Spyware / Malware / Virus Removal

[Resolved] NEED HELP - PLEASE REVIEW HIJACKTHIS LOG

3 min read

Looking for the outcome? Ask AI

xrayeyes2u Topic Starter

Post #1March 1, 2008, 6:48 PM UTC last edited March 1, 2008, 8:38 PM UTC

I have ran several scans and has not helped. I keep trying to run Adaware 2007 but it keeps getting hung up after an hour of running. I have used Spybot, Malwarebytes, Super Antispyware . I am posting my hijackthis file and hoping someone can guide me. I am running Win XP Pro

Logfile of HijackThis v1.99.1
Scan saved at 1:38:16 PM, on 3/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\D-Link\AIRPLUS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Hewlett-Packard\newprinter\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\atievxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Picasa2\Picasa2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\bohlmann\LOCALS~1\Temp\Temporary Directory 6 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2D6699D8-FB8F-4E2F-9BB8-3C89797A4990} - C:\WINDOWS\system32\fdeploye.dll
O2 - BHO: (no name) - {559DEF4A-D5C8-46DC-858A-A22ECB7A2CD3} - c:\windows\system32\cryptdlgr.dll
O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AIRPLUS] "C:\Program Files\D-Link\AIRPLUS.exe" -nogui
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe
O15 - Trusted Zone: http://*.turbotax.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online Enterprise Edition) - https://vpn.harris.com/llclient/IVE/winxp/,…java+AXXPEE.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://vpn.harris.com/dana-cached/setup/JuniperSetupSP1.cab
O20 - Winlogon Notify: luwpkpup - C:\WINDOWS\SYSTEM32\cryptdlgr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: D-Link Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Unknown owner - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Thanks!!!!

Failed to mention I ran ATF Cleaner prior to Spybot

Simon V.

Post #2March 2, 2008, 1:55 PM UTC

Hello, and welcome to the forum.

My name is Simon V., and I'll be glad to help you with your computer problems.
______________

Open HijackThis.

Click on the Config button.
Click on the Misc Tools button.
Click on the Open Uninstall Manager button.
Click on the Save list… button and save the file to a convenient location. When you press Save, Notepad will open with the contents of that file.

______________

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix (C:\Combofix.txt) when you've accomplished that, along with a new HijackThis log and the HijackThis Uninstall List (uninstall_list.txt)

xrayeyes2u

Post #3March 2, 2008, 2:51 PM UTC

Hi Simon,
Thanks for you assistance today!

Here is the info –
Hijack uninstall list:

Ad-Aware 2007
Adobe Download Manager 2.0 (Remove Only)
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0.5
Apple Software Update
AVG 7.5
D-Link Client Installation Program
eFax Messenger 4.2
HijackThis 1.99.1
HP Photo and Imaging 2.0 - All-in-One
HP Photo and Imaging 2.0 - All-in-One Drivers
InterVideo WinDVD 4
Java 2 Runtime Environment Standard Edition v1.3.1_17
Kaspersky Online Scanner
Microsoft Office XP Professional
Picasa 2
QuickBooks Pro 99
QuickTime
SAM 2003
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB912919)
SiteHound for Internet Explorer 1.5.0
TurboTax Deluxe Deduction Maximizer 2006
TurboTax ItsDeductible 2006
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB910437)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086

Combofix log:

ComboFix 08-03-01.3 - bohlmann 2008-03-02 8:26:43.1 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\cryptdlgr.dll
C:\WINDOWS\system32\drivers\bdyqpgud.dat
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\fdeploye.dll
C:\WINDOWS\system32\msiconf.exe
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\Tasks.\At1.job

—– BITS: Possible infected sites —–

hxxp://toolbar.google.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_RZMCMSVC
——-\LEGACY_WJBVOABZ
——-\NPF
——-\rzmcmsvc
——-\wjbvoabz

((((((((((((((((((((((((( Files Created from 2008-02-02 to 2008-03-02 )))))))))))))))))))))))))))))))
.

2008-03-01 22:01 . 2008-03-01 22:01 d——– C:\VundoFix Backups
2008-03-01 14:09 . 2008-03-01 14:09 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-03-01 14:09 . 2008-03-01 14:09 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-01 08:16 . 2008-03-01 09:15 d——– C:\Program Files\Spyware Terminator
2008-03-01 08:16 . 2008-03-01 08:18 d——– C:\Documents and Settings\bohlmann\Application Data\Spyware Terminator
2008-03-01 08:16 . 2008-03-01 09:15 d——– C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-03-01 08:16 . 2008-03-01 08:16 138,752 –a—— C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-03-01 01:24 . 2008-03-01 01:24 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-01 01:23 . 2008-03-01 01:23 d——– C:\Program Files\SUPERAntiSpyware
2008-03-01 01:23 . 2008-03-01 01:23 d——– C:\Documents and Settings\bohlmann\Application Data\SUPERAntiSpyware.com
2008-02-29 20:52 . 2008-02-29 21:12 d——– C:\Program Files\XoftSpySE
2008-02-29 09:01 . 2008-02-29 09:03 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-29 09:00 . 2008-03-01 01:22 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-28 20:56 . 2008-02-28 20:56 d——– C:\Program Files\hijack
2008-02-28 19:57 . 2008-02-29 08:42 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-02-28 19:57 . 2008-02-28 19:57 d——– C:\Documents and Settings\bohlmann\Application Data\Malwarebytes
2008-02-28 19:57 . 2008-02-28 19:57 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-02-26 20:33 . 2008-02-26 20:33 1,188,375 –a—— C:\WINDOWS\system32\libeay32.dll
2008-02-26 20:33 . 2008-02-26 20:33 741,632 –a—— C:\WINDOWS\system32\nrolipao.dat
2008-02-26 20:33 . 2008-02-26 20:33 246,545 –a—— C:\WINDOWS\system32\libssl32.dll
2008-02-26 20:33 . 2008-02-28 19:27 42,752 –a—— C:\WINDOWS\system32\vcmpzsnn.dat
2008-02-26 20:33 . 2008-02-26 20:33 36,608 –a—— C:\WINDOWS\system32\haimkxti.dat
2008-02-26 20:33 . 2008-02-26 20:33 35,072 –a—— C:\WINDOWS\system32\urzudqcw.dat
2008-02-25 20:27 . 2008-02-25 20:27 120,576 –a—— C:\WINDOWS\system32\iycndmez.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 13:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-01 22:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kodak
2008-03-01 22:07 ——— d—–w C:\Program Files\Kodak
2008-03-01 05:23 ——— d—–w C:\Documents and Settings\bohlmann\Application Data\AVG7
2008-03-01 05:03 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-03-01 03:30 ——— d—–w C:\Program Files\Hewlett-Packard
2008-03-01 03:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-01 03:26 ——— d–h–r C:\Documents and Settings\All Users\Application Data\yahoo!
2008-03-01 02:14 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-29 17:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-29 14:02 ——— d—–w C:\Program Files\Lavasoft
2008-02-29 14:02 ——— d—–w C:\Documents and Settings\bohlmann\Application Data\Lavasoft
2008-01-08 14:57 ——— d—–w C:\Program Files\TurboTax
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-09-08 20:49 22,992 —-a-w C:\Documents and Settings\bohlmann\Application Data\GDIPFONTCACHEV1.DAT
2007-05-29 03:27 495,616 —-a-w C:\Program Files\EmailConfig.exe
2007-04-10 01:45 12,754,672 —-a-w C:\Program Files\MP10Setup.exe
2007-04-10 01:39 5,271,552 —-a-w C:\Program Files\PStory.msi
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eFax 4.2"="C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 15:36 107008]
"AIRPLUS"="C:\Program Files\D-Link\AIRPLUS.exe" [2005-08-12 19:34 733184]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-29 20:44 579072]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 07:00 158208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-29 11:56 219136]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\5qc]
C:\WINDOWS\system32\5qc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-05-08 08:43 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2004-08-03 17:32]
S3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys []
S3 jswimd;jswimd Service;C:\WINDOWS\system32\DRIVERS\jswimd.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-02-22 23:16:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 08:47:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\atievxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-03-02 8:54:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-02 13:53:51

New Hijackthis Log :

Logfile of HijackThis v1.99.1
Scan saved at 9:46:23 AM, on 3/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\atievxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\D-Link\AIRPLUS.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\DOCUME~1\bohlmann\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Fire-Trust SiteHound - {C86AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O3 - Toolbar: SiteHound - {73F7F495-A325-4C52-BE48-5F97FA511E89} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [AIRPLUS] "C:\Program Files\D-Link\AIRPLUS.exe" -nogui
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O15 - Trusted Zone: http://*.turbotax.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online Enterprise Edition) - https://vpn.harris.com/llclient/IVE/winxp/,…java+AXXPEE.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://vpn.harris.com/dana-cached/setup/JuniperSetupSP1.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: D-Link Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Unknown owner - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

Since running the Combofix I have not encountered anymore popups.
Please let me know if there is anything else I should do.
With Regards,
Georgia

Simon V.

Post #4March 2, 2008, 3:09 PM UTC

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

[external image: Posted Image]

Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

xrayeyes2u

Post #5March 2, 2008, 3:31 PM UTC

Here is the CF_RC.txt log

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

Will await word from you.
Thanks!

Simon V.

Post #6March 2, 2008, 3:51 PM UTC last edited March 2, 2008, 3:51 PM UTC

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

That's looking good, you may reboot if you wish to do so.

Step 1

Click on Start, then Control Panel. Double click on Add or Remove Programs.

Please remove the following program(s):

Java 2 Runtime Environment Standard Edition v1.3.1_17

Then download and install Java Runtime Environment (JRE) 6 Update 4.

Step 2

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\WINDOWS\system32\nrolipao.dat
C:\WINDOWS\system32\vcmpzsnn.dat
C:\WINDOWS\system32\haimkxti.dat
C:\WINDOWS\system32\urzudqcw.dat
C:\WINDOWS\system32\iycndmez.dat

Folder::

C:\VundoFix Backups

Registry::

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=-
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders]
"SecurityProviders"=-
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SecurityProviders]
"SecurityProviders"=-
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\5qc]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

Click on File > Save as….

In the File Name box, copy/paste CFScript.txt (Note: Do not change the filename!)

Click Save (Save the CFScript in the same location as Combofix.exe)

Close any open windows.

Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Step 3

Close all programs before continuing, and try not to run anything during the scan.

Please do an online scan with Kaspersky WebScanner. (You will need to use Internet Explorer to run this scan)

On the welcome screen, click Accept.

You will be promted to install an ActiveX component from Kaspersky, click Install.

The program will launch and then begin downloading the latest definition files.
Once the files have been downloaded click on Next.
Now click on Scan Settings.
In the scan settings make sure that the following are selected:

Scan using the following Anti-Virus database:

Extended (if available, otherwise Standard)

Scan Options:

Scan Archives
Scan Mail Bases

Click OK.
Now under Select a Target to Scan:

Select My Computer.

The program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button and save the file to your desktop.

Step 4

In your next reply, please post:

the Combofix log (C:\Combofix.txt)
the Kaspersky Online Scan report
a new HijackThis log

xrayeyes2u

Post #7March 4, 2008, 12:18 AM UTC

Hi Simon,
I have done all of the above as directed, however, I have tried to run the Kaspersky Online Scan twice and both times it encounters an error and the computer reboots – both times it has been at least an hour into the scan.
I am posting the Combofix and new HIjackthis log files below.

ComboFix 08-03-01.3 - bohlmann 2008-03-02 12:58:40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.154 [GMT -5:00]Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\bohlmann\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\haimkxti.dat
C:\WINDOWS\system32\iycndmez.dat
C:\WINDOWS\system32\nrolipao.dat
C:\WINDOWS\system32\urzudqcw.dat
C:\WINDOWS\system32\vcmpzsnn.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\WINDOWS\system32\haimkxti.dat
C:\WINDOWS\system32\iycndmez.dat
C:\WINDOWS\system32\nrolipao.dat
C:\WINDOWS\system32\urzudqcw.dat
C:\WINDOWS\system32\vcmpzsnn.dat

.
((((((((((((((((((((((((( Files Created from 2008-02-02 to 2008-03-02 )))))))))))))))))))))))))))))))
.

2008-03-02 12:51 . 2008-03-02 12:51 d——– C:\Program Files\Sun
2008-03-02 12:50 . 2007-12-14 01:59 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-03-02 12:33 . 2008-03-02 12:50 d——– C:\Program Files\Java
2008-03-02 12:14 . 2008-03-02 12:14 d——– C:\Program Files\Common Files\Java
2008-03-02 09:41 . 2008-03-02 09:41 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-03-02 09:41 . 2008-03-02 09:41 1,409 –a—— C:\WINDOWS\QTFont.for
2008-03-02 09:39 . 2008-03-02 09:40 d——– C:\WINDOWS\system32\NtmsData
2008-03-02 09:31 . 2008-03-02 09:31 d——– C:\Program Files\FireTrust
2008-03-01 14:09 . 2008-03-01 14:09 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-03-01 14:09 . 2008-03-01 14:09 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-01 01:24 . 2008-03-01 01:24 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-01 01:23 . 2008-03-02 09:34 d——– C:\Program Files\SUPERAntiSpyware
2008-03-01 01:23 . 2008-03-02 09:34 d——– C:\Documents and Settings\bohlmann\Application Data\SUPERAntiSpyware.com
2008-02-29 20:52 . 2008-02-29 21:12 d——– C:\Program Files\XoftSpySE
2008-02-29 09:01 . 2008-02-29 09:03 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-29 09:00 . 2008-03-02 09:34 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-28 20:56 . 2008-02-28 20:56 d——– C:\Program Files\hijack
2008-02-28 19:57 . 2008-03-02 09:32 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-02-28 19:57 . 2008-02-28 19:57 d——– C:\Documents and Settings\bohlmann\Application Data\Malwarebytes
2008-02-28 19:57 . 2008-02-28 19:57 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-02-26 20:33 . 2008-02-26 20:33 1,188,375 –a—— C:\WINDOWS\system32\libeay32.dll
2008-02-26 20:33 . 2008-02-26 20:33 246,545 –a—— C:\WINDOWS\system32\libssl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 17:10 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-02 13:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-01 22:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kodak
2008-03-01 22:07 ——— d—–w C:\Program Files\Kodak
2008-03-01 05:23 ——— d—–w C:\Documents and Settings\bohlmann\Application Data\AVG7
2008-03-01 05:03 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-03-01 03:30 ——— d—–w C:\Program Files\Hewlett-Packard
2008-03-01 03:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-01 03:26 ——— d–h–r C:\Documents and Settings\All Users\Application Data\yahoo!
2008-02-29 17:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-29 14:02 ——— d—–w C:\Program Files\Lavasoft
2008-02-29 14:02 ——— d—–w C:\Documents and Settings\bohlmann\Application Data\Lavasoft
2008-01-08 14:57 ——— d—–w C:\Program Files\TurboTax
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-09-08 20:49 22,992 —-a-w C:\Documents and Settings\bohlmann\Application Data\GDIPFONTCACHEV1.DAT
2007-05-29 03:27 495,616 —-a-w C:\Program Files\EmailConfig.exe
2007-04-10 01:45 12,754,672 —-a-w C:\Program Files\MP10Setup.exe
2007-04-10 01:39 5,271,552 —-a-w C:\Program Files\PStory.msi
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eFax 4.2"="C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 15:36 107008]
"AIRPLUS"="C:\Program Files\D-Link\AIRPLUS.exe" [2005-08-12 19:34 733184]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-29 20:44 579072]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 07:00 158208]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-08 08:43 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-29 11:56 219136]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-05-08 08:43 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2004-08-03 17:32]
S3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys []
S3 jswimd;jswimd Service;C:\WINDOWS\system32\DRIVERS\jswimd.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-02-22 23:16:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 13:06:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-02 13:08:36
ComboFix-quarantined-files.txt 2008-03-02 18:07:59
ComboFix2.txt 2008-03-02 13:54:01

HIJACK THIS LOG:

Logfile of HijackThis v1.99.1
Scan saved at 7:13:08 PM, on 3/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\atievxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
C:\Program Files\D-Link\AIRPLUS.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\internet explorer\iexplore.exe
C:\DOCUME~1\bohlmann\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: Fire-Trust SiteHound - {C86AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O3 - Toolbar: SiteHound - {73F7F495-A325-4C52-BE48-5F97FA511E89} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [AIRPLUS] "C:\Program Files\D-Link\AIRPLUS.exe" -nogui
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\Program Files\FireTrust\SiteHound\SiteHound.dll
O15 - Trusted Zone: http://*.turbotax.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online Enterprise Edition) - https://vpn.harris.com/llclient/IVE/winxp/,…java+AXXPEE.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://vpn.harris.com/dana-cached/setup/JuniperSetupSP1.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: D-Link Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Unknown owner - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

Please advise.
Thanks,
Georgia

Simon V.

Post #8March 4, 2008, 6:27 AM UTC

Well your logs are looking good, how is your computer currently running?

Simon V.

Post #9March 9, 2008, 4:31 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] NEED HELP - PLEASE REVIEW HIJACKTHIS LOG

✨ Ask AI

Ask AI