Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93083 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

[Resolved] Rather Unknown Problem


  • This topic is locked This topic is locked
18 replies to this topic

#1 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 02 September 2007 - 12:46 AM

Right, at first it wasn't a big deal. However, as one could easily guess, it became a problem.

Mostly small stuff; ads, slower cpu-speed etc. However, I'm more worried for the future and want to take care of whatever problem there is now.

HiJackThis Log;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:34:46 AM, on 9/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.mywa...idebar.jsp?p=DE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {082a5fd3-c7a1-44e6-9b56-d09b44ab1811} - C:\WINDOWS\system32\kbdpph.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmp100F.tmp.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\hgdcyv.dll",forkonce
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1175310877265
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.putfile.c...geUploader4.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangoc.../bridge-c24.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinn...v46/wof/wof.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O20 - Winlogon Notify: kbdpph - C:\WINDOWS\SYSTEM32\kbdpph.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://chibiness.net...nterprofile.gif

--
End of file - 10868 bytes
----

Additional AVG Anti-Spy-ware Report;

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 1:22:50 AM 9/2/2007

+ Scan result:



C:\Documents and Settings\toddw\Local Settings\Temp\tmp21.tmp.exe -> Adware.BHO : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp2E.tmp.exe -> Adware.BHO : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp51.tmp.exe -> Adware.BHO : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129182.dll -> Adware.Companion : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{AE84FF0C-BABD-4D91-92A1-AF75D2D02E6D} -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\UDC6_0001_D10M2905\installer.exe -> Adware.Drop : Cleaned with backup (quarantined).
HKU\S-1-5-21-3339368767-1943524517-2558019384-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929CD6E-2062-44A4-B2C5-2C7E78FBAB38} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1104.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpCC1.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpCCA.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpE5E.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpE65.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpEA7.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpEB2.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpF28.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpF38.tmp.exe -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129098.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129101.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129106.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129107.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129108.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129109.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129113.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129114.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129186.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\WINDOWS\system32\kbdpph.dll -> Downloader.ConHook.aa : Cleaned with backup (quarantined).
[216] C:\WINDOWS\system32\kbdpph.dll -> Downloader.ConHook.aa : Cleaned with backup (quarantined).
[836] C:\WINDOWS\system32\kbdpph.dll -> Downloader.ConHook.aa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129185.exe -> Downloader.PurityScan.eg : Cleaned with backup (quarantined).
C:\WINDOWS\system32\ld9F28.tmp -> Downloader.Zlob.ni : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1002.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1005.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp102C.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1036.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1042.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1052.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1054.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1055.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1056.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp105C.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp105D.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1070.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1075.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp108C.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1092.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10A4.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10AF.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10D0.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10DE.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10E7.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10E9.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp11.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1152.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1193.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp11AC.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp11B0.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp11E2.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp123C.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1282.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp12CD.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp134.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1341.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp135A.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp13A7.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp14.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1427.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp143.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp146.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp148A.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp14E8.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp14EE.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1531.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp158.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp21CB.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp2319.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp24E9.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp3858.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp39.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp3911.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp39AA.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp39AB.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp53.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp59.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp64.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp69.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp83.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp84.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp8E.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpA8.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpAE.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpB58.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpB81.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpBB3.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpC84.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpCDD.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpD08.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpE4C.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpE8.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpFB4.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpFFC.tmp.exe -> Dropper.Small : Cleaned with backup (quarantined).
:mozilla.12:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.133:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.13:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.235:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.244:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.252:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.335:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.16:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.463:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.464:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.465:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.56:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.57:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.58:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned.
:mozilla.23:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.24:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.528:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.529:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.60:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.86:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.90:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.91:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.92:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.93:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.564:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.565:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.566:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.567:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.568:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.164:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Hypertracker : Cleaned.
:mozilla.170:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.171:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.188:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned.
:mozilla.533:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Live : Cleaned.
:mozilla.534:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Live : Cleaned.
:mozilla.535:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Live : Cleaned.
:mozilla.514:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.261:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.283:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.282:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned.
:mozilla.587:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.35:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.36:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.37:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.38:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.39:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.40:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.41:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.42:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.43:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.310:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.311:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.315:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.321:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.322:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.323:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.324:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.325:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.326:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.327:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.328:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.454:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.340:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.341:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.342:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.343:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.344:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.79:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.30:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.31:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.32:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.33:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.34:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.355:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.356:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.357:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.358:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.359:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.364:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.365:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.366:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.462:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.516:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Tracking101 : Cleaned.
:mozilla.380:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.381:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.382:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.383:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.384:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.385:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.386:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.387:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.399:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.517:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.448:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.449:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.450:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.451:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.452:C:\Documents and Settings\toddw\Application Data\Mozilla\Firefox\Profiles\fjaucaae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\toddw\Local Settings\Temp\tmp12B3.tmp.exe -> Trojan.Agent.agv : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp136B.tmp.exe -> Trojan.Agent.agv : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp13ED.tmp.exe -> Trojan.Agent.agv : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1489.tmp.exe -> Trojan.Agent.agv : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp15C3.tmp.exe -> Trojan.Agent.agv : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpE3D.tmp.exe -> Trojan.Agent.agv : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp11D.tmp.exe -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp3B.tmp.exe -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpB72.tmp.exe -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpCDB.tmp.exe -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\WINDOWS\system32\tmp1091.tmp.dll -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\WINDOWS\system32\tmp113E.tmp.dll -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\WINDOWS\system32\tmpF29.tmp.dll -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\WINDOWS\system32\tmpFC0.tmp.dll -> Trojan.BHO.bd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129170.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129171.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129172.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129173.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129174.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129175.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129177.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129181.dll -> Trojan.Juan : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp104D.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1139.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1260.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp12E7.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp105E.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp106A.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10B8.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10C3.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp10F5.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1138.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1168.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1169.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1335.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp158D.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp16FE.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmp1F.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpB43.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpB44.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpB78.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpB8B.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpBAC.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpC19.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpC46.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpCA8.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpCF5.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpD66.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpD90.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpDF7.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpE44.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpF7D.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\toddw\Local Settings\Temp\tmpFB0.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP535\A0129097.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned with backup (quarantined).
HKU\S-1-5-21-3339368767-1943524517-2558019384-1006\Software\Classes\CLSID\{35a88e51-b53d-43e9-b8a7-75d4c31b4676} -> Trojan.Small : Cleaned with backup (quarantined).
HKU\S-1-5-21-3339368767-1943524517-2558019384-1006_Classes\CLSID\{35a88e51-b53d-43e9-b8a7-75d4c31b4676} -> Trojan.Small : Cleaned with backup (quarantined).


::Report end

    Advertisements

Register to Remove


#2 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 02 September 2007 - 05:37 AM

Hello and welcome to the forums

With AVG Anti-Spyware, if you click on the Infections icon, then it will show you all the items in Quarrantine and you can remove them that way. Just click Select All then Remove Finally

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick while its running. That may cause it to stall

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#3 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 02 September 2007 - 03:48 PM

Combo Fix;
-----------------

ComboFix 07-08-30.3 - "toddw" 2007-09-02 16:30:21.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.43 [GMT -5:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2007
C:\DOCUME~1\toddw\APPLIC~1\install.dat
C:\DOCUME~1\toddw\APPLIC~1\macromedia\Flash Player\#SharedObjects\KVFZHFHR\www.broadcaster.com
C:\DOCUME~1\toddw\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\toddw\APPLIC~1\WinAntiVirus Pro 2007
C:\DOCUME~1\toddw\err.log
C:\DOCUME~1\toddw\ResErrors.log
C:\DOCUME~1\toddw\STARTM~1\Programs\Startup.\TA_Start.lnk
C:\DOCUME~1\toddw\STARTM~1\Programs\Startup\ta_start.lnk
C:\Program Files\Common Files\WinAntiVirus Pro 2007
C:\temp\17o7
C:\UWA7P
C:\WINDOWS\cookies.ini
C:\WINDOWS\hgdcyv.dll
C:\WINDOWS\hgikjl.ini
C:\WINDOWS\iiijjj.dll
C:\WINDOWS\jjjiii.ini
C:\WINDOWS\jkkmoq.ini
C:\WINDOWS\kknmoq.ini
C:\WINDOWS\ljkigh.dll
C:\WINDOWS\ljkkkl.dll
C:\WINDOWS\lkkkjl.ini
C:\WINDOWS\lopopo.ini
C:\WINDOWS\opopol.dll
C:\WINDOWS\ppqtut.ini
C:\WINDOWS\qomkkj.dll
C:\WINDOWS\qomnkk.dll
C:\WINDOWS\system32\boa.dat
C:\WINDOWS\system32\oqtss.bak1
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\tmp1004.tmp.dll
C:\WINDOWS\system32\tmp1009.tmp.dll
C:\WINDOWS\system32\tmp100A.tmp.dll
C:\WINDOWS\system32\tmp100F.tmp.dll
C:\WINDOWS\system32\tmp1014.tmp.dll
C:\WINDOWS\system32\tmp1017.tmp.dll
C:\WINDOWS\system32\tmp1040.tmp.dll
C:\WINDOWS\system32\tmp1061.tmp.dll
C:\WINDOWS\system32\tmp106B.tmp.dll
C:\WINDOWS\system32\tmp1073.tmp.dll
C:\WINDOWS\system32\tmp10A2.tmp.dll
C:\WINDOWS\system32\tmp10BB.tmp.dll
C:\WINDOWS\system32\tmp10C5.tmp.dll
C:\WINDOWS\system32\tmp10CD.tmp.dll
C:\WINDOWS\system32\tmp10EB.tmp.dll
C:\WINDOWS\system32\tmp110.tmp.dll
C:\WINDOWS\system32\tmp111A.tmp.dll
C:\WINDOWS\system32\tmp115F.tmp.dll
C:\WINDOWS\system32\tmp11B9.tmp.dll
C:\WINDOWS\system32\tmp11F1.tmp.dll
C:\WINDOWS\system32\tmp1218.tmp.dll
C:\WINDOWS\system32\tmp1244.tmp.dll
C:\WINDOWS\system32\tmp1262.tmp.dll
C:\WINDOWS\system32\tmp127C.tmp.dll
C:\WINDOWS\system32\tmp12C8.tmp.dll
C:\WINDOWS\system32\tmp12EE.tmp.dll
C:\WINDOWS\system32\tmp13EE.tmp.dll
C:\WINDOWS\system32\tmp13EF.tmp.dll
C:\WINDOWS\system32\tmp143.tmp.dll
C:\WINDOWS\system32\tmp16A3.tmp.dll
C:\WINDOWS\system32\tmp173.tmp.dll
C:\WINDOWS\system32\tmp19E.tmp.dll
C:\WINDOWS\system32\tmp1AF.tmp.dll
C:\WINDOWS\system32\tmp21BE.tmp.dll
C:\WINDOWS\system32\tmp25.tmp.dll
C:\WINDOWS\system32\tmp2F.tmp.dll
C:\WINDOWS\system32\tmp32.tmp.dll
C:\WINDOWS\system32\tmp33.tmp.dll
C:\WINDOWS\system32\tmp3380.tmp.dll
C:\WINDOWS\system32\tmp33F9.tmp.dll
C:\WINDOWS\system32\tmp3484.tmp.dll
C:\WINDOWS\system32\tmp34DD.tmp.dll
C:\WINDOWS\system32\tmp3563.tmp.dll
C:\WINDOWS\system32\tmp36.tmp.dll
C:\WINDOWS\system32\tmp3604.tmp.dll
C:\WINDOWS\system32\tmp36B5.tmp.dll
C:\WINDOWS\system32\tmp370D.tmp.dll
C:\WINDOWS\system32\tmp38.tmp.dll
C:\WINDOWS\system32\tmp385C.tmp.dll
C:\WINDOWS\system32\tmp39.tmp.dll
C:\WINDOWS\system32\tmp3915.tmp.dll
C:\WINDOWS\system32\tmp39AC.tmp.dll
C:\WINDOWS\system32\tmp3AC8.tmp.dll
C:\WINDOWS\system32\tmp3C77.tmp.dll
C:\WINDOWS\system32\tmp3D02.tmp.dll
C:\WINDOWS\system32\tmp42.tmp.dll
C:\WINDOWS\system32\tmp51.tmp.dll
C:\WINDOWS\system32\tmp7A.tmp.dll
C:\WINDOWS\system32\tmp7F.tmp.dll
C:\WINDOWS\system32\tmp82.tmp.dll
C:\WINDOWS\system32\tmp91.tmp.dll
C:\WINDOWS\system32\tmpA5.tmp.dll
C:\WINDOWS\system32\tmpA6.tmp.dll
C:\WINDOWS\system32\tmpB4B.tmp.dll
C:\WINDOWS\system32\tmpB4F.tmp.dll
C:\WINDOWS\system32\tmpB5D.tmp.dll
C:\WINDOWS\system32\tmpB60.tmp.dll
C:\WINDOWS\system32\tmpB64.tmp.dll
C:\WINDOWS\system32\tmpB6D.tmp.dll
C:\WINDOWS\system32\tmpB70.tmp.dll
C:\WINDOWS\system32\tmpB77.tmp.dll
C:\WINDOWS\system32\tmpBD.tmp.dll
C:\WINDOWS\system32\tmpBE1.tmp.dll
C:\WINDOWS\system32\tmpBF4.tmp.dll
C:\WINDOWS\system32\tmpC45.tmp.dll
C:\WINDOWS\system32\tmpC4E.tmp.dll
C:\WINDOWS\system32\tmpC93.tmp.dll
C:\WINDOWS\system32\tmpD58.tmp.dll
C:\WINDOWS\system32\tmpD61.tmp.dll
C:\WINDOWS\system32\tmpD73.tmp.dll
C:\WINDOWS\system32\tmpDBA.tmp.dll
C:\WINDOWS\system32\tmpE1F.tmp.dll
C:\WINDOWS\system32\tmpE4.tmp.dll
C:\WINDOWS\system32\tmpE66.tmp.dll
C:\WINDOWS\system32\tmpECB.tmp.dll
C:\WINDOWS\system32\tmpF38.tmp.dll
C:\WINDOWS\system32\tmpF60.tmp.dll
C:\WINDOWS\system32\tmpF9.tmp.dll
C:\WINDOWS\tutqpp.dll
C:\WINDOWS\vycdgh.ini


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\LEGACY_FOPN


((((((((((((((((((((((((( Files Created from 2007-08-02 to 2007-09-02 )))))))))))))))))))))))))))))))


2007-09-02 16:23 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-09-02 00:02 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-01 22:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-01 22:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-01 22:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-20 00:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-08-19 23:46 <DIR> d-------- C:\Program Files\uTorrent
2007-08-07 13:58 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-07 05:36 1,156 --a------ C:\WINDOWS\mozver.dat


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-02 01:34 --------- d-------- C:\Program Files\Trend Micro
2007-09-02 00:11 --------- d-------- C:\Program Files\Dl_cats
2007-09-01 22:16 --------- d-------- C:\Program Files\Lavasoft
2007-08-30 23:02 --------- d-------- C:\DOCUME~1\toddw\APPLIC~1\Skype
2007-08-20 20:04 --------- d-------- C:\DOCUME~1\toddw\APPLIC~1\uTorrent
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll
2007-07-19 01:59 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 18:31 765952 --a------ C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-11 14:37 6272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-27 09:34 823808 --a------ C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 09:34 671232 --a------ C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 09:34 6058496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 09:34 52224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 09:34 477696 --a------ C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 09:34 459264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 09:34 44544 --------- C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 09:34 384512 --------- C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 09:34 383488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 09:34 27648 --a------ C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 09:34 267776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 09:34 232960 --------- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 09:34 230400 --------- C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 09:34 193024 --a------ C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 09:34 153088 --------- C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 09:34 132608 --a------ C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 09:34 124928 --------- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 09:34 1152000 --a------ C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 09:34 105984 --------- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 09:34 102400 --------- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 03:27 63488 --------- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 03:27 625152 --------- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 03:27 13824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 02:00 161792 --------- C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 01:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-26 01:08 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 08:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-19 08:31 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 05:23 1033216 --a------ C:\WINDOWS\explorer.exe
2007-06-13 05:23 1033216 --------- C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-11 23:51 10834944 --a------ C:\WINDOWS\system32\dllcache\wmp.dll
2005-11-03 18:29 72832 -ra------ C:\WINDOWS\inf\CamAvb.sys
2006-03-28 00:23:14 104 --sh--r C:\WINDOWS\system32D5C5BFC2A.sys
2006-03-28 00:23:14 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{082a5fd3-c7a1-44e6-9b56-d09b44ab1811}]
2006-06-09 09:59 27648 --------- C:\WINDOWS\system32\kbdpph.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 20:42]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-12-13 07:21]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-13 07:22]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2005-08-30 17:30]
"Dell Photo AIO Printer 922"="C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" [2004-11-10 14:36]
"DLBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2004-11-09 16:41]
"AlfaCleaner"="C:\Program Files\AlfaCleaner\AlfaCleaner.exe" []
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 06:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 06:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 06:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 06:00]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-08 19:17]
"NWEReboot"="" []
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 15:29]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2006-04-11 19:39]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-07-29 19:34]
"AIM"="C:\Program Files\AIM\aim.exe" [2005-08-05 16:08]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-06-12 17:33]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]

C:\DOCUME~1\toddw\STARTM~1\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-11-17 01:00:00]
Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-11-17 01:00:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kbdpph]
kbdpph.dll 2006-06-09 09:59 27648 C:\WINDOWS\system32\kbdpph.dll

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys
S3 CamAv;SAMSUNG Video Capture;C:\WINDOWS\system32\Drivers\CamAv.sys
S3 CAMFLT;%CAMFLT.SvcDesc%;C:\WINDOWS\system32\drivers\CAMFLT.sys
S3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys
S3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-02 16:39:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-02 16:44:49 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-02 16:44

--- E O F ---


~~~
HiJackThis;
~~~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:46:14 PM, on 9/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.mywa...idebar.jsp?p=DE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {082a5fd3-c7a1-44e6-9b56-d09b44ab1811} - C:\WINDOWS\system32\kbdpph.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1175310877265
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.putfile.c...geUploader4.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangoc.../bridge-c24.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinn...v46/wof/wof.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O20 - Winlogon Notify: kbdpph - C:\WINDOWS\SYSTEM32\kbdpph.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://chibiness.net...nterprofile.gif

--
End of file - 10659 bytes

#4 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 02 September 2007 - 03:54 PM

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\kbdpph.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{082a5fd3-c7a1-44e6-9b56-d09b44ab1811}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kbdpph]


Save this as Save this as "CFScript"


Posted Image

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#5 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 02 September 2007 - 07:57 PM

ComboFix 07-08-30.3 - "toddw" 2007-09-02 20:41:45.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.66 [GMT -5:00]
Command switches used :: C:\Documents and Settings\toddw\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\kbdpph.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\kbdpph.dll


((((((((((((((((((((((((( Files Created from 2007-08-03 to 2007-09-03 )))))))))))))))))))))))))))))))


2007-09-02 16:23 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-09-02 00:02 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-01 22:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-01 22:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-01 22:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-20 00:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-08-19 23:46 <DIR> d-------- C:\Program Files\uTorrent
2007-08-07 13:58 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-07 05:36 1,156 --a------ C:\WINDOWS\mozver.dat


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-02 01:34 --------- d-------- C:\Program Files\Trend Micro
2007-09-02 00:11 --------- d-------- C:\Program Files\Dl_cats
2007-09-01 22:16 --------- d-------- C:\Program Files\Lavasoft
2007-08-30 23:02 --------- d-------- C:\DOCUME~1\toddw\APPLIC~1\Skype
2007-08-20 20:04 --------- d-------- C:\DOCUME~1\toddw\APPLIC~1\uTorrent
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll
2007-07-19 01:59 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 18:31 765952 --a------ C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-11 14:37 6272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-27 09:34 823808 --a------ C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 09:34 671232 --a------ C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 09:34 6058496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 09:34 52224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 09:34 477696 --a------ C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 09:34 459264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 09:34 44544 --------- C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 09:34 384512 --------- C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 09:34 383488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 09:34 27648 --a------ C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 09:34 267776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 09:34 232960 --------- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 09:34 230400 --------- C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 09:34 193024 --a------ C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 09:34 153088 --------- C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 09:34 132608 --a------ C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 09:34 124928 --------- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 09:34 1152000 --a------ C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 09:34 105984 --------- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 09:34 102400 --------- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 03:27 63488 --------- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 03:27 625152 --------- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 03:27 13824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 02:00 161792 --------- C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 01:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-26 01:08 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 08:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-19 08:31 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 05:23 1033216 --a------ C:\WINDOWS\explorer.exe
2007-06-13 05:23 1033216 --------- C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-11 23:51 10834944 --a------ C:\WINDOWS\system32\dllcache\wmp.dll
2005-11-03 18:29 72832 -ra------ C:\WINDOWS\inf\CamAvb.sys
2006-03-28 00:23:14 104 --sh--r C:\WINDOWS\system32D5C5BFC2A.sys
2006-03-28 00:23:14 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 20:42]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-12-13 07:21]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-13 07:22]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2005-08-30 17:30]
"Dell Photo AIO Printer 922"="C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" [2004-11-10 14:36]
"DLBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2004-11-09 16:41]
"AlfaCleaner"="C:\Program Files\AlfaCleaner\AlfaCleaner.exe" []
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 06:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 06:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 06:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 06:00]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-08 19:17]
"NWEReboot"="" []
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 15:29]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2006-04-11 19:39]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-07-29 19:34]
"AIM"="C:\Program Files\AIM\aim.exe" [2005-08-05 16:08]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-06-12 17:33]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]

C:\DOCUME~1\toddw\STARTM~1\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-11-17 01:00:00]
Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-11-17 01:00:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys
S3 CamAv;SAMSUNG Video Capture;C:\WINDOWS\system32\Drivers\CamAv.sys
S3 CAMFLT;%CAMFLT.SvcDesc%;C:\WINDOWS\system32\drivers\CAMFLT.sys
S3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys
S3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-02 20:47:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-02 20:52:55 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-02 20:52
C:\ComboFix2.txt ... 2007-09-02 16:44

--- E O F ---

#6 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 02 September 2007 - 08:02 PM

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#7 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 02 September 2007 - 09:33 PM

Currently, I don't see any difference. Save for the speed of my computer has improved enough to be noticeable.
~What led me to believe there was an 'infestation' was that I would have a Pop-up from a virus-detection program in my computer telling me there were threats in my system. I rebooted just a moment ago, but have yet to see any of these pop-ups.
~As I said, I was taking care of this before it became a larger problem.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:35 PM, on 9/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.mywa...idebar.jsp?p=DE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1175310877265
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.putfile.c...geUploader4.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangoc.../bridge-c24.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinn...v46/wof/wof.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://chibiness.net...nterprofile.gif

--
End of file - 10393 bytes

#8 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 03 September 2007 - 06:43 AM

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
MyWaySA


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

Close ALL windows and browsers except HijackThis and click "Fix checked"



You need to update SunJava.
Updating Java:
Download the latest version of Java Runtime Environment (JRE) 6.
  • Scroll down to where it says Java Runtime Environment (JRE) 6u2
    The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the Posted Image icon next to it.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on 6-windowsi586-p.exe to install the newest version.
Once installed you can test to see that it is in fact installed
Sun Java Test
http://www.java.com/...d/installed.jsp

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#9 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 03 September 2007 - 11:24 AM

Programs deleted/uploaded. Not sure what Java is, but it sure is there now. However, while fixing files in HiJackThis; I couldn't find this file on the list; R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll Could it be because I had already deleted it in the Add/Remove Programs list?

#10 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 03 September 2007 - 11:26 AM

Programs deleted/uploaded.

Not sure what Java is, but it sure is there now.

However, while fixing files in HiJackThis; I couldn't find this file on the list;

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll

Could it be because I had already deleted it in the Add/Remove Programs list?

Yes.

Post a new HijackThis log.


Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

    Advertisements

Register to Remove


#11 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 03 September 2007 - 12:14 PM

Currently, it is behaving much better. Speed has increased quite noticeably and I've yet to see any pop-ups regarding an infection. (Even opening Internet Explorer causes no problems)(Note on that; after the problem became a problem, I abandoned IE and switched to Firefox)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:10:55 PM, on 9/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1175310877265
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.putfile.c...geUploader4.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangoc.../bridge-c24.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinn...v46/wof/wof.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://chibiness.net...nterprofile.gif

--
End of file - 9632 bytes

#12 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 03 September 2007 - 12:58 PM

You can remove any programs / Tools I had you install. Use Add/Remove Programs to remove if listed there otherwise just delete them and empty recycle bin.

Log looks good :D


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
    This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
    You should also scan your computer with this program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Download and install Ad-Aware.
    You should also scan your computer with this program on a regular basis
    just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
    settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

    Using IE-SPYAD to help block unwanted sites and activities

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.
Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#13 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 03 September 2007 - 11:41 PM

I appreciate the help! However, when I returned home from work this evening, before getting on Firefox to find your post, there was another of those pop-ups from "Trend Micro PC-cillin," I believe, saying it found malicious software, or something like that. The files were quarantined and I had them deleted. Was this problem solved upon restarting without restore points?

#14 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 04 September 2007 - 05:48 AM

I appreciate the help!

However, when I returned home from work this evening, before getting on Firefox to find your post, there was another of those pop-ups from "Trend Micro PC-cillin," I believe, saying it found malicious software, or something like that. The files were quarantined and I had them deleted. Was this problem solved upon restarting without restore points?

Where did it show the files at?
You should have created a new restore point. Don't run the pc without restore turned on.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#15 ttheboo

ttheboo

    New Member

  • Authentic Member
  • Pip
  • 9 posts

Posted 04 September 2007 - 04:04 PM

Well, I can't quite remember, however, Trend Micro PC-cillin saved a virus log, which I have a screen shot of here;

http://i30.photobuck...ob/Viruslog.png

And in case Photobucket shrank it to an illegible point, here I have a close-up of the location and file-name;

http://i30.photobuck.../Viruslogcu.png

(There was also one other file that appeared just past midnight, so it's listed under today's date.

~And yes, I turned system restore back on after re-starting.

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users