – EMPTY Directory
C:\Documents and Settings\Sandie\Application Data\Roxio
C:\Documents and Settings\Sandie\Application Data\Smart Pc Solutions – EMPTY Directory
C:\Documents and Settings\Sandie\Application Data\Sun
C:\Documents and Settings\Sandie\Application Data\Webshots
C:\Documents and Settings\Sandie\Application Data\Yahoo!


here the list of hjs

Logfile of HijackThis v1.99.1
Scan saved at 9:46:42 PM, on 8/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\keyhook.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\windows\system32\lqdsrngo.exe
C:\WINDOWS\system32\ctfmon.exe
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {633938a8-385b-41e9-9e67-f6d0ad7c411d} - C:\WINDOWS\system32\imagx3j.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SaveKeepDeafSixth] C:\Documents and Settings\All Users\Application Data\HEARTPINGSAVEKEEP\4 Roam.exe
O4 - HKLM\..\Run: [Online chin internet bolt] C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin\SAFE FIND.exe
O4 - HKLM\..\Run: [{0B-BE-E5-57-ZN}] C:\windows\system32\lqdsrngo.exe CHA001
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab55579.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: imagx3j - imagx3j.dll (file missing)
O20 - Winlogon Notify: mcianfg - mcianfg.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
Post #10
STEP 1:

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {633938a8-385b-41e9-9e67-f6d0ad7c411d} - C:\WINDOWS\system32\imagx3j.dll (file missing)
O4 - HKLM\..\Run: [SaveKeepDeafSixth] C:\Documents and Settings\All Users\Application Data\HEARTPINGSAVEKEEP\4 Roam.exe
O4 - HKLM\..\Run: [Online chin internet bolt] C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin\SAFE FIND.exe
O4 - HKLM\..\Run: [{0B-BE-E5-57-ZN}] C:\windows\system32\lqdsrngo.exe CHA001
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O20 - Winlogon Notify: imagx3j - imagx3j.dll (file missing)
O20 - Winlogon Notify: mcianfg - mcianfg.dll (file missing)

Then close all windows except this one and press Fix checked.


STEP 2:

NOTE: Do not worry if OTMoveIt cannot find the files. Just means they are gone but I want to make sure.

Please download the OTMoveIt by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\Documents and Settings\All Users\Application Data\HEARTPINGSAVEKEEP
    C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin
    C:\windows\system32\lqdsrngo.exe

  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Close OTMoveIt
*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.
**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

Click "Exit" to close OTMoveIt.


STEP 3:

Using Internet Explorer, click on Kaspersky Online Scanner * You will be prompted to install an ActiveX component from Kaspersky, Click 'Yes'.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save as Text' button:
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.
Post #11
Hi Dave Here are the log from "OTMOVE" File/Folder C:\Documents and Settings\All Users\Application Data\HEARTPINGSAVEKEEP not found. C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin moved successfully. C:\windows\system32\lqdsrngo.exe moved successfully. Created on 08/15/2007 02:44:34
Post #12
Here the logs from hjs and kapersky Logfile of HijackThis v1.99.1 Scan saved at 95915 AM, on 8152007 Platform Windows XP SP2 (WinNT 5.01.2600) MSIE Internet Explorer v7.00 (7.00.6000.16512) Running processes CWINDOWSSystem32smss.exe CWINDOWSsystem32winlogon.exe CWINDOWSsystem32services.exe CWINDOWSsystem32lsass.exe CWINDOWSsystem32svchost.exe CProgram FilesWindows DefenderMsMpEng.exe CWINDOWSSystem32svchost.exe CWINDOWSsystem32LEXBCES.EXE CWINDOWSsystem32spoolsv.exe CWINDOWSsystem32LEXPPS.EXE CWINDOWSExplorer.EXE CWINDOWSsystem32keyhook.exe CPROGRA~1mcafee.comagentmcagent.exe CProgram FilesMcAfee.comVSOoasclnt.exe CPROGRA~1McAfee.comPERSON~1MpfTray.exe CPROGRA~1McAfeeSPAMKI~1MskAgent.exe CProgram FilesWindows DefenderMSASCui.exe CProgram FilesGrisoftAVG Anti-Spyware 7.5avgas.exe CProgram FilesLavasoftAd-Aware 2007aawservice.exe CWINDOWSsystem32ctfmon.exe CProgram FilesGrisoftAVG Anti-Spyware 7.5guard.exe cprogram filesmcafee.comagentmcdetect.exe cPROGRA~1mcafee.comvsomcshield.exe cPROGRA~1mcafee.comagentmctskshd.exe CPROGRA~1McAfee.comPERSON~1MpfService.exe CPROGRA~1McAfeeSPAMKI~1MSKSrvr.exe cprogram filesmcafee.comvsomcvsshld.exe cprogra~1mcafee.comvsomcvsescn.exe CWINDOWSsystem32svchost.exe CWINDOWSsystem32svchost.exe CPROGRA~1McAfee.comPERSON~1MpfAgent.exe cPROGRA~1mcafee.commpsmscifapp.exe CProgram FilesInternet Exploreriexplore.exe CProgram FilesWindows Live Favoriteswlfsync.exe CProgram FilesHijackthisHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = httpwww.comcast.netexplore.html R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = httpwww.yahoo.com R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = httpgo.microsoft.comfwlinkLinkId=54896 R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = httpgo.microsoft.comfwlinkLinkId=54896 R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = httpwww.yahoo.com R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = httpg.msn.com0SEENUSSAOS01FORM=TOOLBR R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = httpgo.microsoft.comfwlinkLinkId=74005 O2 - BHO &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - CProgram FilesYahoo!CompanionInstallscpnyt.dll O2 - BHO Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - CProgram FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll O2 - BHO (no name) - {53707962-6F74-2D53-2644-206D7942484F} - CPROGRA~1SPYBOT~1SDHelper.dll O2 - BHO Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - CProgram FilesWindows Live Toolbarmsntb.dll O3 - Toolbar Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - CProgram FilesWindows Live Toolbarmsntb.dll O3 - Toolbar &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - cprogram filesgooglegoogletoolbar3.dll O3 - Toolbar McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - cprogra~1mcafee.comvsomcvsshl.dll O3 - Toolbar Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - CProgram FilesYahoo!CompanionInstallscpnyt.dll O4 - HKLM..Run [SiS Windows KeyHook] CWINDOWSsystem32keyhook.exe O4 - HKLM..Run [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM..Run [BootSkin Startup Jobs] CProgram FilesStardockWinCustomizeBootSkinBootSkin.exe StartupJobs O4 - HKLM..Run [MCAgentExe] cPROGRA~1mcafee.comagentmcagent.exe O4 - HKLM..Run [VSOCheckTask] CPROGRA~1McAfee.comVSOmcmnhdlr.exe checktask O4 - HKLM..Run [OASClnt] CProgram FilesMcAfee.comVSOoasclnt.exe O4 - HKLM..Run [MPFExe] CPROGRA~1McAfee.comPERSON~1MpfTray.exe O4 - HKLM..Run [MSKAGENTEXE] CPROGRA~1McAfeeSPAMKI~1MskAgent.exe O4 - HKLM..Run [MSKDetectorExe] CPROGRA~1McAfeeSPAMKI~1MSKDetct.exe startup O4 - HKLM..Run [Windows Defender] CProgram FilesWindows DefenderMSASCui.exe -hide O4 - HKLM..Run [MCUpdateExe] cPROGRA~1mcafee.comagentmcupdate.exe O4 - HKLM..Run [!AVG Anti-Spyware] CProgram FilesGrisoftAVG Anti-Spyware 7.5avgas.exe minimized O4 - HKLM..Run [Adobe Photo Downloader] CProgram FilesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe O4 - HKLM..Run [CloneCDTray] CProgram FilesSlySoftCloneCDCloneCDTray.exe s O4 - HKLM..Run [ioloDelayModule] CProgram FilesioloSystem Mechanic Professional 6delay.exe O4 - HKCU..Run [ctfmon.exe] CWINDOWSsystem32ctfmon.exe O8 - Extra context menu item &Windows Live Search - resCProgram FilesWindows Live Toolbarmsntb.dllsearch.htm O8 - Extra context menu item Add to Windows &Live Favorites - httpfavorites.live.comquickadd.aspx O8 - Extra context menu item E&xport to Microsoft Excel - resCPROGRA~1MICROS~2Office10EXCEL.EXE3000 O9 - Extra button Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - CDocuments and SettingsAll UsersApplication DataYahoo! CompanionModulesmessmod4v6yhexbmes.dll (file missing) O9 - Extra 'Tools' menuitem Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - CDocuments and SettingsAll UsersApplication DataYahoo! CompanionModulesmessmod4v6yhexbmes.dll (file missing) O9 - Extra button Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - CProgram FilesMessengermsmsgs.exe O9 - Extra 'Tools' menuitem Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - CProgram FilesMessengermsmsgs.exe O11 - Options group [INTERNATIONAL] International O16 - DPF {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - httpsactivatemydsl.verizon.netsdcCommondownloadDSLtgctlcm.cab O16 - DPF {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - httpwww.kaspersky.comkosenglishkavwebscan_unicode.cab O16 - DPF {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - httpdownload.mcafee.commolbinsharedmcinsctl4,0,0,101mcinsctl.cab O16 - DPF {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - httpby130fd.bay130.hotmail.msn.comresourcesMsnPUpld.cab O16 - DPF {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - httpcdn2.zone.msn.combinFrameworkv10ZIntro.cab55579.cab O16 - DPF {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - httpdownload.mcafee.commolbinsharedmcgdmgr1,0,0,26mcgdmgr.cab O16 - DPF {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - httpsediagnostics.lexmark.comserval.cab O16 - DPF {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - httpwww.adobe.comproductsacrobatnosgp.cab O18 - Protocol msnim - {828030A1-22C1-4009-854F-8E305202313F} - CPROGRA~1MSNMES~1msgrapp.dll (file missing) O20 - Winlogon Notify WgaLogon - CWINDOWSSYSTEM32WgaLogon.dll O21 - SSODL WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - CWINDOWSsystem32WPDShServiceObj.dll O23 - Service Ad-Aware 2007 Service (aawservice) - Lavasoft AB - CProgram FilesLavasoftAd-Aware 2007aawservice.exe O23 - Service AVG Anti-Spyware Guard - GRISOFT s.r.o. - CProgram FilesGrisoftAVG Anti-Spyware 7.5guard.exe O23 - Service Google Updater Service (gusvc) - Google - CProgram FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe O23 - Service InstallDriver Table Manager (IDriverT) - Macrovision Corporation - CProgram FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe O23 - Service LexBce Server (LexBceS) - Lexmark International, Inc. - CWINDOWSsystem32LEXBCES.EXE O23 - Service McAfee WSC Integration (McDetect.exe) - McAfee, Inc - cprogram filesmcafee.comagentmcdetect.exe O23 - Service McAfee.com McShield (McShield) - McAfee Inc. - cPROGRA~1mcafee.comvsomcshield.exe O23 - Service McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - cPROGRA~1mcafee.comagentmctskshd.exe O23 - Service McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - CPROGRA~1McAfee.comAgentmcupdmgr.exe O23 - Service McAfee Personal Firewall Service (MpfService) - McAfee Corporation - CPROGRA~1McAfee.comPERSON~1MpfService.exe O23 - Service McAfee SpamKiller Server (MskService) - McAfee Inc. - CPROGRA~1McAfeeSPAMKI~1MSKSrvr.exe O23 - Service Roxio UPnP Renderer 9 - Sonic Solutions - CProgram FilesCommon FilesSonic SharedRoxioUPnPRenderer9.exe O23 - Service Roxio Upnp Server 9 - Sonic Solutions - CProgram FilesCommon FilesSonic SharedRoxioUpnpService9.exe O23 - Service LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - CProgram FilesCommon FilesRoxio Shared9.0SharedCOMRoxLiveShare9.exe O23 - Service RoxMediaDB9 - Sonic Solutions - CProgram FilesCommon FilesRoxio Shared9.0SharedCOMRoxMediaDB9.exe O23 - Service Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - CProgram FilesCommon FilesRoxio Shared9.0SharedCOMRoxWatch9.exe O23 - Service stllssvr - MicroVision Development, Inc. - CProgram FilesCommon FilesSureThing Sharedstllssvr.exe Kapersky log KASPERSKY ONLINE SCANNER REPORT Wednesday, August 15, 2007 9:58:24 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 15/08/2007 Kaspersky Anti-Virus database records: 381301 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ Scan Statistics Total number of scanned objects 98346 Number of viruses found 9 Number of infected objects 37 Number of suspicious objects 0 Duration of the scan process 01:46:56 Infected Object Name Virus Name Last Action C:\3a41f6432e8987535fb3a8\msxml6-KB927977-enu-x86.log Object is locked skipped C:\df239a300e40d4f6b68079abba0ecca9\msxml4-KB927978-enu.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\SpamKiller\Logs\Filtering.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd002.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\DSS\MachineKeys\49f49cb535bf36b4b890a5e8d2bff55e_7a6c3351-ec3a-405a-a08d-ba9ef0148601 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1f35abd9f49a7e151c37dfadf30d819d_7a6c3351-ec3a-405a-a08d-ba9ef0148601 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\44caed0195c16f2c53717f045482859a_7a6c3351-ec3a-405a-a08d-ba9ef0148601 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\83b4e5882e23cfdf554f8dba5dd22a65_7a6c3351-ec3a-405a-a08d-ba9ef0148601 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\90f437880f463bfe616df6e2f9fcc8d3_7a6c3351-ec3a-405a-a08d-ba9ef0148601 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a859063711150c1e8bc5d02f1cd29a3c_7a6c3351-ec3a-405a-a08d-ba9ef0148601 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cd4b9c20bc21cd9836eeb5122e66b058_7a6c3351-ec3a-405a-a08d-ba9ef0148601 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-03052007-213244.log Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Mike's\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped C:\Documents and Settings\Mike's\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Mike's\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Mike's\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Mike's\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{7685E167-34A2-4185-B14D-7BE0A4387AEE} Object is locked skipped C:\Documents and Settings\Mike's\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mike's\Local Settings\Temp\~DF85A9.tmp Object is locked skipped C:\Documents and Settings\Mike's\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Mike's\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mike's\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Mike's\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Mike's\Shared\Medal of Honor Allied Assault.zip/Medal of Honor Allied Assault/imsdox-drkg.rar/imsdox-drkg.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped C:\Documents and Settings\Mike's\Shared\Medal of Honor Allied Assault.zip/Medal of Honor Allied Assault/imsdox-drkg.rar Infected: Trojan-Dropper.Win32.Delf.xo skipped C:\Documents and Settings\Mike's\Shared\Medal of Honor Allied Assault.zip ZIP: infected - 2 skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP415\A0080143.exe/file02 Infected: not-a-virus:AdWare.Win32.Lop.bo skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP415\A0080143.exe/file13 Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP415\A0080143.exe Inno: infected - 2 skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP415\A0083308.exe/file02 Infected: not-a-virus:AdWare.Win32.Lop.bo skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP415\A0083308.exe/file13 Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP415\A0083308.exe Inno: infected - 2 skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP419\A0083972.exe/{E4B12EB2-448D-4A79-8A9D-A571B9D3A08E}.exe/file02 Infected: not-a-virus:AdWare.Win32.Lop.bo skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP419\A0083972.exe/{E4B12EB2-448D-4A79-8A9D-A571B9D3A08E}.exe/file13 Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP419\A0083972.exe/{E4B12EB2-448D-4A79-8A9D-A571B9D3A08E}.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP419\A0083972.exe ZIP: infected - 3 skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP419\A0083991.exe/{BDD6DD19-1C30-4DEE-A64D-7338AABDD6EA}.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP419\A0083991.exe ZIP: infected - 1 skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP427\A0088577.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP427\A0088633.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP427\A0088700.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP427\A0088702.exe Infected: Trojan.Win32.Obfuscated.en skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP428\A0088952.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP429\A0089121.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP429\A0089122.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kw skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP446\A0090930.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP447\A0090943.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP448\A0092629.dll Infected: not-a-virus:AdWare.Win32.Agent.dy skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP448\A0092638.dll Infected: not-a-virus:AdWare.Win32.TrafficSol.h skipped C:\System Volume Information\_restore{61DBCC71-BDE4-42DC-8125-D0B131F91C83}\RP455\change.log Object is locked skipped C:\unzipped\Medal of Honor Allied Assault\Medal of Honor Allied Assault\imsdox-drkg.rar/imsdox-drkg.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped C:\unzipped\Medal of Honor Allied Assault\Medal of Honor Allied Assault\imsdox-drkg.rar RAR: infected - 1 skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\dwdsrngt.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\tmp35.tmp.dll Infected: Trojan.Win32.BHO.bd skipped C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{360818AD-27AB-4193-B090-D4A02BA64C99}.exe/{360818AD-27AB-4193-B090-D4A02BA64C99}.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.TrafficSol.h skipped C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{360818AD-27AB-4193-B090-D4A02BA64C99}.exe/{360818AD-27AB-4193-B090-D4A02BA64C99}.exe/stream Infected: not-a-virus:AdWare.Win32.TrafficSol.h skipped C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{360818AD-27AB-4193-B090-D4A02BA64C99}.exe/{360818AD-27AB-4193-B090-D4A02BA64C99}.exe Infected: not-a-virus:AdWare.Win32.TrafficSol.h skipped C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{360818AD-27AB-4193-B090-D4A02BA64C99}.exe ZIP: infected - 3 skipped C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{E5F5725E-82C4-410A-B41D-D818C66E5703}.exe/{E5F5725E-82C4-410A-B41D-D818C66E5703}.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{E5F5725E-82C4-410A-B41D-D818C66E5703}.exe ZIP: infected - 1 skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\TMP0000004D68EF82BF8865CDDE Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\_OTMoveIt\MovedFiles\windows\system32\lqdsrngo.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped Scan process completed.
Post #13
Hi elloquito,

I need you to use OTMoveIt again as I showed you earlier to move the following files.

C:\Documents and Settings\Mike's\Shared\Medal of Honor Allied Assault.zip
C:\unzipped\Medal of Honor Allied Assault\Medal of Honor Allied Assault\imsdox-drkg.rar
C:\WINDOWS\system32\dwdsrngt.exe
C:\WINDOWS\system32\tmp35.tmp.dll
C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{360818AD-27AB-4193-B090-D4A02BA64C99}.exe
C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{E5F5725E-82C4-410A-B41D-D818C66E5703}.exe
C:\_OTMoveIt\MovedFiles\windows\system32\lqdsrngo.exe


Post the log again also and a new HJT log. Let me know how it's running also.
Post #14
HJS:
Logfile of HijackThis v1.99.1
Scan saved at 7:35:13 PM, on 8/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\keyhook.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live Favorites\wlfsync.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Modules\messmod4\v6\yhexbmes.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by130fd.bay130.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab55579.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

OTMOVE

File/Folder C:\Documents and Settings\Mike's\Shared\Medal of Honor Allied Assault.zip not found.
File/Folder C:\unzipped\Medal of Honor Allied Assault\Medal of Honor Allied Assault\imsdox-drkg.rar not found.
File/Folder C:\WINDOWS\system32\dwdsrngt.exe not found.
File/Folder C:\WINDOWS\system32\tmp35.tmp.dll not found.
File/Folder C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{360818AD-27AB-4193-B090-D4A02BA64C99}.exe not found.
File/Folder C:\WINDOWS\system32\Undo\Manual\{A7708488-F1D6-4B56-8E79-21C96871E471}\{E5F5725E-82C4-410A-B41D-D818C66E5703}.exe not found.
File/Folder C:\_OTMoveIt\MovedFiles\windows\system32\lqdsrngo.exe not found.

Created on 08/15/2007 19:25:04

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI