What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] TrojanDropper.Agent.DGO virus

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I picked this beauty up trying to find a video converter for my new Sony Walkman.

NOD32 found it (too late, alas), but cannot seem to clean it out. The virus actually caused a problem in NOD32, so the systray icon won't display properly unless I reinstall it, but then with each reboot it's gone again.

Also at each reboot, Windows Explorer is telling me that the files in C:\Documents and Settings\Username\Local Settings\Temp are not valid.

Lastly, many of my startup items have been affected (Adobe items, DirectCD, Palm HotSync, etc.). Ad-Aware did seem to find some issues, but even Ad-Aware seemed affected, so I deleted it before finding this forum and doing this HijackThis log. I've also been in the process of removing the remnants of Norton stuff…

Thanks for any help you can give.

Logfile of HijackThis v1.99.1
Scan saved at 9:26:12 AM, on 1/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…age=about:blank
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1125573242171
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers…ll/pinstall.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
Post #2
Hello and Welcome to the forum.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.

Post a new HijackThis Log.
Post #3
Hi, and thanks for responding.

Since I first wrote, I looked at other forums and did a lot of scanning with other programs: SuperAntispyware, AVG, VundoFix. Those removed all they found. One bad dll wouldn't delete, but I was able to add a .bad extension to the end of it. It *seems* that the infection is gone, but I'm not totally sure - there's still a red X for my C: icon, Windows Defender is jacked (should I just remove that?), and when I try to read emails, it wants to install Publisher. I followed your directions, and here's the log:

Logfile of HijackThis v1.99.1
Scan saved at 18:02, on 2008-01-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\OpenBase\bin\openexec.exe
C:\OpenBase\bin\openinfo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…age=about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: metaspinner media GmbH - {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} - D:\Games\Pingu Throw New\IEButtonYetiSportsEBayInterface.dll
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - (no file)
O2 - BHO: {fe51e66d-c6fe-a529-f1b4-c70e208bbf64} - {46fbb802-e07c-4b1f-925a-ef6cd66e15ef} - C:\WINDOWS\system32\jriidjbi.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {C60DBBF3-3588-4430-A9D9-2052E39842E2} - C:\WINDOWS\system32\mllmn.dll (file missing)
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CitiVAN] C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe /dontopenmycards
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1125573242171
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers…ll/pinstall.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: OpenBase Service (openexec) - Unknown owner - C:\\OpenBase/bin/openexec.exe

Thanks again!

Tim
Post #4
Lets see what we're up against.

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #5 last edited
I've followed the directions. ComboFix has been running for almost 1 1/2 hours now. It shows "Completed Stage_29", and the cursor is no longer visible or blinking in the window. I just realized, though, that I did NOT disable NOD32 before running it. Is this normal? Should I quit it and try again, or let it run? Thanks, Tim
Post #6 
Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
It shouldn't run anymore the 20 minutes. Did you do the above?
Post #9
If combofix won't run, do this.

Lets run an F-Secure online scan it will scan for Viruses, Spyware and RootKits:
  • Click HERE
  • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
  • Allow the Active X control to be installed on your computer, then click the Accept button
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
  • When the cleaning option is presented, Uncheck Submit samples to F-Secure
  • Click Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

Note: This scan will only work with Internet Explorer.
You must be logged on a administrator rights to run this scan.
The scan may take a few hours.

Also let me know how the computer is running now.
Post #10
Ok - tried ComboFix again and it ran smoothly. Here's the logs:

ComboFix 08-01-18.5 - Davis Family 2008-01-18 20:17:29.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.624 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mllmn.exe
C:\WINDOWS\system32\nmllm.ini
C:\WINDOWS\system32\nmllm.ini2
C:\WINDOWS\system32\wfrywwcl.ini
C:\WINDOWS\system32\windows

.
((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
.

2008-01-15 22:40 . 2008-01-18 18:02 d——– C:\HJT
2008-01-15 22:32 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-15 12:38 . 2007-12-14 01:59 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-15 12:37 . 2008-01-15 12:37 d——– C:\Program Files\Common Files\Java
2008-01-15 07:35 . 2008-01-15 18:32 d——– C:\VundoFix Backups
2008-01-15 07:33 . 2008-01-18 20:28 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-15 07:33 . 2008-01-15 07:33 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-15 00:08 . 2008-01-15 12:25 d——– C:\Program Files\SUPERAntiSpyware
2008-01-15 00:08 . 2008-01-15 12:25 d——– C:\Documents and Settings\Davis Family\Application Data\SUPERAntiSpyware.com
2008-01-15 00:08 . 2008-01-15 00:08 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-14 21:34 . 2008-01-14 21:34 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-14 17:18 . 2008-01-14 17:18 d——– C:\Program Files\Lavasoft
2008-01-14 17:18 . 2008-01-14 17:18 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-14 17:17 . 2008-01-15 12:25 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-10 00:32 . 2008-01-10 00:32 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2008-01-10 00:26 . 2008-01-10 00:26 d——– C:\Documents and Settings\All Users\Application Data\ESET
2008-01-08 22:08 . 2008-01-08 22:08 41,472 –a—— C:\WINDOWS\system32\fccbyyv.dll.bad
2008-01-05 12:38 . 2008-01-05 12:39 d——– C:\Program Files\K-Lite Codec Pack
2008-01-05 12:38 . 2007-12-04 02:33 682,496 –a—— C:\WINDOWS\system32\divx.dll
2008-01-05 12:38 . 2007-12-24 13:49 7,680 –a—— C:\WINDOWS\system32\ff_vfw.dll
2008-01-05 12:38 . 2007-07-10 17:10 547 –a—— C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-01-05 11:35 . 2008-01-05 12:30 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-05 11:16 . 2008-01-05 11:16 d——– C:\Program Files\Free iPod Video Converter
2008-01-02 18:55 . 2008-01-02 18:55 d——– C:\Documents and Settings\Davis Family\Application Data\Serif
2008-01-02 18:50 . 2008-01-02 18:50 d——– C:\Program Files\Serif
2007-12-26 00:09 . 2008-01-05 12:25 40,737 –a—— C:\WINDOWS\system32\rightonadz-uninst.exe
2007-12-25 23:27 . 2007-12-25 23:43 d——– C:\Documents and Settings\All Users\Application Data\River Past G5
2007-12-25 22:47 . 2006-10-04 09:06 1,197,294 —–c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-12-25 22:47 . 2006-10-04 09:06 764,868 —–c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-12-25 22:47 . 2006-10-04 09:06 217,118 —–c— C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-12-25 22:46 . 2007-12-25 22:46 d——– C:\Program Files\Windows Media Connect 2
2007-12-25 22:43 . 2007-12-25 22:54 d——– C:\WINDOWS\system32\drivers\UMDF
2007-12-25 22:40 . 2007-12-25 22:40 d——– C:\Program Files\Common Files\Sony Shared
2007-12-25 22:32 . 2007-12-25 22:32 d——– C:\WINDOWS\system32\avsplugin
2007-12-25 22:32 . 2004-05-26 20:37 719,872 –a—— C:\WINDOWS\system32\devil.dll
2007-12-25 22:32 . 2006-10-17 22:29 487,479 –a—— C:\WINDOWS\system32\SkinMagic.dll
2007-12-25 22:32 . 2006-12-31 10:16 313,344 –a—— C:\WINDOWS\system32\avisynth.dll
2007-12-25 22:32 . 2007-02-16 07:10 60,273 –a—— C:\WINDOWS\system32\pthreadGC2.dll
2007-12-25 22:22 . 2007-12-25 22:22 98,304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-12-25 22:21 . 2006-07-28 09:30 236,824 –a—— C:\WINDOWS\system32\xactengine2_3.dll
2007-12-25 22:21 . 2006-07-28 09:30 62,744 –a—— C:\WINDOWS\system32\xinput1_2.dll
2007-12-25 22:14 . 2007-12-25 22:14 d——– C:\Program Files\LucasArts
2007-12-21 08:21 . 2007-12-21 08:21 33,800 –a—— C:\WINDOWS\system32\drivers\epfwtdir.sys
2007-12-21 08:20 . 2007-12-21 08:20 30,216 –a—— C:\WINDOWS\system32\drivers\easdrv.sys
2007-12-21 08:19 . 2007-12-21 08:19 39,944 –a—— C:\WINDOWS\system32\drivers\eamon.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-19 01:22 0 —-a-w C:\WINDOWS\system32\drivers\lvuvc.hs
2008-01-15 17:38 ——— d—–w C:\Program Files\Java
2008-01-15 17:34 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-01-15 04:43 ——— d—–w C:\Program Files\Windows Defender
2008-01-11 23:13 ——— d—–w C:\Program Files\LimeWire
2008-01-10 05:49 ——— d—–w C:\Program Files\Norton SystemWorks
2008-01-10 05:48 ——— d—–w C:\Program Files\Symantec
2008-01-10 03:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-06 02:49 ——— d—–w C:\Documents and Settings\Davis Family\Application Data\Skype
2008-01-06 02:48 ——— d—–w C:\Documents and Settings\Davis Family\Application Data\skypePM
2008-01-05 17:37 ——— d—–w C:\Program Files\Common Files\Real
2008-01-05 00:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\Digital Praise
2008-01-05 00:19 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-03 18:43 147,992 —-a-w C:\Documents and Settings\Davis Family\Application Data\GDIPFONTCACHEV1.DAT
2007-12-28 04:06 ——— d—–w C:\Documents and Settings\Davis Family\Application Data\LimeWire
2007-12-26 05:48 ——— d—–w C:\Program Files\Common Files\AOL
2007-12-26 05:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-26 05:16 ——— d—–w C:\Program Files\CDM+ Roommate
2007-12-13 00:48 ——— d—–w C:\Program Files\CDM+ Pro
2007-12-12 04:41 ——— d—–w C:\Program Files\Trillian
2007-12-03 21:09 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-12-02 22:38 ——— d—–w C:\Program Files\Digital Praise
2007-12-01 04:14 ——— d—–w C:\Program Files\FLV Player
2007-11-27 03:43 ——— d—–w C:\Program Files\iTunes
2007-11-27 03:43 ——— d—–w C:\Program Files\iPod
2007-11-27 03:42 ——— d—–w C:\Program Files\QuickTime
2007-11-24 14:33 ——— d—–w C:\Program Files\MSXML 4.0
2007-11-24 04:43 32 —-a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-11-24 04:41 ——— d—–w C:\Program Files\Skype
2007-11-24 04:41 ——— d—–w C:\Program Files\Common Files\Skype
2007-11-24 04:41 ——— d—–w C:\Documents and Settings\All Users\Application Data\Skype
2007-11-24 04:25 ——— d—–w C:\Program Files\Common Files\Logitech
2007-11-24 04:24 ——— d—–w C:\Program Files\Logitech
2007-11-24 04:24 ——— d—–w C:\Program Files\Common Files\Logishrd
2007-11-24 04:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\Logitech
2007-11-23 17:06 ——— d—–w C:\Program Files\Western Digital Technologies
2007-11-08 06:21 12,257 —-a-w C:\Program Files\setuplog.txt
2007-11-08 06:21 11,380 —-a-w C:\Program Files\uninstal.log
2004-07-30 14:56 90,112 —-a-w C:\Program Files\Common Files\PCSBclean.exe
2004-07-26 20:30 291,840 —-a-w C:\Program Files\Common Files\PCSBoff.exe
.
—-a-w		   684,032 2008-01-10 06:00:31  C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD .exe
—-a-w			61,440 2008-01-10 06:00:36  C:\Program Files\Adobe\Adobe Lightroom\apdproxy .exe
—-a-w			40,048 2008-01-10 06:00:40  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
—-a-w		   284,184 2008-01-10 06:00:43  C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper .exe
—-a-w		   244,512 2008-01-10 06:00:54  C:\Program Files\Common Files\Logitech\LComMgr\LVComSX .exe
—-a-w		   949,376 2008-01-10 04:06:56  C:\Program Files\ESET\nod32kui .exe
—-a-w		 1,443,072 2008-01-10 06:01:08  C:\Program Files\ESET\ESET NOD32 Antivirus\egui .exe
—-a-w		   746,520 2008-01-10 06:00:49  C:\Program Files\Logitech\QuickCam10\QuickCam10 .exe
—-a-w			74,832 2008-01-10 05:31:17  C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapw32 .exe
—-a-w		   866,584 2008-01-10 06:00:42  C:\Program Files\Windows Defender\MSASCui .exe
—-a-w		   158,208 2008-01-10 04:07:16  C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig .exe
—-a-w			15,360 2008-01-10 05:32:02  C:\WINDOWS\system32\ctfmon .exe
—-a-w			36,864 2008-01-10 05:31:12  C:\WINDOWS\system32\spool\drivers\w32x86\2\printray .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{46fbb802-e07c-4b1f-925a-ef6cd66e15ef}]
C:\WINDOWS\system32\jriidjbi.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C60DBBF3-3588-4430-A9D9-2052E39842E2}]
C:\WINDOWS\system32\mllmn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe" [ ]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [ ]
"AtiPTA"="atiptaxx.exe" [2006-02-21 19:05 344064 C:\WINDOWS\system32\atiptaxx.exe]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 08:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 04:12 577536 C:\WINDOWS\soundman.exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11 267048]
"CitiVAN"="C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe" [ ]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 08:21 1443072]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

C:\Documents and Settings\Davis Family\Start Menu\Programs\Startup\
HotSync Manager.lnk - C:\Program Files\palmOne\HOTSYNC.EXE [2004-04-13 17:03:10]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\mllmn.exe

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 10:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 10:39]
R1 BIOS;BIOS;C:\WINDOWS\system32\drivers\BIOS.sys [2005-03-16 01:23]
R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\cinemsup.sys [2002-07-19 09:10]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 08:21]
R2 DriverX;DriverX;C:\WINDOWS\system32\drivers\driverx.sys [2001-06-11 21:01]
R2 openexec;OpenBase Service;C:\\OpenBase/bin/openexec.exe [2005-06-19 03:25]
R3 PCX500;Cisco Wireless LAN Adapters Driver;C:\WINDOWS\system32\DRIVERS\pcx500.sys [2001-11-28 09:39]
S1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.sys []
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS []
S3 VIASens;Vinyl Sensaura WDM 3D Audio Driver;C:\WINDOWS\system32\drivers\viasens.sys [2003-11-07 06:07]
S3 Vsp;Vsp;C:\WINDOWS\system32\drivers\Vsp.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-01-15 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-01-08 03:30:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-19 01:26:15 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 20:28:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-18 20:31:10 - machine was rebooted [Davis Family]
ComboFix-quarantined-files.txt 2008-01-19 01:31:08
.
2008-01-11 23:15:43 — E O F —


———————————————————————————————————————————-

Logfile of HijackThis v1.99.1
Scan saved at 8:55:35 PM, on 1/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\OpenBase\bin\openexec.exe
C:\OpenBase\bin\openinfo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…age=about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: metaspinner media GmbH - {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} - D:\Games\Pingu Throw New\IEButtonYetiSportsEBayInterface.dll
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - (no file)
O2 - BHO: {fe51e66d-c6fe-a529-f1b4-c70e208bbf64} - {46fbb802-e07c-4b1f-925a-ef6cd66e15ef} - C:\WINDOWS\system32\jriidjbi.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {C60DBBF3-3588-4430-A9D9-2052E39842E2} - C:\WINDOWS\system32\mllmn.dll (file missing)
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CitiVAN] C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe /dontopenmycards
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1125573242171
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers…ll/pinstall.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: OpenBase Service (openexec) - Unknown owner - C:\\OpenBase/bin/openexec.exe

Thanks!

Tim
Post #11 last edited
We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.


Installing the Recovery Console

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System


[external image: Posted Image]


Download the file & save it as it's originally named, next to ComboFix.exe.



[external image: Posted Image]


Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.
Post #12
All went fine - here's CF_RC.txt: WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /usepmtimer C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
Post #13
You have a few infection which infects legitimate files, it can be a bit of a pain


1. Download RenV.exe by sUBs to your desktop
2. Double click on it to run it
It will search your system drive looking for any modified .exe file and will produce a log for you.
3. Please copy and paste this report to your reply
Post #14
Here's the log from RenV.exe:

Ran on Fri 01/18/2008 - 21:17:58.53

—-a-w		   684,032 2008-01-10 06:00:31  C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD .exe
—-a-w			61,440 2008-01-10 06:00:36  C:\Program Files\Adobe\Adobe Lightroom\apdproxy .exe
—-a-w			40,048 2008-01-10 06:00:40  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
—-a-w		   284,184 2008-01-10 06:00:43  C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper .exe
—-a-w		   244,512 2008-01-10 06:00:54  C:\Program Files\Common Files\Logitech\LComMgr\LVComSX .exe
—-a-w		   949,376 2008-01-10 04:06:56  C:\Program Files\ESET\nod32kui .exe
—-a-w		 1,443,072 2008-01-10 06:01:08  C:\Program Files\ESET\ESET NOD32 Antivirus\egui .exe
—-a-w		   746,520 2008-01-10 06:00:49  C:\Program Files\Logitech\QuickCam10\QuickCam10 .exe
—-a-w			74,832 2008-01-10 05:31:17  C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapw32 .exe
—-a-w		   866,584 2008-01-10 06:00:42  C:\Program Files\Windows Defender\MSASCui .exe
—-a-w		   158,208 2008-01-10 04:07:16  C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig .exe
—-a-w			15,360 2008-01-10 05:32:02  C:\WINDOWS\system32\ctfmon .exe
—-a-w			36,864 2008-01-10 05:31:12  C:\WINDOWS\system32\spool\drivers\w32x86\2\printray .exe

 Entries:			   13  (13)
 Directories:			0  Files:			13
 Bytes:		  5,605,032  Blocks:	   10,953

This all looks like startup items - if so, doesn't sound like fun…
Post #15
  • Copy the entire contents of the Code Box below to Notepad.
  • Name the file as Log.txt (Overwrite the existing one)
  • Change the Save as Type to All Files
  • and Save it on the desktop
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD .exe
C:\Program Files\Adobe\Adobe Lightroom\apdproxy .exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper .exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX .exe
C:\Program Files\ESET\nod32kui .exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui .exe
C:\Program Files\Logitech\QuickCam10\QuickCam10 .exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapw32 .exe
C:\Program Files\Windows Defender\MSASCui .exe
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig .exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\spool\drivers\w32x86\2\printray .exe

[external image: Posted Image]


Refering to the picture above, drag Log.txt into RenV.exe and attach the resulting report to your reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI