ccf_jeff
Topic Starter
I'm afraid my computer might have become infected, though it may be ok. I just thought I'd better run this by someone who knows something about these logs before I tell hi-jack this to "fix everything".
As far as I know every day for months, maybe years my anti-spyware program "Spyware Doctor" pops up a window saying that my scan is complete and infections have been found. My guess is that the lowest number has been 35 and it may have gone above 100 or more on any given day. When I open the program for it to remove the infections it lists 3 categories of infections. The vast majority are always low level but a few times there has been one listed as a "high level" threat. I think that means it could be a trojan or something along those lines.
I think it does an "intelligent scan" where it looks in the most likely places. I've occasionally done a full scan afterwards and occasionally it will find another infection or two or three, but I believe they've always been of the low threat level variety.
I believe it was a few days ago that the scan showed zero infections for the first time. I was suspicious of that and did a full scan but it too showed zero infections. The next day the same thing happened. and the next …
That had never happened before, and now it's been 3 or 4 days or so in a row and has certainly raised my suspicions that something might be wrong.
I think that happened the 1st time a day or two before I downloaded Firefox's newest version 3.0 browser, but I'm not absolutely sure of it. I suppose there's a possibility that Firefox's security enhancements have suddenly eliminated picking up the spyware, but I'd certainly like an informed opinion to verify that. Firefox is my main browser, but I do have to use IE on occasion.
In any event I downloaded Hijack This and let it do its scan. I've done that on another computer years ago and just had it automatically fix everything. That may not have been so smart, however, now that I've read the directions.
In any event I'm hoping someone might take a quick look at my log and let me know if I should be doing any deleting/fixing etc. Here's the log:
Logfile of HijackThis v1.99.1
Scan saved at 1:56:53 PM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Gizmo5\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\PC Tools AntiVirus\PCTAV.exe
C:\Program Files\Comodo\VEngine\VEngine.exe
C:\BITWARE\NT\bwprnmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SUGARC~1.0B\apache2\bin\Apache.exe
C:\PROGRA~1\SUGARC~1.0B\mysql\bin\mysqld.exe
C:\PROGRA~1\SUGARC~1.0B\apache2\bin\Apache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Citrix\GoToAssist\482\G2AProcessFactory.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Comodo\VEngine\VEngine.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Clipomatic\Clipomatic.exe
C:\BITWARE\NT\bwprnmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\usbxrec\usbXprj.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\ProcessExplorer\procexp.exe
C:\Program Files\Audacity\audacity.exe
C:\Program Files\Proxomitron Naoko-4\Proxomitron.exe
C:\Program Files\Chaos32\Chaos32.exe
C:\DOCUME~1\Jeff\LOCALS~1\Temp\Temporary Directory 1 for 4-12-08_hijackthis.zip\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.mypublisher.com/client_help/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Comodo VerificationEngine Browser Helper NEW - {A968A4B4-C492-4834-B651-17602C3885C8} - C:\Program Files\Comodo\VEngine\VEngineIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: eSnips - {ED1184DA-E57E-4480-99D0-A16809037F54} - C:\PROGRA~1\eSnips\SnipBar.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [VEngine] C:\Program Files\Comodo\VEngine\VEngine.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [Clipomatic] C:\Program Files\Clipomatic\Clipomatic.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: USB Recorder.lnk = ?
O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\default.lff\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: Snip to my eSnips account - C:\Program Files\eSnips\res\SnipIt.htm
O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\default.lff\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O15 - Trusted Zone: www.accessmylibrary.com
O15 - Trusted Zone: *.Allstate.com
O15 - Trusted Zone: www.catholic-forum.com
O15 - Trusted Zone: www.deerbrook.com
O15 - Trusted Zone: *.deerbrook.com
O15 - Trusted Zone: *.Encompassinsurance.com
O15 - Trusted Zone: www.esnips.com
O15 - Trusted Zone: *.foragentsonly.com
O15 - Trusted Zone: www.goldenrulehealth.com
O15 - Trusted Zone: *.GotoAssist.com
O15 - Trusted Zone: www1.gotomeeting.com
O15 - Trusted Zone: *.integritydrive.com
O15 - Trusted Zone: http://www.kfru.com
O15 - Trusted Zone: kaiweb.kingswayamerica.com
O15 - Trusted Zone: lms5.learnshare.com
O15 - Trusted Zone: webclust1.liquidcompass.cc
O15 - Trusted Zone: *.phoenixautoins.com
O15 - Trusted Zone: *.safeco.com
O15 - Trusted Zone: *.safecoagent.com
O15 - Trusted Zone: *.safeconow.com
O15 - Trusted Zone: *.safecoplaza.com
O15 - Trusted Zone: *.shutterfly.com
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://eagent.farmersinsurance.com/PLA/eAg…ctiveX/smsx.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\482\G2AWinLogon.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo5\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Unknown owner - C:\Program Files\Citrix\GoToAssist\482\g2aservice.exe" Start=service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: sugarApache - Unknown owner - C:\PROGRA~1\SUGARC~1.0B\apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: sugarMysql - Unknown owner - C:\PROGRA~1\SUGARC~1.0B\mysql\bin\mysqld.exe
=====================
This is getting curiouser and curiouser.
Now, it just popped up a scan as back to normal. (see screenshot image of scan) 67 infections, some of which were an browser hijack/affiliated with browser hijackers.
Online screenshot of the latest Spyware Doctor scan results:
http://www.imagepile.net/index.php?page=vi…ware.report.jpg
It makes me wonder why it had come up blank for several days with no infections and now all of a sudden it's back to normal. Well sort of. That is a typical number of infections per day, but the elevated risk ones are not very common.
My kids visit mini-clip, (which as affiliated with the browser hijacker program) but I don't and haven't let them use my computer. They have an older one they can use. I don't think any of them snuck on here, but I guess it's theoretically possible.
One possibility might be that I had used Firefox in "safe mode" today. I use their No-script extension which would not have been functional in the safe mode which does not start any extensions. But I've had No-script for a long time. Maybe some new update to it stopped all of the infections I had normally been getting?
Also, my wife got on this computer today and logged in as herself. I think she usually uses Internet Explorer and maybe that let the infections start again? This would assume that Firefox 3.0 had fixed whatever problems allowed the prior infections.
Or maybe someone had been able to watch what I was doing and noticed I posted this on here and then they decided to re-enable Spyware Doctor again?
This is all just kind of weird to me. Not sure what's going on. Sorry for all the confusion.
=============
As a side note, I neglected to mention that my computer has tended to really bog down and lock up at times, especially when using Firefox and particularly when using Google within Firefox. I was hoping the Firefox 3 upgrade would fix all of that. But it was not exclusive to Firefox. It also happened with Internet Explorer.
BTW, I have 1 Gig of Ram.
I often use Process Explorer (dubbed Taskmanager on Steroids) to try and keep tabs on what's going on with memory. When it locks up I can usually still toggle over to Process Explorer and see that it is Firefox (or occasionally IE) that was locking it up. It would often resolve itself if I waited long enough, but sometimes I'd have to use Process Explorer to minimize the Firefox windows (it would do so when I couldn't minimize them normally). It might still take awhile but usually the windows would minimize and I'd be back in business for awhile. But it was likely to lock up again, sometimes fairly quickly.
Today it has been running fairly smoothly for some reason with no lockups. It's almost like someone was messing with it, saw I was trying to rid it of infections and then let loose of it.
=================
6-23-08 - The last couple of days it's gone back to Zero infections detected from Spyware Doctor. That's still *very* unusual, as in it had never happened prior to the last week or so. Then it got the "normal" double digit infections one day, and now back to zero. I'm not sure if the day it jumped back to "normal" might have been someone else getting on my computer. Another possibility is that I had used Firefox in "safe mode" that day which would have disable the "No-Script" Firefox extension. That extension gets pretty frequent updates and maybe one of the updates suddenly made Firefox immune to the normal tracking cookies etc.?
As far as I know every day for months, maybe years my anti-spyware program "Spyware Doctor" pops up a window saying that my scan is complete and infections have been found. My guess is that the lowest number has been 35 and it may have gone above 100 or more on any given day. When I open the program for it to remove the infections it lists 3 categories of infections. The vast majority are always low level but a few times there has been one listed as a "high level" threat. I think that means it could be a trojan or something along those lines.
I think it does an "intelligent scan" where it looks in the most likely places. I've occasionally done a full scan afterwards and occasionally it will find another infection or two or three, but I believe they've always been of the low threat level variety.
I believe it was a few days ago that the scan showed zero infections for the first time. I was suspicious of that and did a full scan but it too showed zero infections. The next day the same thing happened. and the next …
That had never happened before, and now it's been 3 or 4 days or so in a row and has certainly raised my suspicions that something might be wrong.
I think that happened the 1st time a day or two before I downloaded Firefox's newest version 3.0 browser, but I'm not absolutely sure of it. I suppose there's a possibility that Firefox's security enhancements have suddenly eliminated picking up the spyware, but I'd certainly like an informed opinion to verify that. Firefox is my main browser, but I do have to use IE on occasion.
In any event I downloaded Hijack This and let it do its scan. I've done that on another computer years ago and just had it automatically fix everything. That may not have been so smart, however, now that I've read the directions.
In any event I'm hoping someone might take a quick look at my log and let me know if I should be doing any deleting/fixing etc. Here's the log:Logfile of HijackThis v1.99.1
Scan saved at 1:56:53 PM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Gizmo5\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\PC Tools AntiVirus\PCTAV.exe
C:\Program Files\Comodo\VEngine\VEngine.exe
C:\BITWARE\NT\bwprnmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SUGARC~1.0B\apache2\bin\Apache.exe
C:\PROGRA~1\SUGARC~1.0B\mysql\bin\mysqld.exe
C:\PROGRA~1\SUGARC~1.0B\apache2\bin\Apache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Citrix\GoToAssist\482\G2AProcessFactory.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Comodo\VEngine\VEngine.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Clipomatic\Clipomatic.exe
C:\BITWARE\NT\bwprnmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\usbxrec\usbXprj.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\ProcessExplorer\procexp.exe
C:\Program Files\Audacity\audacity.exe
C:\Program Files\Proxomitron Naoko-4\Proxomitron.exe
C:\Program Files\Chaos32\Chaos32.exe
C:\DOCUME~1\Jeff\LOCALS~1\Temp\Temporary Directory 1 for 4-12-08_hijackthis.zip\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.mypublisher.com/client_help/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Comodo VerificationEngine Browser Helper NEW - {A968A4B4-C492-4834-B651-17602C3885C8} - C:\Program Files\Comodo\VEngine\VEngineIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: eSnips - {ED1184DA-E57E-4480-99D0-A16809037F54} - C:\PROGRA~1\eSnips\SnipBar.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [VEngine] C:\Program Files\Comodo\VEngine\VEngine.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [Clipomatic] C:\Program Files\Clipomatic\Clipomatic.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: USB Recorder.lnk = ?
O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\default.lff\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: Snip to my eSnips account - C:\Program Files\eSnips\res\SnipIt.htm
O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\default.lff\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O15 - Trusted Zone: www.accessmylibrary.com
O15 - Trusted Zone: *.Allstate.com
O15 - Trusted Zone: www.catholic-forum.com
O15 - Trusted Zone: www.deerbrook.com
O15 - Trusted Zone: *.deerbrook.com
O15 - Trusted Zone: *.Encompassinsurance.com
O15 - Trusted Zone: www.esnips.com
O15 - Trusted Zone: *.foragentsonly.com
O15 - Trusted Zone: www.goldenrulehealth.com
O15 - Trusted Zone: *.GotoAssist.com
O15 - Trusted Zone: www1.gotomeeting.com
O15 - Trusted Zone: *.integritydrive.com
O15 - Trusted Zone: http://www.kfru.com
O15 - Trusted Zone: kaiweb.kingswayamerica.com
O15 - Trusted Zone: lms5.learnshare.com
O15 - Trusted Zone: webclust1.liquidcompass.cc
O15 - Trusted Zone: *.phoenixautoins.com
O15 - Trusted Zone: *.safeco.com
O15 - Trusted Zone: *.safecoagent.com
O15 - Trusted Zone: *.safeconow.com
O15 - Trusted Zone: *.safecoplaza.com
O15 - Trusted Zone: *.shutterfly.com
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://eagent.farmersinsurance.com/PLA/eAg…ctiveX/smsx.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\482\G2AWinLogon.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo5\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Unknown owner - C:\Program Files\Citrix\GoToAssist\482\g2aservice.exe" Start=service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: sugarApache - Unknown owner - C:\PROGRA~1\SUGARC~1.0B\apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: sugarMysql - Unknown owner - C:\PROGRA~1\SUGARC~1.0B\mysql\bin\mysqld.exe
=====================
This is getting curiouser and curiouser.
Now, it just popped up a scan as back to normal. (see screenshot image of scan) 67 infections, some of which were an browser hijack/affiliated with browser hijackers.
Online screenshot of the latest Spyware Doctor scan results:
http://www.imagepile.net/index.php?page=vi…ware.report.jpg
It makes me wonder why it had come up blank for several days with no infections and now all of a sudden it's back to normal. Well sort of. That is a typical number of infections per day, but the elevated risk ones are not very common.
My kids visit mini-clip, (which as affiliated with the browser hijacker program) but I don't and haven't let them use my computer. They have an older one they can use. I don't think any of them snuck on here, but I guess it's theoretically possible.
One possibility might be that I had used Firefox in "safe mode" today. I use their No-script extension which would not have been functional in the safe mode which does not start any extensions. But I've had No-script for a long time. Maybe some new update to it stopped all of the infections I had normally been getting?
Also, my wife got on this computer today and logged in as herself. I think she usually uses Internet Explorer and maybe that let the infections start again? This would assume that Firefox 3.0 had fixed whatever problems allowed the prior infections.
Or maybe someone had been able to watch what I was doing and noticed I posted this on here and then they decided to re-enable Spyware Doctor again?
This is all just kind of weird to me. Not sure what's going on. Sorry for all the confusion.
=============
As a side note, I neglected to mention that my computer has tended to really bog down and lock up at times, especially when using Firefox and particularly when using Google within Firefox. I was hoping the Firefox 3 upgrade would fix all of that. But it was not exclusive to Firefox. It also happened with Internet Explorer.
BTW, I have 1 Gig of Ram.
I often use Process Explorer (dubbed Taskmanager on Steroids) to try and keep tabs on what's going on with memory. When it locks up I can usually still toggle over to Process Explorer and see that it is Firefox (or occasionally IE) that was locking it up. It would often resolve itself if I waited long enough, but sometimes I'd have to use Process Explorer to minimize the Firefox windows (it would do so when I couldn't minimize them normally). It might still take awhile but usually the windows would minimize and I'd be back in business for awhile. But it was likely to lock up again, sometimes fairly quickly.
Today it has been running fairly smoothly for some reason with no lockups. It's almost like someone was messing with it, saw I was trying to rid it of infections and then let loose of it.
=================
6-23-08 - The last couple of days it's gone back to Zero infections detected from Spyware Doctor. That's still *very* unusual, as in it had never happened prior to the last week or so. Then it got the "normal" double digit infections one day, and now back to zero. I'm not sure if the day it jumped back to "normal" might have been someone else getting on my computer. Another possibility is that I had used Firefox in "safe mode" that day which would have disable the "No-Script" Firefox extension. That extension gets pretty frequent updates and maybe one of the updates suddenly made Firefox immune to the normal tracking cookies etc.?
