What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] e404

39 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Sorry Ken for the late reply. I have been having prolems when I drag the CFScript into the ComboFix, the report starts to run then it seems to freeze, i even left it all night but the report didn't end. Any suggestions? Will i still run the Virus Total reports. Thanks Blair
Post #17
Sorry Ken for the late reply. I have been havin problems when running the CFScript on the ComboFix, the report starts to run then seems to freeze, i have even left it to run over night but it still doesn't complete. Any suggestions? Will I still run the Virus Total report. Thanks Blair
Post #18
Evening Ken,

I have run the reports, here is the info required,

ComboFix Log

ComboFix 08-06-20.4 - Compaq_Owner 2008-06-24 19:56:00.6 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFixNew.exe
Command switches used :: C:\Documents and Settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
C:\Documents and Settings\All Users\Application Data\CryptDrive
C:\Documents and Settings\All Users\Application Data\CryptDrive\Data\Abbr
C:\Documents and Settings\All Users\Application Data\CryptDrive\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\CryptDrive\Data\CustomerEmail
C:\Documents and Settings\All Users\Application Data\CryptDrive\Data\CustomerName
C:\Documents and Settings\All Users\Application Data\CryptDrive\Data\OID
C:\Documents and Settings\All Users\Application Data\CryptDrive\Data\PCID
C:\Documents and Settings\All Users\Application Data\CryptDrive\Data\Suspicious
C:\Program Files\Common Files\CryptDrive
C:\Program Files\Common Files\CryptDrive\cdcheck.dll
C:\Program Files\Common Files\CryptDrive\cdcw.exe
C:\Program Files\Common Files\CryptDrive\err.log
C:\Program Files\CryptDrive
C:\Program Files\CryptDrive\Activate.dat
C:\Program Files\CryptDrive\atl71.dll
C:\Program Files\CryptDrive\BlockEng.exe
C:\Program Files\CryptDrive\cdr.dmp
C:\Program Files\CryptDrive\cdr.exe
C:\Program Files\CryptDrive\cdr.exe.manifest
C:\Program Files\CryptDrive\cdr.url
C:\Program Files\CryptDrive\cdr.xml
C:\Program Files\CryptDrive\CDTbar.dll
C:\Program Files\CryptDrive\dbghelp.dll
C:\Program Files\CryptDrive\errors.log
C:\Program Files\CryptDrive\fopnl.dll
C:\Program Files\CryptDrive\install.exe
C:\Program Files\CryptDrive\InstHelp.exe
C:\Program Files\CryptDrive\lapv.dat
C:\Program Files\CryptDrive\license.rtf
C:\Program Files\CryptDrive\manual.chm
C:\Program Files\CryptDrive\mfc71.dll
C:\Program Files\CryptDrive\msvcp71.dll
C:\Program Files\CryptDrive\msvcr71.dll
C:\Program Files\CryptDrive\ps.dat
C:\Program Files\CryptDrive\pv.dat
C:\Program Files\CryptDrive\readme.rtf
C:\Program Files\CryptDrive\SafeOper.dll
C:\Program Files\CryptDrive\SDShExt.dll
C:\Program Files\CryptDrive\sr.log
C:\Program Files\CryptDrive\unins000.dat
C:\Program Files\CryptDrive\unins000.exe
C:\Program Files\CryptDrive\up.dat
C:\Program Files\CryptDrive\updater.dat

.
((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))
.

2008-06-20 16:51 . 2008-06-20 16:51 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-06-20 16:50 . 2008-06-20 16:50 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-06-20 16:50 . 2008-06-20 16:50 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-20 16:50 . 2008-06-19 17:48 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-20 16:50 . 2008-06-19 17:47 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-06-20 15:58 . 2008-06-20 15:58 d——– C:\WINDOWS\ERUNT
2008-06-20 15:36 . 2008-06-20 16:12 d——– C:\SDFix
2008-06-20 12:21 . 2008-06-20 12:21 d——– C:\Program Files\Trend Micro
2008-06-14 10:18 . 2008-06-13 14:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 10:18 . 2008-06-13 14:10 272,128 —–c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-27 18:40 . 2008-05-27 18:41 d——– C:\Program Files\USS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-20 10:57 ——— d—–w C:\Program Files\Nick Arcade
2008-06-20 10:56 ——— d—–w C:\Program Files\PF.Magic
2008-06-20 10:55 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-20 10:44 ——— d—–w C:\Program Files\DivX
2008-06-19 15:43 ——— d—–w C:\Program Files\Disney Interactive
2008-06-19 15:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Disney Interactive
2008-06-19 15:42 ——— d—–w C:\Program Files\Europress
2008-06-19 15:42 ——— d—–w C:\Program Files\Daily Star Sci-Fi Saturday
2008-06-19 15:40 ——— d—–w C:\Program Files\THQ
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-26 17:22 ——— d—–w C:\Documents and Settings\Compaq_Owner\Application Data\CryptDrive
2008-04-25 22:26 ——— d—–w C:\Program Files\Microsoft Works
2008-04-25 22:26 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-25 22:26 ——— d—–w C:\Program Files\Betfair Poker
2008-04-25 17:36 ——— d—–w C:\Program Files\McAfee.com
2008-04-25 17:20 704,280 —-a-w C:\Documents and Settings\Compaq_Owner\Application Data\driveclean-upinstallfull_en[1].exe
2008-04-25 17:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-04-25 17:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-25 17:12 ——— d—–w C:\Program Files\McAfee
2008-04-06 17:09 181,016 —-a-w C:\Documents and Settings\Compaq_Owner\Application Data\antivirusinstallfull_en[1].exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-20_20.54.10.65 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-20 19:49:38 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-24 17:56:29 2,048 –s-a-w C:\WINDOWS\bootstat.dat
- 2000-08-31 07:00:00 28,160 —-a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 07:00:00 28,672 —-a-w C:\WINDOWS\Nircmd.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe" [2004-01-01 11:07 159744]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 17:33 126976]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-21 19:11 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-01 09:51 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 16:51 118784]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-04-21 19:28 286720]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
"VTTimer"="VTTimer.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2003-12-09 00:18 70776]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 14:54 241664]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 17:21 406016]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 23:32 53248]
"SoundMan"="SOUNDMAN.EXE" [2005-04-06 18:57 90112 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2005-04-06 18:53 2805248 C:\WINDOWS\ALCWZRD.EXE]
"SpeedTouch USB Diagnostics"="C:\Program Files\Virgin Net Broadband\Dragdiag.exe" [2004-01-26 11:38 866816]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-01-01 10:45 98304]
"TalkTalk"="C:\Program Files\TalkTalk\bin\sprtcmd.exe" [2005-08-16 01:12 192512]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 17:44 61440]
"USS"="C:\Program Files\USS\USS.exe" [2008-03-25 19:31 143360]
"NetTurboPro"="C:\Program Files\NetTurboPro\ntp.exe" [2008-01-24 19:36 585728]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 23:31:38 241664]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 00:06:36 53248]
Media Card Companion Monitor.lnk - C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe [2005-12-28 13:50:37 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= vdrcodec.dll
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"vidc.VP31"= vp31vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

R1 DrvPrt;DrvPrt;C:\WINDOWS\system32\drivers\drvprt.sys [2003-11-26 14:26]

.
Contents of the 'Scheduled Tasks' folder
"2004-12-25 12:02:17 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-24 19:59:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-24 20:01:03
ComboFix-quarantined-files.txt 2008-06-24 19:00:56
ComboFix2.txt 2008-06-20 19:54:34

Pre-Run: 37,930,172,416 bytes free
Post-Run: 37,932,724,224 bytes free

167 — E O F — 2008-06-20 15:20:35

VirusTotal Logs

File driveclean-upinstallfull_en_1_.ex received on 06.24.2008 21:08:32 (CET)Antivirus Version Last Update Result
AhnLab-V3 2008.6.24.0 2008.06.24 -
AntiVir 7.8.0.59 2008.06.24 -
Authentium 5.1.0.4 2008.06.24 -
Avast 4.8.1195.0 2008.06.24 -
AVG 7.5.0.516 2008.06.24 Potentially harmful program WinFixer.ASI
BitDefender 7.2 2008.06.24 -
CAT-QuickHeal 9.50 2008.06.23 Downloader.WinFixer.gt (Not a Virus)
ClamAV 0.93.1 2008.06.24 -
DrWeb 4.44.0.09170 2008.06.24 -
eSafe 7.0.17.0 2008.06.24 -
eTrust-Vet 31.6.5900 2008.06.24 -
Ewido 4.0 2008.06.24 Not-A-Virus.Downloader.Win32.WinFixer.gt
F-Prot 4.4.4.56 2008.06.24 -
F-Secure 7.60.13501.0 2008.06.24 Downloader.Win32.WinFixer.gt
Fortinet 3.14.0.0 2008.06.24 Misc/BestSeller
GData 2.0.7306.1023 2008.06.24 -
Ikarus T3.1.1.26.0 2008.06.24 -
Kaspersky 7.0.0.125 2008.06.24 not-a-virus:Downloader.Win32.WinFixer.gt
McAfee 5324 2008.06.24 -
Microsoft 1.3604 2008.06.24 Program:Win32/Winfixer
NOD32v2 3214 2008.06.24 -
Norman 5.80.02 2008.06.24 -
Panda 9.0.0.4 2008.06.24 -
Prevx1 V2 2008.06.24 -
Rising 20.50.10.00 2008.06.24 -
Sophos 4.30.0 2008.06.24 -
Sunbelt 3.0.1153.1 2008.06.15 -
Symantec 10 2008.06.24 -
TheHacker 6.2.92.360 2008.06.24 -
TrendMicro 8.700.0.1004 2008.06.24 -
VBA32 3.12.6.8 2008.06.23 Downloader.Win32.WinFixer.gt
VirusBuster 4.5.11.0 2008.06.23 -
Webwasher-Gateway 6.6.2 2008.06.24 -

Additional information
File size: 704280 bytes
MD5…: 60080379118ea23398adb0e51a663c69
SHA1..: bb4f70a7ca7b08dddb16cebbb849a1e01f10140a
SHA256: a5439443d1529bea2f70ab14fef951556303932ec2d6d3338944e0e5cf418d2a
SHA512: 8ad23dcce84cb9f3b56add81156fd4d62021ff25770c0a85f7ffa73257dead05
847eaad3225fa3e0e3703e7e4ef0a39cf26e382386ddb2a7ce93dbfd281f2977
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x41427f
timedatestamp…..: 0x47fde25c (Thu Apr 10 09:48:12 2008)
machinetype…….: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1d57c 0x1d600 6.58 7fd98be7b80e0674a5771c41b819b869
.rdata 0x1f000 0x5e20 0x6000 4.94 6ad7269866ba8940e619751a94e77de3
.data 0x25000 0x3398 0x1200 3.84 5fab6228a14319d561a0feaa3f4f360e
.rsrc 0x29000 0x85db4 0x85e00 6.16 44dbd4e0adc6180978308e9b0a4aebea

( 12 imports )
> SHFOLDER.dll: SHGetFolderPathA
> SHELL32.dll: Shell_NotifyIconA, SHFileOperationA, ShellExecuteExA, SHGetSpecialFolderPathA
> COMCTL32.dll: InitCommonControlsEx
> WS2_32.dll: -, -, -, -, -, -, -, -
> SHLWAPI.dll: StrChrA, StrStrA, PathCombineA, StrFormatByteSizeA, StrCmpW, StrToIntA, PathStripPathA, PathRemoveFileSpecA, PathAppendA
> iphlpapi.dll: GetAdaptersInfo
> KERNEL32.dll: GetEnvironmentStringsW, FreeEnvironmentStringsW, InterlockedExchange, GetACP, GetLocaleInfoA, GetThreadLocale, GetVersionExA, MultiByteToWideChar, SizeofResource, LockResource, LoadResource, FindResourceA, FindResourceExA, GetLastError, CloseHandle, CreateFileA, WriteFile, GetVolumeInformationA, Sleep, SetEvent, CreateEventA, WideCharToMultiByte, lstrlenA, Module32Next, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, GetSystemTime, GetCurrentProcess, GetCurrentThreadId, GetProcAddress, FreeLibrary, LoadLibraryA, GetSystemDirectoryA, GetFileAttributesA, CreateProcessA, CopyFileA, GetModuleHandleA, CreateMutexA, ExitProcess, FreeResource, SetErrorMode, SetUnhandledExceptionFilter, FileTimeToSystemTime, FileTimeToLocalFileTime, ReadFile, MapViewOfFileEx, CreateFileMappingA, GetFileSize, UnmapViewOfFile, GetPrivateProfileSectionNamesA, GetPrivateProfileStringA, GetPrivateProfileIntA, CompareFileTime, GetTempPathA, GetExitCodeProcess, WaitForSingleObject, GetModuleFileNameA, CreateDirectoryA, lstrcpynA, FindClose, FindNextFileA, SetHandleCount, FindFirstFileA, RemoveDirectoryA, GetSystemTimeAsFileTime, SetFilePointer, FlushFileBuffers, TerminateProcess, RaiseException, InitializeCriticalSection, DeleteCriticalSection, WritePrivateProfileStringA, CompareStringA, CompareStringW, TerminateThread, CreateThread, lstrcmpA, GetTickCount, MulDiv, LocalAlloc, LocalFree, ReleaseMutex, ResetEvent, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, WaitForSingleObjectEx, GetEnvironmentStrings, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetStdHandle, GetStringTypeW, GetStringTypeA, GetTimeZoneInformation, GetFileType, LCMapStringW, LCMapStringA, SetLastError, GetCPInfo, GetOEMCP, IsBadWritePtr, VirtualFree, HeapCreate, GetCommandLineA, GetStartupInfoA, RtlUnwind, VirtualQuery, GetSystemInfo, VirtualAlloc, VirtualProtect, GetProcessHeap, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, LeaveCriticalSection, EnterCriticalSection, QueryPerformanceCounter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, SetEnvironmentVariableA, DeleteFileA
> USER32.dll: GetClientRect, InvalidateRect, IsWindow, GetDC, IsWindowVisible, SetWindowPos, GetDlgItemTextA, DestroyWindow, KillTimer, DefWindowProcA, PostQuitMessage, SetWindowRgn, SetTimer, CreateDialogParamA, UpdateWindow, GetMessageA, IsDialogMessageA, TranslateMessage, DispatchMessageA, ReleaseCapture, MoveWindow, LoadImageA, DrawIconEx, EndPaint, GetSysColor, GetWindowTextLengthA, SetFocus, DialogBoxParamA, SetForegroundWindow, EndDialog, SendMessageA, SetWindowTextA, SetDlgItemTextA, GetDlgItem, GetSystemMenu, DeleteMenu, ShowWindow, PostMessageA, MessageBoxA, LoadIconA, LoadCursorA, GetSysColorBrush, RegisterClassExA, GetWindowRect, GetFocus, DrawTextA, BeginPaint, RegisterWindowMessageA
> GDI32.dll: BitBlt, CreatePatternBrush, GetObjectA, Rectangle, DeleteObject, CombineRgn, CreateEllipticRgn, CreateRectRgn, GetDIBits, DeleteDC, CreateFontIndirectA, SetBkMode, SetTextColor, CreateCompatibleDC, SelectObject
> ADVAPI32.dll: RegCloseKey, RegDeleteValueA, GetUserNameA, RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegCreateKeyExA, RegEnumKeyExA, RegFlushKey
> ole32.dll: OleRun, CoInitialize, CoUninitialize, CoCreateInstance
> OLEAUT32.dll: -, -

( 0 exports )



File driveclean-upinstallfull_en_1_.ex received on 06.24.2008 21:08:32 (CET)Antivirus Version Last Update Result
AhnLab-V3 2008.6.24.0 2008.06.24 -
AntiVir 7.8.0.59 2008.06.24 -
Authentium 5.1.0.4 2008.06.24 -
Avast 4.8.1195.0 2008.06.24 -
AVG 7.5.0.516 2008.06.24 Potentially harmful program WinFixer.ASI
BitDefender 7.2 2008.06.24 -
CAT-QuickHeal 9.50 2008.06.23 Downloader.WinFixer.gt (Not a Virus)
ClamAV 0.93.1 2008.06.24 -
DrWeb 4.44.0.09170 2008.06.24 -
eSafe 7.0.17.0 2008.06.24 -
eTrust-Vet 31.6.5900 2008.06.24 -
Ewido 4.0 2008.06.24 Not-A-Virus.Downloader.Win32.WinFixer.gt
F-Prot 4.4.4.56 2008.06.24 -
F-Secure 7.60.13501.0 2008.06.24 Downloader.Win32.WinFixer.gt
Fortinet 3.14.0.0 2008.06.24 Misc/BestSeller
GData 2.0.7306.1023 2008.06.24 -
Ikarus T3.1.1.26.0 2008.06.24 -
Kaspersky 7.0.0.125 2008.06.24 not-a-virus:Downloader.Win32.WinFixer.gt
McAfee 5324 2008.06.24 -
Microsoft 1.3604 2008.06.24 Program:Win32/Winfixer
NOD32v2 3214 2008.06.24 -
Norman 5.80.02 2008.06.24 -
Panda 9.0.0.4 2008.06.24 -
Prevx1 V2 2008.06.24 -
Rising 20.50.10.00 2008.06.24 -
Sophos 4.30.0 2008.06.24 -
Sunbelt 3.0.1153.1 2008.06.15 -
Symantec 10 2008.06.24 -
TheHacker 6.2.92.360 2008.06.24 -
TrendMicro 8.700.0.1004 2008.06.24 -
VBA32 3.12.6.8 2008.06.23 Downloader.Win32.WinFixer.gt
VirusBuster 4.5.11.0 2008.06.23 -
Webwasher-Gateway 6.6.2 2008.06.24 -

Additional information
File size: 704280 bytes
MD5…: 60080379118ea23398adb0e51a663c69
SHA1..: bb4f70a7ca7b08dddb16cebbb849a1e01f10140a
SHA256: a5439443d1529bea2f70ab14fef951556303932ec2d6d3338944e0e5cf418d2a
SHA512: 8ad23dcce84cb9f3b56add81156fd4d62021ff25770c0a85f7ffa73257dead05
847eaad3225fa3e0e3703e7e4ef0a39cf26e382386ddb2a7ce93dbfd281f2977
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x41427f
timedatestamp…..: 0x47fde25c (Thu Apr 10 09:48:12 2008)
machinetype…….: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1d57c 0x1d600 6.58 7fd98be7b80e0674a5771c41b819b869
.rdata 0x1f000 0x5e20 0x6000 4.94 6ad7269866ba8940e619751a94e77de3
.data 0x25000 0x3398 0x1200 3.84 5fab6228a14319d561a0feaa3f4f360e
.rsrc 0x29000 0x85db4 0x85e00 6.16 44dbd4e0adc6180978308e9b0a4aebea

( 12 imports )
> SHFOLDER.dll: SHGetFolderPathA
> SHELL32.dll: Shell_NotifyIconA, SHFileOperationA, ShellExecuteExA, SHGetSpecialFolderPathA
> COMCTL32.dll: InitCommonControlsEx
> WS2_32.dll: -, -, -, -, -, -, -, -
> SHLWAPI.dll: StrChrA, StrStrA, PathCombineA, StrFormatByteSizeA, StrCmpW, StrToIntA, PathStripPathA, PathRemoveFileSpecA, PathAppendA
> iphlpapi.dll: GetAdaptersInfo
> KERNEL32.dll: GetEnvironmentStringsW, FreeEnvironmentStringsW, InterlockedExchange, GetACP, GetLocaleInfoA, GetThreadLocale, GetVersionExA, MultiByteToWideChar, SizeofResource, LockResource, LoadResource, FindResourceA, FindResourceExA, GetLastError, CloseHandle, CreateFileA, WriteFile, GetVolumeInformationA, Sleep, SetEvent, CreateEventA, WideCharToMultiByte, lstrlenA, Module32Next, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, GetSystemTime, GetCurrentProcess, GetCurrentThreadId, GetProcAddress, FreeLibrary, LoadLibraryA, GetSystemDirectoryA, GetFileAttributesA, CreateProcessA, CopyFileA, GetModuleHandleA, CreateMutexA, ExitProcess, FreeResource, SetErrorMode, SetUnhandledExceptionFilter, FileTimeToSystemTime, FileTimeToLocalFileTime, ReadFile, MapViewOfFileEx, CreateFileMappingA, GetFileSize, UnmapViewOfFile, GetPrivateProfileSectionNamesA, GetPrivateProfileStringA, GetPrivateProfileIntA, CompareFileTime, GetTempPathA, GetExitCodeProcess, WaitForSingleObject, GetModuleFileNameA, CreateDirectoryA, lstrcpynA, FindClose, FindNextFileA, SetHandleCount, FindFirstFileA, RemoveDirectoryA, GetSystemTimeAsFileTime, SetFilePointer, FlushFileBuffers, TerminateProcess, RaiseException, InitializeCriticalSection, DeleteCriticalSection, WritePrivateProfileStringA, CompareStringA, CompareStringW, TerminateThread, CreateThread, lstrcmpA, GetTickCount, MulDiv, LocalAlloc, LocalFree, ReleaseMutex, ResetEvent, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, WaitForSingleObjectEx, GetEnvironmentStrings, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetStdHandle, GetStringTypeW, GetStringTypeA, GetTimeZoneInformation, GetFileType, LCMapStringW, LCMapStringA, SetLastError, GetCPInfo, GetOEMCP, IsBadWritePtr, VirtualFree, HeapCreate, GetCommandLineA, GetStartupInfoA, RtlUnwind, VirtualQuery, GetSystemInfo, VirtualAlloc, VirtualProtect, GetProcessHeap, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, LeaveCriticalSection, EnterCriticalSection, QueryPerformanceCounter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, SetEnvironmentVariableA, DeleteFileA
> USER32.dll: GetClientRect, InvalidateRect, IsWindow, GetDC, IsWindowVisible, SetWindowPos, GetDlgItemTextA, DestroyWindow, KillTimer, DefWindowProcA, PostQuitMessage, SetWindowRgn, SetTimer, CreateDialogParamA, UpdateWindow, GetMessageA, IsDialogMessageA, TranslateMessage, DispatchMessageA, ReleaseCapture, MoveWindow, LoadImageA, DrawIconEx, EndPaint, GetSysColor, GetWindowTextLengthA, SetFocus, DialogBoxParamA, SetForegroundWindow, EndDialog, SendMessageA, SetWindowTextA, SetDlgItemTextA, GetDlgItem, GetSystemMenu, DeleteMenu, ShowWindow, PostMessageA, MessageBoxA, LoadIconA, LoadCursorA, GetSysColorBrush, RegisterClassExA, GetWindowRect, GetFocus, DrawTextA, BeginPaint, RegisterWindowMessageA
> GDI32.dll: BitBlt, CreatePatternBrush, GetObjectA, Rectangle, DeleteObject, CombineRgn, CreateEllipticRgn, CreateRectRgn, GetDIBits, DeleteDC, CreateFontIndirectA, SetBkMode, SetTextColor, CreateCompatibleDC, SelectObject
> ADVAPI32.dll: RegCloseKey, RegDeleteValueA, GetUserNameA, RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegCreateKeyExA, RegEnumKeyExA, RegFlushKey
> ole32.dll: OleRun, CoInitialize, CoUninitialize, CoCreateInstance
> OLEAUT32.dll: -, -

( 0 exports )



HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:15:14, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Virgin Net Broadband\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\USS\USS.exe
C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [USS] "C:\Program Files\USS\USS.exe"
O4 - HKLM\..\Run: [NetTurboPro] C:\Program Files\NetTurboPro\ntp.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Stan James Poker.com Poker - {7F2F6F5A-CAE2-4954-A461-36B3757B2BFB} - C:\Program Files\stanjamesgibMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 8215 bytes

Thanks

Blair
Post #19
Hello,

Do you know what this program is??
C:\Program Files\USS\USS.exe

Please download OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\Documents and Settings\Compaq_Owner\Application Data\driveclean-upinstallfull_en[1].exe
    C:\Documents and Settings\Compaq_Owner\Application Data\antivirusinstallfull_en[1].exe

  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


Post the OTMoveIt log and a New HJT log and let me know how your system is running now
Post #20
Ken,

I don't know what the below program is.

C:\Program Files\USS\USS.exe

OTMoveIT Log

< C:\Documents and Settings\Compaq_Owner\Application Data\driveclean-upinstallfull_en[1].exe >
C:\Documents and Settings\Compaq_Owner\Application Data\driveclean-upinstallfull_en[1].exe moved successfully.
< C:\Documents and Settings\Compaq_Owner\Application Data\antivirusinstallfull_en[1].exe >
C:\Documents and Settings\Compaq_Owner\Application Data\antivirusinstallfull_en[1].exe moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06252008_193427

HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:40:23, on 25/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Virgin Net Broadband\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\USS\USS.exe
C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [USS] "C:\Program Files\USS\USS.exe"
O4 - HKLM\..\Run: [NetTurboPro] C:\Program Files\NetTurboPro\ntp.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Stan James Poker.com Poker - {7F2F6F5A-CAE2-4954-A461-36B3757B2BFB} - C:\Program Files\stanjamesgibMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 8215 bytes


Since starting this process, my computer has been running alot better

Thanks

Blair
Post #22
The results from VirusTotal | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Français | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information… File USS.exe received on 06.26.2008 19:20:57 (CET) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 0/33 (0%) Loading server information… Your file is queued in position: 1. Estimated start time is between 37 and 53 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2008.6.26.0 2008.06.26 - AntiVir 7.8.0.59 2008.06.26 - Authentium 5.1.0.4 2008.06.25 - Avast 4.8.1195.0 2008.06.26 - AVG 7.5.0.516 2008.06.26 - BitDefender 7.2 2008.06.26 - CAT-QuickHeal 9.50 2008.06.26 - ClamAV 0.93.1 2008.06.26 - DrWeb 4.44.0.09170 2008.06.26 - eSafe 7.0.17.0 2008.06.26 - eTrust-Vet 31.6.5907 2008.06.26 - Ewido 4.0 2008.06.26 - F-Prot 4.4.4.56 2008.06.25 - F-Secure 7.60.13501.0 2008.06.24 - Fortinet 3.14.0.0 2008.06.26 - GData 2.0.7306.1023 2008.06.26 - Ikarus T3.1.1.26.0 2008.06.26 - Kaspersky 7.0.0.125 2008.06.26 - McAfee 5326 2008.06.26 - Microsoft None 2008.06.26 - NOD32v2 3222 2008.06.26 - Norman 5.80.02 2008.06.26 - Panda 9.0.0.4 2008.06.26 - Prevx1 V2 2008.06.26 - Rising 20.50.32.00 2008.06.26 - Sophos 4.30.0 2008.06.26 - Sunbelt 3.0.1153.1 2008.06.15 - Symantec 10 2008.06.26 - TheHacker 6.2.92.362 2008.06.26 - TrendMicro 8.700.0.1004 2008.06.26 - VBA32 3.12.6.8 2008.06.26 - VirusBuster 4.5.11.0 2008.06.23 - Webwasher-Gateway 6.6.2 2008.06.26 - Additional information File size: 143360 bytes MD5…: 321347308212bc82eeb9191d1850c860 SHA1..: fd727fd4dc27186e0719c614075b04994fedef4b SHA256: 6dbde18fed1937f2f545a8921dd78a07a0504fc7588b859a629ff269f8226e6e SHA512: acfc5529f92a94b157606c820363e2dadd1dc15c7f827ec7cb3649e0f99265f9 f10f8679cec27234973c39f4a21d2f8c5e78f6a352a5621132189c8cdda9cef8 PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x41a3b0 timedatestamp…..: 0x46cd3b88 (Thu Aug 23 07:47:20 2007) machinetype…….: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x1a8c3 0x1b000 6.37 cca143cfc5a44db988999c4fb00803fa .rdata 0x1c000 0x46e6 0x5000 4.54 bc3b7bfab2032a5198f813a2bbbb9e4f .data 0x21000 0x63c 0x1000 0.82 c98485a3dfed1c987022ac67ae89cdec .rsrc 0x22000 0x6b8 0x1000 2.29 88df774c2a3b54f797399ef47c9900c6 ( 13 imports ) > KERNEL32.dll: CreateMutexA, CloseHandle, Thread32Next, Thread32First, CreateToolhelp32Snapshot, GetCurrentThreadId, InterlockedIncrement, InterlockedDecrement, GetModuleHandleA, GetModuleFileNameA, LoadLibraryExA, lstrcpynA, IsDBCSLeadByte, OpenProcess, Process32Next, GetCurrentProcessId, Process32First, TerminateProcess, Sleep, CreateEventA, CreateWaitableTimerA, CancelWaitableTimer, WaitForMultipleObjectsEx, SetWaitableTimer, CreateProcessA, SetEvent, LocalFileTimeToFileTime, SystemTimeToFileTime, TerminateThread, ExitProcess, WaitForSingleObject, LoadLibraryA, GetProcAddress, FreeLibrary, lstrlenA, lstrcmpiA, GetVersion, lstrlenW, LeaveCriticalSection, EnterCriticalSection, FindResourceExA, FindResourceA, LoadResource, LockResource, SizeofResource, DeleteCriticalSection, InitializeCriticalSection, GetLastError, RaiseException, WideCharToMultiByte, MultiByteToWideChar, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetSystemTimeAsFileTime, GetTickCount, QueryPerformanceCounter, GetStartupInfoA, HeapSize, HeapReAlloc, HeapDestroy, GetPrivateProfileStringA, GetPrivateProfileSectionNamesA, ReadFile, GetPrivateProfileIntA, UnmapViewOfFile, GetFileSize, CreateFileMappingA, MapViewOfFileEx, GetACP, ResetEvent, CreateFileA, FindFirstFileA, MulDiv, GetSystemInfo, VirtualProtect, GetCurrentProcess, WriteProcessMemory, VirtualQuery, Module32Next, Module32First, HeapAlloc, GetProcessHeap, HeapFree, InterlockedExchange > USER32.dll: KillTimer, PostQuitMessage, SetTimer, DispatchMessageA, TranslateMessage, GetMessageA, GetPropA, SetWindowPos, SendMessageA, EnableScrollBar, GetScrollInfo, GetScrollPos, GetScrollRange, SetScrollPos, SetWindowLongA, ShowScrollBar, GetWindowLongA, RemovePropA, CreateWindowExA, SetPropA, GetClientRect, SetScrollInfo, SetScrollRange, FillRect, PeekMessageA, DrawFrameControl, SetRect, GetSystemMetrics, GetSysColorBrush, DrawEdge, GetWindowRect, GetParent, OffsetRect, FrameRect, InflateRect, WindowFromDC, GetWindowDC, ReleaseDC, CopyRect, MapWindowPoints, CallWindowProcA, PtInRect, SetCapture, ReleaseCapture, GetMessagePos, ScreenToClient, GetCursorPos, SetCursor, IsWindowVisible, DestroyWindow, CharNextA, PostThreadMessageA, DefWindowProcA, GetSysColor > ADVAPI32.dll: RegQueryInfoKeyA, RegOpenKeyExA, RegQueryValueExA, RegEnumValueA, RegDeleteKeyA, RegSetValueExA, RegEnumKeyExA, RegCloseKey, RegDeleteValueA, RegCreateKeyExA > SHELL32.dll: ShellExecuteA > ole32.dll: CoInitialize, CoTaskMemAlloc, CoTaskMemFree, CoCreateInstance, StringFromCLSID, CoUninitialize, CoTaskMemRealloc > OLEAUT32.dll: -, -, -, -, -, -, - > SHLWAPI.dll: PathFindFileNameA, PathAppendA, PathStripPathA > COMCTL32.dll: InitCommonControlsEx > WININET.dll: InternetCloseHandle, InternetGetCookieA, InternetReadFile, InternetOpenUrlA, InternetOpenA > MSVCR71.dll: __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _amsg_exit, _acmdln, exit, _cexit, _ismbblead, _XcptFilter, _exit, _mbsstr, _terminate@@YAXXZ, _onexit, __dllonexit, __1type_info@@UAE@XZ, __security_error_handler, memset, strtol, memchr, toupper, _mbsnbcpy, atoi, _mbsrchr, __0exception@@QAE@XZ, __1exception@@UAE@XZ, _beginthreadex, realloc, __0exception@@QAE@ABV0@@Z, _mbslwr, __2@YAPAXI@Z, _time64, _purecall, _localtime64, _mktime64, _mbsupr, __3@YAXPAX@Z, __CxxFrameHandler, ___V@YAXPAX@Z, ___U@YAPAXI@Z, _mbschr, _mbscmp, memmove, _ismbcspace, _mbsinc, _mbscspn, _mbsspn, _controlfp, malloc, free, _mbsicmp, _CxxThrowException, _except_handler3, _resetstkoflw, _c_exit > MSVCP71.dll: __4_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV01@ABV01@@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBD@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@ABV01@@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ > SHFOLDER.dll: SHGetFolderPathA > GDI32.dll: DeleteDC, DeleteObject, GetStockObject, SetTextColor, BitBlt, SetBkColor, CreateCompatibleBitmap, SelectObject, UnrealizeObject, CreateBitmap, CreateCompatibleDC, PatBlt, SetBrushOrgEx, CreatePatternBrush, ExtTextOutA, GetObjectA, PlayEnhMetaFile, SetWindowOrgEx, SelectClipRgn, IntersectClipRect ( 0 exports ) ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware. VirusTotal © Hispasec Sistemas - Blog - Contact: [removed] - Terms of Service & Privacy Policy Ken when completed, what virus protection do you recommend. Cheers Martin
Post #23
That program appears to be ok, just wanted to make sure.

  • Your Java is out of date and leaving your system vulnerable.
  • Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
  • It should have an icon next to it:
    [external image: Posted Image]
    Select it and click Remove.
  • Reboot your system.
  • Then go to the Sun Microsystems and install the update
  • Java Runtime Environment (JRE) 6 Update 6 <–This is what you need to download and install.
  • If you chose the online installation, it will prompt you to run the program.
  • If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it.
  • Then after install you can verify your installation here Sun Java Verify
I like to to do the offline installation and save the setup file in case I may need it in the future


Please download ATF Cleaner by Atribune to your desktop.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up



You have Symantec Anti Virus which is a good program, let me know if you want to get rid of it and I can link you to some free AV programs if you like. I am also going to link you to some free programs that are must haves to help keep you more secure on the internet


How is everything running now??
Post #24 last edited
Hello Ken, I have completed the above actions and my computer is running great. Am happy with whatever you think is best regarding the anti virus, it's just that everytime I start up the computer I get windows security alert telling me it can't detect any anti virus protection. Is this a problem? Cheers Blair
Post #25
Hello,

Run Symantec and check for updates , thats all it may need. If the program is outdated and you do not want to renew it, here is a free program that is more than adequate that I use on a couple of my computers. Make sure you uninstall Norton first.

AVG Free


Go to Start> Control Panel> Security Center and under " Change the way Security Center Alerts Me" Take the checkmark out of Anti Virus.


  • How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • GeeksTo Go
  • Dslreports

Safe Surfn
Ken
Post #27

Since starting this process, my computer has been running alot better
I have completed the above actions and my computer is running great



Why would you?? If you use System Restore to revert your system back to an earlier date you take the chance of reinfecting yourself all over again as bad stuff along with good is backed up in that program.


Is your Symantec program out of date? Are you ready to download a new program or update Symantec??
Post #28
Good point, I downloaded AVG, couldn't find Symantec to check if it was up to date. I removed the norton programs before downloading AVG. Do I need to download some more stuff as suggested in the links?
Post #29
Good Morning,

I would install these.

Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.


Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
  • Spybot Search and Destroy 1.5
    Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  • Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  • Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  • IE-Spyad
    IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.


Post a new HJT log and lets make sure Norton is completely gone
Post #30
Afternoon Ken,

Here is the HJT log,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:27:20, on 30/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Virgin Net Broadband\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\USS\USS.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [USS] "C:\Program Files\USS\USS.exe"
O4 - HKLM\..\Run: [NetTurboPro] C:\Program Files\NetTurboPro\ntp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Presario\XPHWWRF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Software Suite\Media Card Companion\MCC Monitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Stan James Poker.com Poker - {7F2F6F5A-CAE2-4954-A461-36B3757B2BFB} - C:\Program Files\stanjamesgibMPP\MPPoker.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1214815288656
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 8453 bytes

Ive downloaded the files, as suggested, correctly I hope!

Thanks

Blair

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI