What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Vundo infection, mostly clean, need final help

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I was hit with a Vundo infection which may have included some other nasty stuff. I have done the following in this order. Downloaded and ran ATF cleaner Downloaded and ran SpyBot-Search and Destroy Downloaded and ran VundoFix. (Log to follow) Downloaded and ran ComboFix (Log to follow) Downloaded and ran Hijackthis. (Log to follow) I was trying to take care of this myself and I mostly have but I want to be certain that everything is gone. So if someone would be kind enough to take a look at my logs and get back to me with any additional steps, I'd appreciate it. Thanks in advance.
Post #2
VundoFix V6.7.7 Checking Java version… Scan started at 1:26:08 PM 2/18/2008 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\aefhlieg.dll C:\WINDOWS\SYSTEM32\aegkbhjh.ini C:\WINDOWS\SYSTEM32\awtqpmm.dll C:\WINDOWS\SYSTEM32\ddtktkxo.dll C:\WINDOWS\SYSTEM32\ejjmnrag.dll C:\WINDOWS\SYSTEM32\garnmjje.ini C:\WINDOWS\SYSTEM32\hjhbkgea.dll C:\WINDOWS\SYSTEM32\mlljk.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\aefhlieg.dll C:\WINDOWS\SYSTEM32\aefhlieg.dll Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\aegkbhjh.ini C:\WINDOWS\SYSTEM32\aegkbhjh.ini Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\awtqpmm.dll C:\WINDOWS\SYSTEM32\awtqpmm.dll Could not be deleted. Attempting to delete C:\WINDOWS\SYSTEM32\ddtktkxo.dll C:\WINDOWS\SYSTEM32\ddtktkxo.dll Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\ejjmnrag.dll C:\WINDOWS\SYSTEM32\ejjmnrag.dll Could not be deleted. Attempting to delete C:\WINDOWS\SYSTEM32\garnmjje.ini C:\WINDOWS\SYSTEM32\garnmjje.ini Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\hjhbkgea.dll C:\WINDOWS\SYSTEM32\hjhbkgea.dll Has been deleted! Attempting to delete C:\WINDOWS\SYSTEM32\mlljk.dll C:\WINDOWS\SYSTEM32\mlljk.dll Has been deleted! Performing Repairs to the registry. Done! Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\awtqpmm.dll C:\WINDOWS\SYSTEM32\awtqpmm.dll Could not be deleted. Attempting to delete C:\WINDOWS\SYSTEM32\ejjmnrag.dll C:\WINDOWS\SYSTEM32\ejjmnrag.dll Has been deleted! Performing Repairs to the registry. Done!
Post #3
ComboFix 08-02-18.1 - Barry Kunz 2008-02-19 20:38:43.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\awtqpmm.dll
C:\WINDOWS\system32\ewjkevwv.dll
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\SYSTEM32\kjllm.ini
C:\WINDOWS\SYSTEM32\kjllm.ini2
C:\WINDOWS\SYSTEM32\klkkj.ini
C:\WINDOWS\SYSTEM32\klkkj.ini2
C:\WINDOWS\SYSTEM32\vwvekjwe.ini
C:\WINDOWS\system32\xppsjbln.dll
.
—- Previous Run ——-
.
C:\WINDOWS\system32\awtqpmm.dll
C:\WINDOWS\system32\ewjkevwv.dll
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\SYSTEM32\kjllm.ini
C:\WINDOWS\SYSTEM32\kjllm.ini2
C:\WINDOWS\SYSTEM32\klkkj.ini
C:\WINDOWS\SYSTEM32\klkkj.ini2
C:\WINDOWS\SYSTEM32\vwvekjwe.ini
C:\WINDOWS\system32\xppsjbln.dll
C:\Program Files\Real

.
((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))
.

2008-02-18 13:07 . 2008-02-18 15:28 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-18 13:07 . 2008-02-18 13:07 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-02 15:56 . 2008-02-18 14:00 d——– C:\VundoFix Backups
2008-02-02 10:22 . 2008-02-02 10:30 d——– C:\sdat
2008-02-02 10:05 . 2008-02-02 10:10 33,260,764 –a—— C:\sdat5221.exe
2008-02-02 03:52 . 2008-02-02 11:14 d——– C:\Documents and Settings\Barry Kunz\smitRem
2008-02-02 03:32 . 2004-01-08 00:11 d——– C:\Documents and Settings\Administrator.ELLIE\Application Data\Sonic
2008-02-02 03:32 . 2004-01-08 00:13 d——– C:\Documents and Settings\Administrator.ELLIE\Application Data\Jasc Software Inc
2008-02-02 03:14 . 2008-02-02 03:14 3,470 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2008-02-02 03:13 . 2008-02-02 11:14 d——– C:\Documents and Settings\Barry Kunz\SmitfraudFix
2008-02-02 03:13 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\SYSTEM32\VCCLSID.exe
2008-02-02 03:13 . 2006-04-27 16:49 288,417 –a—— C:\WINDOWS\SYSTEM32\SrchSTS.exe
2008-02-02 03:13 . 2008-02-02 00:55 83,456 –a—— C:\WINDOWS\SYSTEM32\VACFix.exe
2008-02-02 03:13 . 2008-01-27 14:37 81,920 –a—— C:\WINDOWS\SYSTEM32\IEDFix.exe
2008-02-02 03:13 . 2004-07-31 17:50 51,200 –a—— C:\WINDOWS\SYSTEM32\dumphive.exe
2008-02-02 03:13 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\SYSTEM32\WS2Fix.exe
2008-02-02 03:06 . 2008-02-02 03:06 1,212,030 –a—— C:\SmitfraudFix.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 14:15 ——— d—–w C:\Documents and Settings\Barry Kunz\Application Data\SiteAdvisor
2008-02-16 15:26 ——— d—–w C:\Program Files\McAfee
2008-02-12 03:27 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-09 18:24 ——— d—–w C:\Documents and Settings\Barry Kunz\Application Data\Intuit
2008-02-09 18:09 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-09 18:09 ——— d—–w C:\Program Files\Common Files\AnswerWorks 4.0
2008-02-09 17:57 ——— d—–w C:\Program Files\TurboTax
2008-02-09 16:19 ——— d—–w C:\Program Files\ABC
2008-02-02 21:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-02 20:06 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-01-28 06:39 ——— d—–w C:\Program Files\iTunes
2008-01-28 06:39 ——— d—–w C:\Program Files\iPod
2008-01-28 06:37 ——— d—–w C:\Program Files\QuickTime
2008-01-15 04:36 ——— d—–w C:\Program Files\mIRC
2008-01-04 02:11 ——— d—–w C:\Program Files\MagicISO
2007-12-30 06:21 ——— d—–w C:\Program Files\Alcohol Soft
2007-12-30 06:15 715,248 —-a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-23 13:37 ——— d—–w C:\Program Files\SiteAdvisor
2007-10-12 01:49 95,544 —-a-w C:\Documents and Settings\Barry Kunz\Application Data\GDIPFONTCACHEV1.DAT
2007-04-19 04:06 439,296 —-a-w C:\Documents and Settings\Barry Kunz\GoToAssist_phone__317_en.exe
2007-02-16 14:20 3,518 —-a-w C:\Documents and Settings\Barry Kunz\Application Data\wklnhst.dat
2006-09-24 17:41 483,401 —-a-w C:\Documents and Settings\Barry Kunz\gotomypc_314.exe
2006-08-20 23:06 774,144 —-a-w C:\Program Files\RngInterstitial.dll
2006-01-22 05:17 9,692,886 —-a-w C:\Program Files\vlc-0.8.4a-win32.exe
2006-01-22 02:37 4,222,516 —-a-w C:\Program Files\ABC-win32-v3.1.exe
2005-10-06 22:41 483,401 —-a-w C:\Documents and Settings\Barry Kunz\314_gotomypc.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A7ED57BC-5C26-4348-9E08-52174949DAC2}]
C:\WINDOWS\system32\ssqpm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4EDFEA7-289F-4996-BE11-6712DF56C6ED}]
C:\WINDOWS\system32\mlljk.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sonic RecordNow!"="" []
"RemoteCenter"="C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2004-06-25 09:21 147456]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 02:20 222080]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 03:59 122880 C:\WINDOWS\BCMSMMSG.exe]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04 114741]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47 204800]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 01:01 110592]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2006-12-19 21:37 36952]
"EPSON Stylus CX7800 Series (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAFA.exe" [2005-04-06 16:00 98304]
"Microsoft Help"="C:\LOL\jah.exe" [2007-12-01 20:26 45056]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Media Card Companion Monitor.lnk - C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe [2005-06-04 15:32:26 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"Image"= rundll32 C:\WINDOWS\sdkqh32.dll,Install

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gclfladm]

R2 ONSIO;ONSIO;C:\WINDOWS\SYSTEM32\DRIVERS\ONSIO.SYS [1998-09-14 08:41]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2006-11-07 00:20]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
S0 SMPLSCSI;SMPLSCSI;C:\WINDOWS\system32\drivers\SMPLSCSI.SYS [1998-08-01 12:00]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\SiriusUSB.sys [2005-09-03 00:58]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-16 01:46:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 06:00:04 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-02-01 06:00:11 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 20:52:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\program files\mcafee\msc\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-02-19 21:01:55 - machine was rebooted [Barry Kunz]
ComboFix-quarantined-files.txt 2008-02-20 02:01:52
ComboFix2.txt 2008-02-02 22:30:42
.
2008-02-13 08:05:17 — E O F —
Post #4
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:03:31 PM, on 2/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
c:\program files\mcafee\msc\mcshell.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (disabled by BHODemon)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {A7ED57BC-5C26-4348-9E08-52174949DAC2} - C:\WINDOWS\system32\ssqpm.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (disabled by BHODemon)
O2 - BHO: (no name) - {F4EDFEA7-289F-4996-BE11-6712DF56C6ED} - C:\WINDOWS\system32\mlljk.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [EPSON Stylus CX7800 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAFA.EXE /P35 "EPSON Stylus CX7800 Series (Copy 1)" /O6 "USB002" /M "Stylus CX7800"
O4 - HKLM\..\Run: [Microsoft Help] C:\LOL\jah.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [Image] rundll32 C:\WINDOWS\sdkqh32.dll,Install
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…84/mcinsctl.cab
O16 - DPF: {8FD68625-2346-418A-8899-67CB36B1917F} (McciSM Class) - http://supportcenter.verizon.net/euserv/jsp/VOLAWeb.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,21/mcgdmgr.cab
O16 - DPF: {CAFECAFE-0013-0001-0013-ABCDEFABCDEF} (JInitiator 1.3.1.13) - http://dcstars.k12.dc.us:50825/jinitiator/jinit.exe
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta…es/vzWebIns.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC5B3E01-924A-42C7-90DE-A72FB7FE35A5}: NameServer = 207.172.3.8,207.172.3.9
O20 - Winlogon Notify: gclfladm - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 10555 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI