This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

C:, D:, G:, F: = "Unknown File Type - Plz select a program to ope

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

After thinking a drive was clean (latest Norton Defs on my Mac and fully scanned it with no hits), brought it to work. Everything looked fine for 5 minutes…. then the drive letter icon did the same thing that's happening now when I click on any root disk icon at home: a dialog box pops up like it is an unknown file type instead of navigating to the contents of the drive. grrr. Fortunately the drive's contents are still there and can be found, navigated to, viewed and modified using the search feature of Windows Explorer. But, I think this constitutes a big problem that Norton (on my Mac), Symantec Corporate (on my home PC), and TrendMicro ウイルスバスター (on My work PC) are NOT fining. *note: home and work PCs are running Japanese windows*
(I will post logs from home ASAP)

Logfile from work -

Logfile of HijackThis v1.99.1
Scan saved at 13:04:15, on 2007/10/22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Justsystem\JSLIB32\JSQSF32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\conime.exe
C:\Mozilla Firefox\firefox.exe
C:\Hijackthis\HijackThis.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: リサーチ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.fmworld.net/biz/fmv/?fmwbfrom=pc_default
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136272828140
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
All right, back online (at the doctor's office… wifi.. who knew) after being under the weather myself yesterday. The hijackthis log from home is much longer and hopefully more revealing… but I don't see it on my portable drive so it will be in my NEXT post. Since I am online I will post some new screen captures of error messages from my PC at home. Also, I want to note that the original poinnt of infection was a CF card in my digital camera, plugged into a comprimized PC in a hostel in Taipei. This CF card showed a file called Flashy.exe and the other directory names (DCIM and MISC) were masked by files of the same name that a Norton scan on my Mac found as "the macro or PC virus W32.Glupzy.A" quarantined, and deleted… however, it did not find any isue with a autorun.inf file that I tried to delete and quarantine to no sucess. The Autorun.inf file contained (and still contains - as I still CANNOT delete it without it coming back) these instructions: [AutoRun] open=ntdelect.com ;shell\open=Open(&O) shell\open\Command=ntdelect.com shell\open\Default=1 ;shell\explore=Manager(&X) shell\explore\Command=ntdelect.com
I cannot see a ntdelect.com file on my portable drive in OSX and XP. Perhaps it was removed during the Symantec Corperate scan on my PC (results shown in attached .png - W32.Gammima.AG). I do not know what keeps the mac OS from altering, quarantining, or deleting Autorun.inf and any copy of Autorun.inf that exists on my portable drive, nor do I understand why XP seems to delete it without any problem, but it reappears when the drive is viewed in OSX.

Finally, and perhaps most confusingly a "System Volume Information" folder appears on the portable drive now (only) when viewed in OSX, it holds a folder named "_restore{87D6F8BF-9D79-4695-97F6-AA1F5A3B5545}" even though I THOUGHT I turned off system restore in XP, it holds a folder called "RP623", which holds 8 files:

A0053383.INF
[AutoRun]
open=ntdelect.com
;shell\open=Open(&O)
shell\open\Command=ntdelect.com
shell\open\Default=1
;shell\explore=Manager(&X)
shell\explore\Command=ntdelect.com

A0053384.INF
[AutoRun]
open=ntdelect.com
;shell\open=Open(&O)
shell\open\Command=ntdelect.com
shell\open\Default=1
;shell\explore=Manager(&X)
shell\explore\Command=ntdelect.com

change.log.1
ÔÕ´Ï\Device\HarddiskVolume4\System Volume Information\_restore{87D6F8BF-9D79-4695-97F6-AA1F5A3B5545}\RP623\change.log∏ÔÕ´@ˇˇˇˇΩ*&\._AUTORUN.INF,\Recycled\Df1.INF"	_AUTOR~1.INF∏pÔÕ´!æ*,\AUTORUN copy.INFpæÔÕ´@ˇˇˇˇø*,\AUTORUN copy.INF,\Recycled\Df2.INF"	AUTORU~1.INFætÔÕ´!¿*0\AUTORUN copy 1.INFt¬ÔÕ´@ˇˇˇˇ¡*0\AUTORUN copy 1.INF,\Recycled\Df3.INF"	AUTORU~3.INF¬∫ÔÕ´»*4\Recycled\desktop.ini"A0053381.ini 	DESKTOP.INI∫™ÔÕ´ …*,\Recycled\Df1.INF"A0053382.INF	DF1.INF™pÔÕ´! *,\Recycled\Df2.INFp™ÔÕ´ À*,\Recycled\Df2.INF"A0053383.INF	DF2.INF™pÔÕ´!Ã*,\Recycled\Df3.INFp™ÔÕ´ Õ*,\Recycled\Df3.INF"A0053384.INF	DF3.INF™xÔÕ´ ˇˇˇˇŒ*4\Recycled\desktop.inix`ÔÕ´œ*\Recycled`xÔÕ´ˇˇˇˇÁ*4\Recycled\desktop.inixxÔÕ´ ˇˇˇˇË*4\Recycled\desktop.inix|ÔÕ´ ˇˇˇˇÌ*8\avg75free_488a1157.exe|xÔÕ´ˇˇˇˇÙ*4\Recycled\desktop.inixxÔÕ´ ˇˇˇˇı*4\Recycled\desktop.inix

A0053381.INI
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}

A0053411.INI
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}

CHANGE.LOG
ÔÕ´Ï\Device\HarddiskVolume4\System Volume Information\_restore{87D6F8BF-9D79-4695-97F6-AA1F5A3B5545}\RP623\change.log^Ôմϡˇˇw+\∞eW0D0’0©0Î0¿0^úÔÕ´ˇˇˇˇx+\∞eW0D0’0©0Î0¿0*\New Virus Stuff	∞eW0D0~1ú˛ÔÕ´@ˇˇˇˇy+<\spybotsd_newest-defs.exe\\New Virus Stuff\spybotsd_newest-defs.exe"	SPYBOT~3.EXE˛÷ÔÕ´@ˇˇˇˇz+(\spybotsd15.exeH\New Virus Stuff\spybotsd15.exe"	SPYBOT~1.EXE÷RÔÕ´@ˇˇˇˇ{+f\Windows-KB890830-V1.34-malicious-soft-rem.exeÜ\New Virus Stuff\Windows-KB890830-V1.34-malicious-soft-rem.exe"	WINDOW~1.EXERˆÔÕ´@ˇˇˇˇ|+8\avg75free_488a1157.exeX\New Virus Stuff\avg75free_488a1157.exe"	AVG75F~1.EXEˆ

change.log.2
ÔÕ´Ï\Device\HarddiskVolume3\System Volume Information\_restore{87D6F8BF-9D79-4695-97F6-AA1F5A3B5545}\RP623\change.loglÔÕ´ ˇˇˇˇ_+(\spybotsd15.exel™ÔÕ´ ˇˇˇˇ`+f\Windows-KB890830-V1.34-malicious-soft-rem.exe™zÔÕ´ ˇˇˇˇc+6\spybotsd_includes.exezÿÔÕ´@ˇˇˇˇd+6\spybotsd_includes.exe<\spybotsd_newest-defs.exe"	SPYBOT~2.EXEÿ∫ÔÕ´o+4\Recycled\desktop.ini"A0053411.ini 	DESKTOP.INI∫xÔÕ´ ˇˇˇˇp+4\Recycled\desktop.inix`ÔÕ´q+\Recycled`

A0053382.INF
	2 R
Additionally there is a "Recycled" folder on the root of my portable drive (when viewed in OSX) that includes two items each time following an instance of use in XP, reguardless of whether I delete any items while using XP. "desktop.ini" and "INFO2" are there. "DESKTOP.INI" read in TextEdit shows:
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}

however, the INFO2 file cannot be read in TextEdit, though it is only 64k (1,358 bytes)…. That's all for now.

Thanks in advance. Apologies for overcomplicating things.
Here is the hijackthis log from home - note - I renamed HijackThis to "Jiznackdat": Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:49:02 PM, on 10/22/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Justsystem\OpenMG BeatJam\Plugin\bgsvclib.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Common Files\Creoapp\MrnTS_Sync5.exe C:\Program Files\Fujitsu\MyMedia\MyMedia Server Tool\MyMediaServer.exe C:\Program Files\Common Files\Panasonic\PSSCore.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Panasonic\TVfunSTUDIO\VrService.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Fujitsu RF comfort keyboard\KPDrv4XP.EXE C:\Program Files\Fujitsu\IndicatorUtility\IndicatorUty.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\Fujitsu\Fujitsu Quick Touch\QuickTouch.exe C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe C:\Program Files\Fujitsu\iNetConDsp\iNetConDsp.exe C:\Program Files\Fujitsu\ÉäÉÇÉRÉìÉ}ÉlÅ[ÉWÉÉÅ[\IRRCManager.exe C:\Program Files\Fujitsu\PowerUtility\schedule\PUSCKAPLEXE.exe C:\Program Files\Fujitsu\PowerUtility\schedule\PUSCDaemon.exe C:\fjuty\wallbtn\FMVLauncher.exe C:\Program Files\Fujitsu\chitose\updatenv.exe C:\Program Files\Fujitsu\MyMedia\MyMedia Server Tool\MyMediaServerHelper.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\vsnpstd.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\Panasonic\TVfunSTUDIO\eTVtimer.exe C:\Program Files\Fujitsu RF comfort keyboard\mmkbd.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\FastStone Capture\FSCapture.exe C:\Documents and Settings\Owner\ÉfÉXÉNÉgÉbÉv\More Virus Stuff\jiznakdat.exe O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {A57EE9D7-0534-496A-B2B0-E95866D0C1B0} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [KPDrv4Xp] "C:\Program Files\Fujitsu RF comfort keyboard\KPDrv4XP.EXE" O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\IndicatorUtility\IndicatorUty.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Fujitsu Quick Touch\QuickTouch.exe O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe O4 - HKLM\..\Run: [INETCONDSP] "C:\Program Files\Fujitsu\iNetConDsp\iNetConDsp.exe" O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32 O4 - HKLM\..\Run: [IRRCManager] C:\Program Files\Fujitsu\?????R?Åg?}?l?[?W???[\IRRCManager.exe O4 - HKLM\..\Run: [PUSCKAPLEXE] C:\Program Files\Fujitsu\PowerUtility\schedule\PUSCKAPLEXE.exe O4 - HKLM\..\Run: [LoadPUSCDaemon] C:\Program Files\Fujitsu\PowerUtility\schedule\PUSCDaemon.exe O4 - HKLM\..\Run: [FMVÉâÉìÉ`ÉÉÅ[] C:\fjuty\wallbtn\FMVLauncher.exe O4 - HKLM\..\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\chitose\updatenv.exe O4 - HKLM\..\Run: [MyMedia Server Helper] "C:\Program Files\Fujitsu\MyMedia\MyMedia Server Tool\MyMediaServerHelper.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Microsoft Excel Ç…ÉGÉNÉXÉ|Å[Ég(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra 'Tools' menuitem: Sun ?I Java ?R?Åg?\?[?? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra button: ???T?[?` - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: msjwwdat - {BAAB02DC-913E-40AA-B9ED-8068DEE42CFA} - C:\Program Files\Microsoft Office\Home Style\JWW\JWWData.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: PUSCSRVC - C:\WINDOWS\SYSTEM32\PUSCSRVC.dll O23 - Service: BeatJam Music Server - HTTP (BeatJamMusicStreamingServer) - Justsystem Corporation - C:\Program Files\Justsystem\BeatJam Music Server\BeatJamHttpService.exe O23 - Service: BeatJam Music Server - UPnP (BeatJamUPnPMusicServer) - Justsystem Corporation - C:\Program Files\Justsystem\BeatJam Music Server\BeatJamUPnPService.exe O23 - Service: B's Recorder GOLD Library Service (bgsvclib) - B.H.A Corporation - C:\Program Files\Justsystem\OpenMG BeatJam\Plugin\bgsvclib.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Morrin Thumbnail Synchronized Service 5 (MrnTS_Sync5) - äîéÆâÔé–ÉÇÅ[ÉäÉì - C:\Program Files\Common Files\Creoapp\MrnTS_Sync5.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: MyMedia Server - DigiOn - C:\Program Files\Fujitsu\MyMedia\MyMedia Server Tool\MyMediaServer.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PSS Core - Matsushita Electric Industry Co., LTD. - C:\Program Files\Common Files\Panasonic\PSSCore.exe O23 - Service: PowerUtility Remote Power Management Service (putlrsrv) - FUJITSU LIMITED - C:\PROGRA~1\Fujitsu\POWERU~1\remote\PUTLRSRV.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: VRService - Matsushita Electric Industrial Co., Ltd. - C:\Program Files\Panasonic\TVfunSTUDIO\VrService.exe – End of file - 10490 bytes
Quick note: some directory names or file names from the hijackthis.log are displayed incorrectly because they were written in Japanese characters. Let me know if this is a problem. Also, i have no idea what to do about my mac… is there anything similar to hijackthis that I can use to scan it? Because I had a rootkit on the drive that I use to transfer info between my XP system and OSX system I downloaded and ran a file called OS-X-Rootkit-Hunter-0.1.dmg but it didn't seem to do anything except open the terminal and wait idly. Additional information in this area greatly appreciated. :blink: That's all I can give 'til I get a reply. Thanks!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI