Spyware / Malware / Virus Removal

[Resolved] Please help

112 min read

Looking for the outcome? Ask AI

emmabell22

Post #16January 7, 2008, 3:40 PM UTC

ComboFix 08-01-04.1 - Emma 2008-01-07 15:20:52.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.185 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Emma\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\dccdd.ini
C:\WINDOWS\system32\dccdd.ini2
C:\WINDOWS\system32\jkhhe.exe
C:\WINDOWS\system32\u2g.f
C:\WINDOWS\system32\xxyvwuu.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\jkhhe.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-07 04:31 . 2008-01-07 04:51 d——– C:\Program Files\CCleaner
2008-01-06 15:47 . 2008-01-06 15:47 d–h—– C:\WINDOWS\PIF
2008-01-06 15:37 . 2007-03-06 13:24 55,296 –a—— C:\WINDOWS\system32\drivers\rp_skt32.sys
2008-01-06 15:37 . 2007-04-19 11:36 48,384 –a—— C:\WINDOWS\system32\drivers\rp_pkt32.sys
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Program Files\Raxco
2008-01-06 15:36 . 2008-01-06 15:45 d——– C:\Program Files\Common Files\Scanner
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Program Files\Common Files\Authentium
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Program Files\CA
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Documents and Settings\All Users\Application Data\Raxco
2008-01-06 15:33 . 2008-01-06 15:33 d——– C:\Documents and Settings\Emma\Application Data\InstallShield
2008-01-06 15:31 . 2008-01-06 15:35 d——– C:\Program Files\Virgin Broadband
2008-01-06 15:31 . 2008-01-06 15:49 d——– C:\Documents and Settings\Emma\Application Data\Virgin Broadband
2008-01-06 15:31 . 2008-01-06 15:35 d——– C:\Documents and Settings\All Users\Application Data\Virgin Broadband
2008-01-06 14:17 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-05 21:53 . 2008-01-05 21:54 d——– C:\Program Files\EMCO Malware Destroyer
2008-01-05 21:02 . 2008-01-05 21:02 3,584 –a—— C:\WINDOWS\system32\ddccd.exe
2007-12-29 06:09 . 2007-12-29 09:32 d——– C:\Program Files\Soulseek-Test
2007-12-16 09:46 . 2007-12-16 09:46 d——– C:\Program Files\ZoneAlarmSB
2007-12-14 14:39 . 2007-12-14 14:39 495,104 –a—— C:\WINDOWS\system32\mp3tsshx.dll
2007-12-14 14:37 . 2007-12-14 14:37 d——– C:\Program Files\Magnus Brading

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 15:26 32,587,808 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-07 15:20 ——— d—–w C:\Program Files\mIRC
2008-01-07 08:21 382,748 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-07 08:18 ——— d—–w C:\Program Files\Soulseek
2008-01-07 06:03 ——— d—–w C:\Documents and Settings\Emma\Application Data\shrink_pic
2008-01-07 04:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-07 04:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-06 15:33 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-06 13:41 ——— d—–w C:\Program Files\Winamp
2008-01-06 13:41 ——— d—–w C:\Program Files\REGSHAVE
2008-01-06 13:41 ——— d—–w C:\Program Files\BitTorrent
2008-01-05 20:54 ——— d—–w C:\Program Files\SUPERAntiSpyware
2008-01-05 10:50 ——— d—–w C:\Documents and Settings\Emma\Application Data\AVG7
2008-01-02 07:33 ——— d—–w C:\Program Files\Winamp Remote
2008-01-02 06:48 ——— d—–w C:\Program Files\SpywareBlaster
2007-12-25 17:58 ——— d—–w C:\Documents and Settings\Emma\Application Data\BitTorrent
2007-12-19 17:21 11,165,020 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-19 15:25 ——— d—–w C:\Program Files\Messenger Plus! Live
2007-12-16 16:37 ——— d—–w C:\Documents and Settings\Emma\Application Data\SopCast
2007-12-03 05:45 ——— d—–w C:\Documents and Settings\Emma\Application Data\Azureus
2007-12-01 03:01 ——— d—–w C:\Program Files\Windows Live Toolbar
2007-12-01 03:01 ——— d—–w C:\Program Files\Windows Live Favorites
2007-11-29 12:53 1,772 —-a-w C:\Documents and Settings\Emma\Application Data\wklnhst.dat
2007-11-28 09:51 ——— d—–w C:\Documents and Settings\Robert\Application Data\AVG7
2007-11-26 12:02 ——— d—–w C:\Program Files\VirtualDJ
2007-11-19 06:09 ——— d—–w C:\Program Files\Native Instruments
2007-11-14 16:05 75,248 —-a-w C:\WINDOWS\zllsputility.exe
2007-11-14 16:05 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 17:56 ——— d—–w C:\Program Files\DivX
2007-10-29 22:35 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 17:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-21 18:24 159,744 —-a-w C:\WINDOWS\system32\UCLiveCore.dll
2007-10-21 17:33 241,664 —-a-w C:\WINDOWS\system32\UCLiveSocket.dll
2007-10-20 00:56 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-10-20 00:56 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-10-20 00:56 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-10-20 00:56 129,784 —-a-w C:\WINDOWS\system32\pxafs.dll
2007-10-20 00:56 120,056 —-a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-10-20 00:56 118,520 —-a-w C:\WINDOWS\system32\pxinsi64.exe
2007-10-20 00:56 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-10-20 00:54 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 00:54 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 00:54 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-10-20 00:54 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 00:54 739,840 —-a-w C:\WINDOWS\system32\DivX.dll
2007-10-20 00:54 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-10-18 09:06 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 09:03 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-10-18 09:03 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-10-18 09:03 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 09:03 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-10-18 09:03 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-10-18 09:03 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-10-18 09:02 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-06-02 23:31 17,519,458 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_06_02_15_02_24_full.dmp.zip
2007-04-06 23:03 115,903 —-a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_06_20_06_33_small.dmp.zip
2007-04-06 16:09 117,433 —-a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_06_14_51_29_small.dmp.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 20:06 1135968 –a—— C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-12-16 09:46 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 20:06 1135968]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-16 09:46 262144]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [ ]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [ ]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [ ]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2008-01-07 04:03 5039616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 15:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMan"="SOUNDMAN.EXE" [2006-01-24 14:46 86016 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2006-01-24 14:46 2807808 C:\WINDOWS\ALCWZRD.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-01 12:02 7311360]
"nwiz"="nwiz.exe" [2005-12-01 12:02 1519616 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [ ]
"LWBMOUSE"="C:\Program Files\FSC\Wireless Wheel Mouse\MOUSE32A.EXE" [ ]
"MULTIMEDIA KEYBOARD"="C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe" [ ]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe" [ ]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [ ]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]
"HPHUPD06"="C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [ ]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [ ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"Broadbandadvisor.exe"="C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" [2008-01-07 04:03 2430976]
"PCguard"="C:\Program Files\Virgin Broadband\PCguard\Rps.exe" [2008-01-07 04:03 679424]
"-FreedomNeedsReboot"="C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe" [2008-01-07 04:03 357376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-23 14:33 219136]

C:\Documents and Settings\Emma\Start Menu\Programs\Startup\
Shrink Pic.lnk - C:\Program Files\Shrink Pic\shrink_pic.exe [2007-09-18 20:08:02]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe –force_start_minimized

R1 msikbd2k;Multimedia Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2001-12-20 09:02]
R2 nhksrv;Netropa NHK Server;C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe [2001-08-06 06:41]
S3 Radialpoint Security Services;Virgin Broadband PCguard;C:\WINDOWS\system32\dllhost.exe [2004-08-04 12:00]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-07 07:32:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-07 04:31:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
- C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-07 15:27:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll
.
Completion time: 2008-01-07 15:28:19
ComboFix-quarantined-files.txt 2008-01-07 15:28:14
ComboFix2.txt 2008-01-07 04:20:17
ComboFix3.txt 2008-01-06 15:09:39
.
2007-12-12 03:13:29 — E O F —

emmabell22

Post #17January 7, 2008, 5:29 PM UTC

Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115499.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115500.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115501.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115502.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115503.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116486.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116488.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116489.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116490.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116491.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116492.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116493.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116494.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116495.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116496.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116497.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116498.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116499.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116500.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116501.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116502.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116514.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116560.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116572.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116573.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116574.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116575.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116576.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116577.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116578.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116579.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116580.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116581.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116582.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116583.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116584.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116585.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116586.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116633.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116634.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116635.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116636.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116637.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116638.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116639.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116640.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116641.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116642.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116643.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116644.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116646.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116647.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116648.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116658.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116659.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116660.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116661.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116662.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116663.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116664.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116665.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116666.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116667.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116668.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116669.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116670.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116671.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116672.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116835.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116836.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116837.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116838.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116839.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116840.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116841.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116842.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116843.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116844.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116845.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116846.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116847.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116848.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116849.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117377.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117379.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117486.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117488.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117509.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117510.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117511.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117512.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP212\A0117520.sys Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP213\A0117840.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP213\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\Internet Logs\YOUR-98EB2AFCD0.ldb Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{D4D04FC8-7342-455F-A29C-8B7DE114E873}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\ddccd.exe Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped C:\WINDOWS\system32\drivers\ip6fw.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\ZLT0196e.TMP Object is locked skipped C:\WINDOWS\Temp\ZLT01971.TMP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

emmabell22

Post #18January 7, 2008, 5:32 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 17:31:07, on 07/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Emma\LOCALS~1\Temp\Rar$EX00.688\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://english.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\FSC\Wireless Wheel Mouse\MOUSE32A.EXE
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Startup: Shrink Pic.lnk = C:\Program Files\Shrink Pic\shrink_pic.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/re…es/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5DA9D8E0-5A57-11CF-9E36-00C0930198C0} (Pegasus ImagN' 32-bit (Windowed) ActiveX Control v4.00) - http://www.crownbar.com/LNetCam.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/…gr.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/a…zylomloader.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://sympatico.zone.msn.com/bingame/hsol…WebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames/Check…PA.cab55579.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

bob4

Post #19January 7, 2008, 10:19 PM UTC

Good job on getting Kasperskys running.

Unfortunately the log was cut off early on.
It should start like this:

Kaspersky Log

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Monday, January 07, 2008 1:06:46 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 7/01/2008
Kaspersky Anti-Virus database records: 503378
———————————————————

Please repost the entire log so I'm sure we don't miss anything.
If it's very long use 2 or three posts if you need to.
OR
Use the attachment box below.

emmabell22

Post #20January 8, 2008, 6:14 PM UTC

KASPERSKY ONLINE SCANNER REPORT Tuesday, January 08, 2008 6:12:34 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 8/01/2008 Kaspersky Anti-Virus database records: 504240 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan Statistics Total number of scanned objects 114138 Number of viruses found 7 Number of infected objects 21 Number of suspicious objects 0 Duration of the scan process 01:28:30 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Virgin Broadband\PCguard\Logs\FirewallService01-08-2008–16-26-07.log Object is locked skipped C:\Documents and Settings\Emma\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped C:\Documents and Settings\Emma\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\cert8.db Object is locked skipped C:\Documents and Settings\Emma\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped C:\Documents and Settings\Emma\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\history.dat Object is locked skipped C:\Documents and Settings\Emma\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\key3.db Object is locked skipped C:\Documents and Settings\Emma\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\parent.lock Object is locked skipped C:\Documents and Settings\Emma\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\search.sqlite Object is locked skipped C:\Documents and Settings\Emma\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Emma\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Emma\Desktop\Unused Desktop Shortcuts\mirc621.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\Documents and Settings\Emma\Desktop\Unused Desktop Shortcuts\mirc621.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\Documents and Settings\Emma\Desktop\Unused Desktop Shortcuts\mirc621.exe NSIS: infected - 2 skipped C:\Documents and Settings\Emma\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Application Data\Mozilla\Firefox\Profiles\d365s0x1.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Emma\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Emma\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Emma\My Documents\My Received Files\NewYearsParty(1).zip/Image053.JPEG_ScannedBy-Msn.com Infected: Backdoor.Win32.IRCBot.azd skipped C:\Documents and Settings\Emma\My Documents\My Received Files\NewYearsParty(1).zip ZIP: infected - 1 skipped C:\Documents and Settings\Emma\My Documents\My Received Files\NewYearsParty.zip/Image053.JPEG_ScannedBy-Msn.com Infected: Backdoor.Win32.IRCBot.azd skipped C:\Documents and Settings\Emma\My Documents\My Received Files\NewYearsParty.zip ZIP: infected - 1 skipped C:\Documents and Settings\Emma\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Emma\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Robert\Desktop\WebfettiSetup2.2.60.11.exe/mwsSetup.CommonCodebase.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped C:\Documents and Settings\Robert\Desktop\WebfettiSetup2.2.60.11.exe CAB: infected - 1 skipped C:\ISP\BT_Openworld\Narrowband\Signup\Anytime\signupLt.exe/btwebcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.b skipped C:\ISP\BT_Openworld\Narrowband\Signup\Anytime\signupLt.exe CAB: infected - 1 skipped C:\ISP\BT_Openworld\Narrowband\Signup\Reinstall\SignupLt.EXE/btwebcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.b skipped C:\ISP\BT_Openworld\Narrowband\Signup\Reinstall\SignupLt.EXE CAB: infected - 1 skipped C:\ISP\BT_Openworld\Narrowband\Signup\Standard\SignupLt.exe/btwebcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.b skipped C:\ISP\BT_Openworld\Narrowband\Signup\Standard\SignupLt.exe CAB: infected - 1 skipped C:\Program Files\CA\PPRT\logs\2008-01-08.csv Object is locked skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe Object is locked skipped C:\Program Files\Virgin Broadband\PCguard\Rps.exe Object is locked skipped C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe Object is locked skipped C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\smtpdrv.sys.vir Infected: Email-Worm.Win32.Agent.l skipped C:\QooBox\Quarantine\C\WINDOWS\system32\jkhhe.exe.vir Infected: Trojan-Dropper.Win32.Agent.dgo skipped C:\QooBox\Quarantine\C\WINDOWS\system32\usrserv.exe.vir Infected: Backdoor.Win32.IRCBot.azd skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0114518.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115490.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115491.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115492.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115493.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115494.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115495.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115496.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115497.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115498.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115499.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115500.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115501.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115502.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0115503.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116486.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116488.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116489.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116490.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116491.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116492.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116493.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116494.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116495.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116496.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116497.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116498.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116499.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116500.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116501.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116502.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116514.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116560.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116572.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116573.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116574.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116575.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116576.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116577.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116578.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116579.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116580.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116581.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116582.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116583.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116584.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116585.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116586.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116633.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116634.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116635.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116636.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116637.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116638.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116639.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116640.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116641.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116642.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116643.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116644.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116646.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116647.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116648.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116658.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116659.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116660.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116661.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116662.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116663.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116664.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116665.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116666.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116667.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116668.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116669.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116670.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116671.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP205\A0116672.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116835.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116836.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116837.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116838.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116839.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116840.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116841.EXE Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116842.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116843.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116844.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116845.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116846.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116847.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116848.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP206\A0116849.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117377.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117379.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117486.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP210\A0117488.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117509.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117510.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117511.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP211\A0117512.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP212\A0117520.sys Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP212\A0117521.exe Infected: Backdoor.Win32.IRCBot.azd skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP213\A0117840.exe Object is locked skipped C:\System Volume Information\_restore{0A427C85-0FF1-45CD-B55F-DD5B2C95A885}\RP213\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\Internet Logs\YOUR-98EB2AFCD0.ldb Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\ddccd.exe Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped C:\WINDOWS\system32\drivers\ip6fw.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\ZLT00d9a.TMP Object is locked skipped C:\WINDOWS\Temp\ZLT00d9d.TMP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

bob4

Post #21January 8, 2008, 11:47 PM UTC

I hope we don't need back ups because your still running HJT from a temporary directory.

How to Download, Extract and Run Hijackthis
http://www.nellie2.co.uk/extract.htm

C:\DOCUME~1\Emma\LOCALS~1\Temp\Rar$EX00.688\HijackThis.exe

________________________________________
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\Emma\My Documents\My Received Files\NewYearsParty(1).zip
C:\Documents and Settings\Robert\Desktop\WebfettiSetup2.2.60.11.exe
C:\WINDOWS\Downloaded Program Files\popcaploader.dll

NOTE: This script was done for this user specifically.
DO NOT ATTEMPT TO USE IT IF YOU ARE NOT THIS USER
YOU WILL HURT THE WORKINGS OF YOUR COMPUTER !!.

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.

___________________________________________

I see signs of 2 anti virus programs running.

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe

Running 2 anti virus programs is not advised. They will confilict with each other and provide you with much less protection.
I highly recommend you uninstall one of them through add/remove programs.

_________________________
In your next reply I would like to see:

A new HJT log
The report from Combofix
Let me know how things are running now.

emmabell22

Post #22January 9, 2008, 7:27 PM UTC

Can't seem to find ……. C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe anywhere to uninstall.

ComboFix 08-01-04.1 - Emma 2008-01-09 19:04:09.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.161 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Emma\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\Documents and Settings\Emma\My Documents\My Received Files\NewYearsParty(1).zip
C:\Documents and Settings\Robert\Desktop\WebfettiSetup2.2.60.11.exe
C:\WINDOWS\Downloaded Program Files\popcaploader.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Emma\My Documents\My Received Files\NewYearsParty(1).zip
C:\Documents and Settings\Robert\Desktop\WebfettiSetup2.2.60.11.exe
C:\WINDOWS\Downloaded Program Files\popcaploader.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-09 to 2008-01-09 )))))))))))))))))))))))))))))))
.

2008-01-09 18:56 . 2008-01-09 18:56 d——– C:\WINDOWS\LastGood
2008-01-07 15:45 . 2008-01-07 15:45 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-01-07 15:45 . 2008-01-07 15:45 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-07 04:31 . 2008-01-07 04:51 d——– C:\Program Files\CCleaner
2008-01-06 15:47 . 2008-01-06 15:47 d–h—– C:\WINDOWS\PIF
2008-01-06 15:37 . 2007-03-06 13:24 55,296 –a—— C:\WINDOWS\system32\drivers\rp_skt32.sys
2008-01-06 15:37 . 2007-04-19 11:36 48,384 –a—— C:\WINDOWS\system32\drivers\rp_pkt32.sys
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Program Files\Raxco
2008-01-06 15:36 . 2008-01-06 15:45 d——– C:\Program Files\Common Files\Scanner
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Program Files\Common Files\Authentium
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Program Files\CA
2008-01-06 15:36 . 2008-01-06 15:36 d——– C:\Documents and Settings\All Users\Application Data\Raxco
2008-01-06 15:33 . 2008-01-06 15:33 d——– C:\Documents and Settings\Emma\Application Data\InstallShield
2008-01-06 15:31 . 2008-01-06 15:35 d——– C:\Program Files\Virgin Broadband
2008-01-06 15:31 . 2008-01-06 15:49 d——– C:\Documents and Settings\Emma\Application Data\Virgin Broadband
2008-01-06 15:31 . 2008-01-06 15:35 d——– C:\Documents and Settings\All Users\Application Data\Virgin Broadband
2008-01-06 14:17 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-05 21:53 . 2008-01-05 21:54 d——– C:\Program Files\EMCO Malware Destroyer
2008-01-05 21:02 . 2008-01-05 21:02 3,584 –a—— C:\WINDOWS\system32\ddccd.exe
2007-12-29 06:09 . 2007-12-29 09:32 d——– C:\Program Files\Soulseek-Test
2007-12-16 09:46 . 2007-12-16 09:46 d——– C:\Program Files\ZoneAlarmSB
2007-12-14 14:39 . 2007-12-14 14:39 495,104 –a—— C:\WINDOWS\system32\mp3tsshx.dll
2007-12-14 14:37 . 2007-12-14 14:37 d——– C:\Program Files\Magnus Brading

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 19:08 33,921,056 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-09 18:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-09 07:59 398,300 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-09 07:58 ——— d—–w C:\Program Files\mIRC
2008-01-09 00:33 ——— d—–w C:\Program Files\Soulseek
2008-01-07 06:03 ——— d—–w C:\Documents and Settings\Emma\Application Data\shrink_pic
2008-01-07 04:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-06 15:33 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-06 13:41 ——— d—–w C:\Program Files\Winamp
2008-01-06 13:41 ——— d—–w C:\Program Files\REGSHAVE
2008-01-06 13:41 ——— d—–w C:\Program Files\BitTorrent
2008-01-05 20:54 ——— d—–w C:\Program Files\SUPERAntiSpyware
2008-01-05 10:50 ——— d—–w C:\Documents and Settings\Emma\Application Data\AVG7
2008-01-02 07:33 ——— d—–w C:\Program Files\Winamp Remote
2008-01-02 06:48 ——— d—–w C:\Program Files\SpywareBlaster
2007-12-25 17:58 ——— d—–w C:\Documents and Settings\Emma\Application Data\BitTorrent
2007-12-19 17:21 11,165,020 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-19 15:25 ——— d—–w C:\Program Files\Messenger Plus! Live
2007-12-16 16:37 ——— d—–w C:\Documents and Settings\Emma\Application Data\SopCast
2007-12-03 05:45 ——— d—–w C:\Documents and Settings\Emma\Application Data\Azureus
2007-12-01 03:01 ——— d—–w C:\Program Files\Windows Live Toolbar
2007-12-01 03:01 ——— d—–w C:\Program Files\Windows Live Favorites
2007-11-29 12:53 1,772 —-a-w C:\Documents and Settings\Emma\Application Data\wklnhst.dat
2007-11-28 09:51 ——— d—–w C:\Documents and Settings\Robert\Application Data\AVG7
2007-11-26 12:02 ——— d—–w C:\Program Files\VirtualDJ
2007-11-19 06:09 ——— d—–w C:\Program Files\Native Instruments
2007-11-14 16:05 75,248 —-a-w C:\WINDOWS\zllsputility.exe
2007-11-14 16:05 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 17:56 ——— d—–w C:\Program Files\DivX
2007-10-29 22:35 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 17:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-21 18:24 159,744 —-a-w C:\WINDOWS\system32\UCLiveCore.dll
2007-10-21 17:33 241,664 —-a-w C:\WINDOWS\system32\UCLiveSocket.dll
2007-10-20 00:56 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-10-20 00:56 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-10-20 00:56 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-10-20 00:56 129,784 —-a-w C:\WINDOWS\system32\pxafs.dll
2007-10-20 00:56 120,056 —-a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-10-20 00:56 118,520 —-a-w C:\WINDOWS\system32\pxinsi64.exe
2007-10-20 00:56 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-10-20 00:54 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 00:54 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 00:54 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-10-20 00:54 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 00:54 739,840 —-a-w C:\WINDOWS\system32\DivX.dll
2007-10-20 00:54 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-10-18 09:06 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 09:03 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-10-18 09:03 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-10-18 09:03 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 09:03 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-10-18 09:03 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-10-18 09:03 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-10-18 09:02 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-06-02 23:31 17,519,458 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_06_02_15_02_24_full.dmp.zip
2007-04-06 23:03 115,903 —-a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_06_20_06_33_small.dmp.zip
2007-04-06 16:09 117,433 —-a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_04_06_14_51_29_small.dmp.zip
.

((((((((((((((((((((((((((((( snapshot_2008-01-07_ 4.19.27.65 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 12:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 15:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 15:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-12-16 09:46 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-16 09:46 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [ ]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [ ]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [ ]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 15:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMan"="SOUNDMAN.EXE" [2006-01-24 14:46 86016 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2006-01-24 14:46 2807808 C:\WINDOWS\ALCWZRD.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-01 12:02 7311360]
"nwiz"="nwiz.exe" [2005-12-01 12:02 1519616 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [ ]
"LWBMOUSE"="C:\Program Files\FSC\Wireless Wheel Mouse\MOUSE32A.EXE" [ ]
"MULTIMEDIA KEYBOARD"="C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe" [ ]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe" [ ]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [ ]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]
"HPHUPD06"="C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [ ]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [ ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [ ]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"Broadbandadvisor.exe"="C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" [2008-01-07 04:03 2430976]
"PCguard"="C:\Program Files\Virgin Broadband\PCguard\Rps.exe" [2008-01-07 04:03 679424]
"-FreedomNeedsReboot"="C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe" [2008-01-07 04:03 357376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-23 14:33 219136]

C:\Documents and Settings\Emma\Start Menu\Programs\Startup\
Shrink Pic.lnk - C:\Program Files\Shrink Pic\shrink_pic.exe [2007-09-18 20:08:02]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe –force_start_minimized

R1 msikbd2k;Multimedia Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2001-12-20 09:02]
R2 nhksrv;Netropa NHK Server;C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe [2001-08-06 06:41]
S3 Radialpoint Security Services;Virgin Broadband PCguard;C:\WINDOWS\system32\dllhost.exe [2004-08-04 12:00]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-09 07:32:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-09 04:31:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
- C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 19:09:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll
.
Completion time: 2008-01-09 19:10:17
ComboFix-quarantined-files.txt 2008-01-09 19:10:14
ComboFix2.txt 2008-01-07 15:28:20
ComboFix3.txt 2008-01-07 04:20:17
ComboFix4.txt 2008-01-06 15:09:39
.
2007-12-12 03:13:29 — E O F —

emmabell22

Post #23January 9, 2008, 7:29 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 19:28:58, on 09/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Emma\LOCALS~1\Temp\Rar$EX00.953\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://english.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\FSC\Wireless Wheel Mouse\MOUSE32A.EXE
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - Startup: Shrink Pic.lnk = C:\Program Files\Shrink Pic\shrink_pic.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/re…es/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5DA9D8E0-5A57-11CF-9E36-00C0930198C0} (Pegasus ImagN' 32-bit (Windowed) ActiveX Control v4.00) - http://www.crownbar.com/LNetCam.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/…gr.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/a…zylomloader.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://sympatico.zone.msn.com/bingame/hsol…WebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames/Check…PA.cab55579.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

emmabell22

Post #24January 9, 2008, 7:31 PM UTC

Things seem to be running much more smoothly now. PC is behaving itself much more appropriately. Thank you for all your help. Is much appreciated.

bob4

Post #25January 9, 2008, 9:47 PM UTC

open CCleaner
click on tools
highlight uninstall

down on the bottom click save to text file.
Save it to your desktop and post
the contents
of that log for me.

emmabell22

Post #26January 9, 2008, 11:14 PM UTC

Yes I can see it now. Ad-Aware 2007 Adobe Reader 8.1.0 Adobe Shockwave Player Authentium AntiVirus SDK - 2 AutoUpdate AVG 7.5 Azureus BitTorrent 5.0.9 BufferChm CCleaner (remove only) CreativeProjects CreativeProjectsTemplates CueTour ÐÂÀËÖ±²¥ Destinations Director DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player EMCO Malware Destroyer eMusic - 50 Free MP3 offer FinePixViewer Ver.4.3 FUJIFILM USB Driver Fujitsu Siemens Wireless Keyboard Fujitsu Siemens Wireless Wheel Mouse Google Desktop Search Google Pack Screensaver Google Toolbar for Internet Explorer Google Updater Gtk+ Runtime Environment 2.10.7-1 Hardcore Lives Tuner Hardwood Solitaire III Lite High Definition Audio Driver Package - KB888111 HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB889527) Hotfix for Windows XP (KB893357) Hotfix for Windows XP (KB896256) Hotfix for Windows XP (KB896344) Hotfix for Windows XP (KB898900) Hotfix for Windows XP (KB900485) Hotfix for Windows XP (KB903234) Hotfix for Windows XP (KB904412) Hotfix for Windows XP (KB906569) Hotfix for Windows XP (KB907865) Hotfix for Windows XP (KB908673) Hotfix for Windows XP (KB910728) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB935448) HP Diagnostic Assistant HP Image Zone 4.0 HP Software Update HPSystemDiagnostics InstantShare InterVideo WinDVD Java™ 6 Update 2 Java™ 6 Update 3 Java™ SE Runtime Environment 6 Kaspersky Online Scanner Macromedia Flash Player 8 Magic DVD Ripper V5.0.1 Map Button (Windows Live Toolbar) Messenger Plus! 3 Messenger Plus! Live Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Standard Edition 2003 Microsoft User-Mode Driver Framework Feature Pack 1.5 Microsoft Works mIRC Mozilla Firefox (2.0.0.11) Mp3-Tag Studio 3.05 MSXML 4.0 SP2 (KB936181) Native Instruments Service Center Native Instruments Traktor DJ Studio 3 Nero BurnRights Nero Digital Nero OEM NeroVision Express Content Nokia Connectivity Cable Driver Nokia PC Suite NVIDIA Drivers OneCare Advisor (Windows Live Toolbar) Overland PC Connectivity Solution PerfectDisk PhotoGallery Photosmart 320,370,7400,8100,8400 Series Popup Blocker (Windows Live Toolbar) PPSDKRedistributables PrintScreen PS7400 PSPrinters06 QFolder QuickProjects Radialpoint Security Services RAW FILE CONVERTER LE RealPlayer Realtek High Definition Audio Driver Rhapsody Player Engine RPS Ad Blocker RPS AntiFraud RPS AntiSpyware RPS AntiVirus RPS App Detector RPS AsRealtime RPS Backup RPS Burn RPS Diagnostic Utility RPS Firewall RPS ParentalControl RPS Performance Tool RPS PopupBlocker RPS Privacy Manager RPS RpsCore RPS Security Cleanup RPS Zip SAMSUNG CDMA Modem Driver Set SAMSUNG Mobile USB Modem 1.0 Software SAMSUNG Mobile USB Modem Software Samsung PC Studio Secure Game Player Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900930) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944653) Shrink Pic (remove) SkinsHP1 Smart Menus (Windows Live Toolbar) SoftV92 Data Fax Modem with SmartCP Software Update for Web Folders SopCast 1.1.2 SoulSeek Client 156c Spybot - Search & Destroy 1.4 SpywareBlaster v3.5.1 TrayApp Unload Update for Windows XP (KB896427) Update for Windows XP (KB897663) Update for Windows XP (KB898461) Update for Windows XP (KB904942) Update for Windows XP (KB908521) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Virgin Broadband advisor 1.5.14 Virgin Broadband PCguard Virtual DJ - Atomix Productions Vodafone 804SS USB driver Software WebFldrs XP WebReg Winamp Winamp Remote Windows Driver Package - Nokia (WUDFRd) WPD (11/03/2006 6.82.26.2) Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1) Windows Genuine Advantage Notifications (KB905474) Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Favorites for Windows Live Toolbar Windows Live installer Windows Live Messenger Windows Live Outlook Toolbar (Windows Live Toolbar) Windows Live Sign-in Assistant Windows Live Toolbar Windows Live Toolbar Extension (Windows Live Toolbar) Windows Live Toolbar Feed Detector (Windows Live Toolbar) Windows Media Format 11 runtime Windows Media Player 11 Windows Messenger 5.1 Windows Messenger 5.1 MUI Pack Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883529 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB884018 Windows XP Hotfix - KB884575 Windows XP Hotfix - KB884868 Windows XP Hotfix - KB884883 Windows XP Hotfix - KB885523 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885855 Windows XP Hotfix - KB885894 Windows XP Hotfix - KB886677 Windows XP Hotfix - KB886716 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB887797 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB888402 Windows XP Hotfix - KB889016 Windows XP Hotfix - KB889673 Windows XP Hotfix - KB890831 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891220 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB892627 Windows XP Hotfix - KB893056 Windows XP Hotfix - KB896626 WinRAR archiver XviD 1.1 final uninstall Yahoo! Extras Yahoo! Internet Mail Yahoo! Messenger Yahoo! Photos Easy Upload Tool 1v7 Yahoo! Toolbar ZoneAlarm For information, the PC guard package I have has firewall & antivirus disabled, so as not to conflct. Hope we are getiing there.

bob4

Post #27January 10, 2008, 1:44 AM UTC

OK.. We really are almost there.

Having PC guard disabled would be fine… But in your last log I saw this :

C:\Program Files\Virgin Broadband\PCguard\Fws.exe

This is infact part of PC guard Internet security you think you have disabled.
And listed in the running process section of HJT tells me it's running..

Heres what I would do if I were you. I know I need only one good anti virus and one good firewall. So theres no reason to slow my computer down with extra programs
I don't need or use. Especially ones like anti virus and firewalls that are hard on system resources.

I would remove the others that I do not want through add/remove programs.

If you happy with Zone alarm you may keep that and 1 Anti virus.

__________________________________
Heres what you have installed in the way of Anti virus programs.

Authentium AntiVirus SDK - 2

AVG 7.5

Radialpoint Security Services

Two (2) of these need to go.

__________________________________

Also remove this.

Java™ 6 Update 2 <<<<< You have update 3 so you no longer need this one.

___________________________

Messenger Plus! (MessengerPlus2, MessengerPlus3) (MP) is an add-on for Microsoft's free messaging programs Windows Messenger and MSN Messenger. It is a 'free' download (with a few stingers in its tail). MP includes an optional Sponsor Program provided by C2Media. The Sponsor Program is commonly known in the anti-spyware and adware world as 'Lop' or 'Lop.com'. There has been a problem since Messenger Plus! first started including the Sponsor Program in approximately May 2003, with users installing the Sponsor Program without understanding what the Sponsor Program is, what it does to a user's system, or the privacy implications involved.

Messenger Plus!, if installed to include the 'sponsor program', will install adware on your computer that generates pop up windows. The Sponsor Program will also change your home page, your search engine settings, place numerous links in IE favorites (including online casino and gambling links) and place more links on your desktop. The search toolbar that is installed cannot be turned off. The pop up advertising windows will appear even if you are running IE's pop-up blocker. This is because the Sponsor Program adds its advertisement URLs to the pop-up blocker exclusion list. If you want to reinstall MessengerPlus3, make sure you click "I refuse, do not install the sponsor program".

__________________________________________

Any Idea at all what this program is ??

ÐÂÀËÖ±²¥ ?
It's listed in your add/remove programs. If you didn't place it there and you don't know what it is I would remove this also. Just don't like the looks of it.

__________________________________________

Do your best to get all this done and post one last HJT log and assure me things are still running OK.
Then I will have 1 last post to clean things up a bit.

emmabell22

Post #28January 10, 2008, 2:07 AM UTC

On it. Gimme 5 mins.

emmabell22

Post #29January 10, 2008, 2:21 AM UTC

Okies. I have removed PC Guard altogether & Java update 2 via add / remove.
Authentium & Radialpoint via CCCleaner, coz they neva showed on add / remove.
Also neva had the sponsor prog, coz I refused it, for messenger plus, but have got rid of Plus, anyway.
Other than that, things, seem good & I look forward to a clean bill of health………………………….

Logfile of HijackThis v1.99.1
Scan saved at 02:16, on 2008-01-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Emma\LOCALS~1\Temp\Rar$EX02.078\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://english.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\FSC\Wireless Wheel Mouse\MOUSE32A.EXE
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: Shrink Pic.lnk = C:\Program Files\Shrink Pic\shrink_pic.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/re…es/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5DA9D8E0-5A57-11CF-9E36-00C0930198C0} (Pegasus ImagN' 32-bit (Windowed) ActiveX Control v4.00) - http://www.crownbar.com/LNetCam.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/…gr.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/a…zylomloader.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://sympatico.zone.msn.com/bingame/hsol…WebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames/Check…PA.cab55579.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

bob4

Post #30January 10, 2008, 2:36 AM UTC

Authentium & Radialpoint via CCCleaner, coz they neva showed on add / remove.

Radialpoint Security Services

Is in your add/remove list.

What do you mean you removed it through ccleaner ?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Please help

✨ Ask AI

Ask AI