Spyware / Malware / Virus Removal

[Resolved] brastk.exe found after scan

14 min read

Looking for the outcome? Ask AI

john1701 Topic Starter

Post #1November 14, 2008, 4:39 PM UTC

Hi There,
I was here some time ago ( when it was called Tom Coyote) and if I remember correctly it was LD Tate who helped me out.

I may have been infected.
Last week I was informed by AVG that a threat had been detected and I removed the threat. I noticed a new icon on the Desktop called ' Delself'. I remove this and did a number of scans and removed some other possible problem files. My computer has been working fine with no obvious signs of infection. Yesterday just as I was about to Shutdown I notice the ZoneAlarm icon was active, some program was accessing the internet. I check ZA Logs and discovered the culprit was called 'brastk.exe@ I promptly blocked its access to the internet.
Today I ran an number of programs that tell me everything is fine. Could you please check and let me know if my machine is clear of infection.

I have done the following:
1. show hidden folders and files
Ran the following programs;
2. Erunt
3. ATF Cleaner
4. Windows Disk Clean Up
5. CCleaner
6. Malwarebytes Antimalware, no malicious programs found
7. Spybot S+D, No threats found
8. Ad Aware 2008, One MRU Object found and removed
9. AVG Full scan, No infections found

I have run HIJACKTHIS and the log is below.

Is my computer infected? Please help

Thank You
JOHN

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:22:34, on 14/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.targa.co.uk/
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.targa.co.uk/
O15 - Trusted Zone: http://*.akamai.net
O15 - Trusted Zone: http://www.amazon.co.uk
O15 - Trusted Zone: http://content.ancestry.co.uk
O15 - Trusted Zone: http://search.ancestry.co.uk
O15 - Trusted Zone: http://www.ancestry.co.uk
O15 - Trusted Zone: http://akamai.avg.com
O15 - Trusted Zone: http://update.avg.com
O15 - Trusted Zone: http://akamai.avg.cz
O15 - Trusted Zone: http://backup.avg.cz
O15 - Trusted Zone: http://download.avg.cz
O15 - Trusted Zone: http://files2.avg.cz
O15 - Trusted Zone: http://www.botanicalkeys.co.uk
O15 - Trusted Zone: http://www.brightminds.co.uk
O15 - Trusted Zone: http://www.download.com
O15 - Trusted Zone: *.download.com
O15 - Trusted Zone: http://akamai.avg.com.edgesuite.net
O15 - Trusted Zone: http://akamai.avg.cz.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.com.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.cz.edgesuite.net
O15 - Trusted Zone: http://www.freebmd.org.uk
O15 - Trusted Zone: http://www.galaxyzoo.org
O15 - Trusted Zone: http://www.genesreunited.com
O15 - Trusted Zone: http://www.google.co.uk
O15 - Trusted Zone: http://akamai.grisoft.com
O15 - Trusted Zone: http://free.grisoft.com
O15 - Trusted Zone: http://uodate.grisoft.com
O15 - Trusted Zone: http://www.grisoft.com
O15 - Trusted Zone: http://akamai.grisoft.cz
O15 - Trusted Zone: http://download.grisoft.cz
O15 - Trusted Zone: http://files2.grisoft.cz
O15 - Trusted Zone: http://www.hotmail.com
O15 - Trusted Zone: http://www.lidl.co.uk
O15 - Trusted Zone: http://login.live.com
O15 - Trusted Zone: http://www.msn.co.uk
O15 - Trusted Zone: http://by102fd.bay102.hotmail.msn.com
O15 - Trusted Zone: http://uk.msn.com
O15 - Trusted Zone: http://www.msn.com
O15 - Trusted Zone: http://www.nationalarchives.gov.uk
O15 - Trusted Zone: http://www.netto.co.uk
O15 - Trusted Zone: http://www.networkmagic.com
O15 - Trusted Zone: http://www.open.ac.uk
O15 - Trusted Zone: http://www.scotlandspeople.gov.uk
O15 - Trusted Zone: http://www.spatial-literacy.org
O15 - Trusted Zone: http://www.symantec.com
O15 - Trusted Zone: http://www.zonealarm.com
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.uclan.ac.uk/other/iss/remote/wficat.cab
O16 - DPF: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} (AlamyUploader Class) - http://www.alamy.com/uploader/alamy_uploader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106832058390
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: karna.dat
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 11872 bytes

Rorschach112

Post #2November 14, 2008, 4:47 PM UTC

Hello

Download avz4.zip from here

Unzip it to your desktop to a folder named avz4
Double click on AVZ.exe to run it.
Run an update by clicking the Auto Update button on the Right of the Log window: [external image: Posted Image]
Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

After the update, from the "File" menu, choose "Standard Scripts"
Put a check next to item 2: Advanced System Investigation
Click Execute selected scripts
At the next prompt, click the OK button
Let the scan run and click "OK" when the completion prompt pops up
Now Close out of the Standard Scripts window, and exit AVZ
Navigate to the avz4 folder and locate the folder LOG
Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
Attach virusinfo_syscheck.htm to your next reply, along with a fresh HijackThis log

john1701

Post #3November 14, 2008, 7:59 PM UTC

Hello Rorschach112,
Thanks for your help.
below is a new HJT Log
avz4 log file Zipped version attached ( the unzipped file was too large)

Hope its good news.

John

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:52:35, on 14/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.targa.co.uk/
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.targa.co.uk/
O15 - Trusted Zone: http://*.akamai.net
O15 - Trusted Zone: http://www.amazon.co.uk
O15 - Trusted Zone: http://content.ancestry.co.uk
O15 - Trusted Zone: http://search.ancestry.co.uk
O15 - Trusted Zone: http://www.ancestry.co.uk
O15 - Trusted Zone: http://akamai.avg.com
O15 - Trusted Zone: http://update.avg.com
O15 - Trusted Zone: http://akamai.avg.cz
O15 - Trusted Zone: http://backup.avg.cz
O15 - Trusted Zone: http://download.avg.cz
O15 - Trusted Zone: http://files2.avg.cz
O15 - Trusted Zone: http://www.botanicalkeys.co.uk
O15 - Trusted Zone: http://www.brightminds.co.uk
O15 - Trusted Zone: http://www.download.com
O15 - Trusted Zone: *.download.com
O15 - Trusted Zone: http://akamai.avg.com.edgesuite.net
O15 - Trusted Zone: http://akamai.avg.cz.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.com.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.cz.edgesuite.net
O15 - Trusted Zone: http://www.freebmd.org.uk
O15 - Trusted Zone: http://www.galaxyzoo.org
O15 - Trusted Zone: http://www.genesreunited.com
O15 - Trusted Zone: http://www.google.co.uk
O15 - Trusted Zone: http://akamai.grisoft.com
O15 - Trusted Zone: http://free.grisoft.com
O15 - Trusted Zone: http://uodate.grisoft.com
O15 - Trusted Zone: http://www.grisoft.com
O15 - Trusted Zone: http://akamai.grisoft.cz
O15 - Trusted Zone: http://download.grisoft.cz
O15 - Trusted Zone: http://files2.grisoft.cz
O15 - Trusted Zone: http://www.hotmail.com
O15 - Trusted Zone: http://www.lidl.co.uk
O15 - Trusted Zone: http://login.live.com
O15 - Trusted Zone: http://www.msn.co.uk
O15 - Trusted Zone: http://by102fd.bay102.hotmail.msn.com
O15 - Trusted Zone: http://uk.msn.com
O15 - Trusted Zone: http://www.msn.com
O15 - Trusted Zone: http://www.nationalarchives.gov.uk
O15 - Trusted Zone: http://www.netto.co.uk
O15 - Trusted Zone: http://www.networkmagic.com
O15 - Trusted Zone: http://www.open.ac.uk
O15 - Trusted Zone: http://www.scotlandspeople.gov.uk
O15 - Trusted Zone: http://www.spatial-literacy.org
O15 - Trusted Zone: http://www.symantec.com
O15 - Trusted Zone: http://www.zonealarm.com
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.uclan.ac.uk/other/iss/remote/wficat.cab
O16 - DPF: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} (AlamyUploader Class) - http://www.alamy.com/uploader/alamy_uploader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106832058390
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: karna.dat
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 11839 bytes

Attachments:

📎virusinfo_syscheck.zip

Rorschach112

Post #4November 14, 2008, 8:27 PM UTC

Hello

Close all windows then double click on AVZ.exe
Click File > Custom scripts

Copy & paste the contents of the following codebox in the box in the program

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 TerminateProcessByName('c:\program files\zone labs\zonealarm\zlclient.exe');
 TerminateProcessByName('c:\windows\system32\zonelabs\vsmon.exe');
 TerminateProcessByName('c:\program files\spybot - search & destroy\teatimer.exe');
 TerminateProcessByName('c:\program files\spywareguard\sgmain.exe');
 TerminateProcessByName('c:\program files\spywareguard\sgbhp.exe');
 TerminateProcessByName('c:\program files\windows defender\msmpeng.exe');
 TerminateProcessByName('c:\program files\windows defender\msascui.exe');
 TerminateProcessByName('c:\progra~1\avg\avg8\avgwdsvc.exe');
 TerminateProcessByName('c:\progra~1\avg\avg8\avgtray.exe');
 TerminateProcessByName('c:\progra~1\avg\avg8\avgrsx.exe');
 TerminateProcessByName('c:\progra~1\avg\avg8\avgemc.exe');
 BC_DeleteFile('karna.dat');
 BC_DeleteFile('D:\autorun.inf');
 BC_DeleteFile('D:\Autorun.exe');
 BC_DeleteFile('L:\autorun.inf');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Note: When you run the script, your PC will be restarted
Click Run
Restart your PC if it doesn't do it automatically, and post back with a new HijackThis log.

Also post a new HJT log

john1701

Post #5November 14, 2008, 11:16 PM UTC

Hi Rorschach112,

Ran avz4 with the custom script and the new HJT log is below.
Its now 23:00 Hrs my time so I'll be going to bed soon.

Catch up with you tomorrow.

Nighty Nighty

John

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:09, on 14/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.targa.co.uk/
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program

Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program

Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} -

C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat

7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting]

"C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program

Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works

Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program

Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program

Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program

Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program

Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program

Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.targa.co.uk/
O15 - Trusted Zone: http://*.akamai.net
O15 - Trusted Zone: http://www.amazon.co.uk
O15 - Trusted Zone: http://content.ancestry.co.uk
O15 - Trusted Zone: http://search.ancestry.co.uk
O15 - Trusted Zone: http://www.ancestry.co.uk
O15 - Trusted Zone: http://akamai.avg.com
O15 - Trusted Zone: http://update.avg.com
O15 - Trusted Zone: http://akamai.avg.cz
O15 - Trusted Zone: http://backup.avg.cz
O15 - Trusted Zone: http://download.avg.cz
O15 - Trusted Zone: http://files2.avg.cz
O15 - Trusted Zone: http://www.botanicalkeys.co.uk
O15 - Trusted Zone: http://www.brightminds.co.uk
O15 - Trusted Zone: http://www.download.com
O15 - Trusted Zone: *.download.com
O15 - Trusted Zone: http://akamai.avg.com.edgesuite.net
O15 - Trusted Zone: http://akamai.avg.cz.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.com.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.cz.edgesuite.net
O15 - Trusted Zone: http://www.freebmd.org.uk
O15 - Trusted Zone: http://www.galaxyzoo.org
O15 - Trusted Zone: http://www.genesreunited.com
O15 - Trusted Zone: http://www.google.co.uk
O15 - Trusted Zone: http://akamai.grisoft.com
O15 - Trusted Zone: http://free.grisoft.com
O15 - Trusted Zone: http://uodate.grisoft.com
O15 - Trusted Zone: http://www.grisoft.com
O15 - Trusted Zone: http://akamai.grisoft.cz
O15 - Trusted Zone: http://download.grisoft.cz
O15 - Trusted Zone: http://files2.grisoft.cz
O15 - Trusted Zone: http://www.hotmail.com
O15 - Trusted Zone: http://www.lidl.co.uk
O15 - Trusted Zone: http://login.live.com
O15 - Trusted Zone: http://www.msn.co.uk
O15 - Trusted Zone: http://by102fd.bay102.hotmail.msn.com
O15 - Trusted Zone: http://uk.msn.com
O15 - Trusted Zone: http://www.msn.com
O15 - Trusted Zone: http://www.nationalarchives.gov.uk
O15 - Trusted Zone: http://www.netto.co.uk
O15 - Trusted Zone: http://www.networkmagic.com
O15 - Trusted Zone: http://www.open.ac.uk
O15 - Trusted Zone: http://www.scotlandspeople.gov.uk
O15 - Trusted Zone: http://www.spatial-literacy.org
O15 - Trusted Zone: http://www.symantec.com
O15 - Trusted Zone: http://www.zonealarm.com
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) -

http://www.uclan.ac.uk/other/iss/remote/wficat.cab
O16 - DPF: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} (AlamyUploader Class) -

http://www.alamy.com/uploader/alamy_uploader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -

http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://v5.windowsupdate.microsoft.com/v5co…eb_site.cab?110

6832058390
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program

Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: karna.dat
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program

Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe

Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner -

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. -

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. -

C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. -

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program

Files\Canon\CAL\CALMAIN.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner -

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program

Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program

Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common

Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 11846 bytes

Rorschach112

Post #6November 14, 2008, 11:19 PM UTC

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum.

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

john1701

Post #7November 15, 2008, 11:31 AM UTC

Hello,
I'm back after a good nights rest and have completed the tasks you set.

The only slight worry was when using SDfix an error box came up, it said; C:\Program~1\Symantec\S32EVENT1.DLL An Installable Virtual Device Driver Failed to Initialise. Choose close to terminate application.
I Choose to click on Ignore and SDFix carried on.
The same message poped up when the computer rebooted, agian I clicked Ignore. Hope that was the right thing to do.

Bye for now

John

SDFix: Version 1.240
Run by [removed] on 15/11/2008 at 09:53

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\SYSTEM32\TDSSOSVD.dat - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-15 10:23:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"="C:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe:*:Enabled:PowerCinema"
"C:\\Program Files\\CA\\Etrust Antivirus\\Realmon.exe"="C:\\Program Files\\CA\\Etrust Antivirus\\Realmon.exe:*:Enabled:Realmon"
"C:\\Program Files\\FreshDevices\\FreshDownload\\fdgo.exe"="C:\\Program Files\\FreshDevices\\FreshDownload\\fdgo.exe:*:Enabled:fdgo"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Scribble\\Scribble.exe"="C:\\Program Files\\Scribble\\Scribble.exe:*:Enabled:pcscribble, digiscribble"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 23 Jun 2008 39 A..H. — "C:\highi.sys"
Mon 3 Sep 2001 309,453 A.SH. — "C:\WINDOWS\rsx.exe"
Wed 31 Mar 2004 54,384 A..H. — "C:\Program Files\AOL 9.0\aolphx.exe"
Wed 31 Mar 2004 156,784 A..H. — "C:\Program Files\AOL 9.0\aoltray.exe"
Wed 31 Mar 2004 31,344 A..H. — "C:\Program Files\AOL 9.0\RBM.exe"
Fri 7 Dec 2007 6,219,320 A..H. — "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008 949,072 A.SHR — "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR — "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Thu 14 Aug 2008 1,429,840 A.SHR — "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Wed 30 Jul 2008 4,891,984 A.SHR — "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Tue 16 Sep 2008 1,833,296 A.SHR — "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR — "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Mon 27 Oct 2008 1,880,064 A..H. — "C:\Program Files\Accu-Chek Compass\Backup\Compass.bak"
Thu 5 Aug 2004 1,949,696 A..HR — "C:\Program Files\Microsoft Works Suite 2005\Setup\launcher.exe"
Thu 29 Jul 2004 53,760 A..HR — "C:\Program Files\Microsoft Works Suite 2005\Setup\mnyinsta.dll"
Sat 12 Jun 2004 94,208 A..HR — "C:\Program Files\Microsoft Works Suite 2005\Setup\RmvSuite.exe"
Sat 3 Jul 2004 35,328 A..HR — "C:\Program Files\Microsoft Works Suite 2005\Setup\setuplng.dll"
Fri 21 Nov 2003 20,480 A..HR — "C:\Program Files\Microsoft Works Suite 2005\Setup\unregwtr.exe"

Finished!

Malwarebytes' Anti-Malware 1.30
Database version: 1399
Windows 5.1.2600 Service Pack 3

15/11/2008 11:19:41
mbam-log-2008-11-15 (11-19-41).txt

Scan type: Quick Scan
Objects scanned: 52733
Time elapsed: 4 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Rorschach112

Post #8November 15, 2008, 1:15 PM UTC

One final thing

Please download the OTMoveIt3 by OldTimer or from here.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
:Processes
explorer.exe

:Services

:Reg

:Files
C:\highi.sys
C:\WINDOWS\rsx.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
```
Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Also post a new HJT log

john1701

Post #9November 15, 2008, 5:24 PM UTC

hi there,
the logs you requested are below.

Hope these are OK

JOHN

MOVEIT LOG

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\highi.sys moved successfully.
C:\WINDOWS\rsx.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\John\LOCALS~1\Temp\~DF89FF.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\John\LOCALS~1\Temp\~DF8A15.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\John\LOCALS~1\Temp\~DF90DC.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\John\LOCALS~1\Temp\~DF9F5B.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\CWLGUVAOCFIIRCUPM\2040 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZLT0039c.TMP scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZLT07622.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11152008_145012

Files moved on Reboot…
File C:\DOCUME~1\John\LOCALS~1\Temp\~DF89FF.tmp not found!
File C:\DOCUME~1\John\LOCALS~1\Temp\~DF8A15.tmp not found!
C:\DOCUME~1\John\LOCALS~1\Temp\~DF90DC.tmp moved successfully.
C:\DOCUME~1\John\LOCALS~1\Temp\~DF9F5B.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\CWLGUVAOCFIIRCUPM\2040 scheduled to be moved on reboot.
File C:\WINDOWS\temp\ZLT0039c.TMP not found!
File C:\WINDOWS\temp\ZLT07622.TMP not found!

COMBOFIX LOG
Your User Name
Your Company Name
1A20-0320-0133-2111-9323-1999

Windows XP 5.1
IA32
WinAspi: File 'Wnaspi32.dll': Ver=4.71 (0002), size=45056 bytes, created 17/07/2002 00:20:56
ahead WinASPI: File 'C:\Program Files\Ahead\nero\Wnaspi32.dll': Ver=2.0.1.74, size=164112 bytes, created 26/10/2004 17:35:32
Nero version: 6.6.0.5 (Nero Express)
Recorder: Version: TU53 - HA 1 TA 1 - 6.6.0.5
Adapter driver: HA 1
Drive buffer : 2048kB
Bus Type : default (0) -> ATAPI, detected: ?
CD-ROM: Version: 0L06 - HA 1 TA 0 - 6.6.0.5
Adapter driver: HA 1

=== Scsi-Device-Map ===
CdRomPeripheral : HL-DT-ST DVD-ROM GDR8164B nvatabus Port 1 ID 0 DMA: Off
CdRomPeripheral : TOSHIBA CD/DVDW SD-R5372 nvatabus Port 1 ID 1 DMA: Off
DiskPeripheral : Maxtor 6B300S0 nvatabus Port 2 ID 0 DMA: Off

=== CDRom-Device-Map ===
HL-DT-ST DVD-ROM GDR8164 E: CDRom0
TOSHIBA CD/DVDW SD-R5372 F: CDRom1
=======================

AutoRun : 1
Excluded drive IDs:
WriteBufferSize: 83886080 (0) Byte
ShowDrvBufStat : 0
BUFE : 0
Physical memory : 1023MB (1048048kB)
Free physical memory: 355MB (364220kB)
Memory in use : 65 %
Uncached PFiles: 0x0
Use Inquiry : 1
Global Bus Type: default (0)
Check supported media : Disabled (0)

15.10.2008
ISO compilation
11:32:25 #1 Text 0 File Isodoc.cpp, Line 6168
Iso document burn settings
——————————————
Determine maximum speed : FALSE
Simulate : FALSE
Write : TRUE
Finalize CD : TRUE
Multisession : FALSE
Burning mode : DAO
Mode : 1
ISO Level : 1 (Max. of 11 = 8 + 3 char)
Character set : ISO 9660
Joliet : TRUE
Allow pathdepth more than 8 directories : TRUE
Allow more than 255 characters in path : TRUE
Write ISO9660 ;1 file extensions : TRUE

11:32:25 #2 Text 0 File Reader.cpp, Line 127
Reader running

11:32:25 #3 Text 0 File Writer.cpp, Line 122
Writer TOSHIBA CD/DVDW SD-R5372 running

11:32:25 #4 ISO9660GEN -11 File geniso.cpp, Line 3286
First writeable address = 0 (0x00000000)

11:32:26 #5 Text 0 File Burncd.cpp, Line 3155
Turn on Disc-at-once, using DVD media

11:32:26 #6 Text 0 File DlgWaitCD.cpp, Line 257
Last possible write address on media: 2295103 (510:01.28, 4482MB)
Last address to be written: 2171849 (482:37.74, 4241MB)

11:32:26 #7 Text 0 File DlgWaitCD.cpp, Line 269
Write in overburning mode: NO (enabled: CD)

11:32:26 #8 Text 0 File DlgWaitCD.cpp, Line 2310
Recorder: TOSHIBA CD/DVDW SD-R5372, Media type: DVD+R
Disc Manufacturer ID: AML, Media Type ID: 002, Product revision number: 0
Disc Application Code: 0, Extended Information Indicators: 3

11:32:26 #9 Text 0 File DlgWaitCD.cpp, Line 431
>>> Protocol of DlgWaitCD activities: <<<
=========================================

11:32:26 #10 Text 0 File ThreadedTransferInterface.cpp, Line 829
Setup items (after recorder preparation)
0: TRM_DATA_MODE1 ()
2 indices, index0 (150) not provided
original disc pos #0 + 2172000 (2172000) = #2172000/482:40.0
relocatable, disc pos for caching/writing not required/ required, no patch infos
-> TRM_DATA_MODE1, 2048, config 0, wanted index0 0 blocks, length 2172000 blocks [TOSHIBA CD/DVDW SD-R5372]
————————————————————–

11:32:26 #11 Text 0 File ThreadedTransferInterface.cpp, Line 1042
Prepare recorder [TOSHIBA CD/DVDW SD-R5372] for write in CUE-sheet-DAO
DAO infos:
==========
MCN: ""
TOCType: 0x00; Session Closed, disc fixated
Tracks 1 to 1:
1: TRM_DATA_MODE1, 2048/0x00, FilePos 0 0 153288704, ISRC ""
DAO layout:
===========
__Start_|____Track_|_Idx_|_CtrlAdr_|_RecDep__________
0 | lead-in | 0 | 0x41 | 0x00
0 | 1 | 0 | 0x41 | 0x00
0 | 1 | 1 | 0x41 | 0x00
2172000 | lead-out | 1 | 0x41 | 0x00

11:32:26 #12 Phase 24 File dlgbrnst.cpp, Line 1832
Caching of files started

11:32:26 #13 Text 0 File Burncd.cpp, Line 4042
Cache writing successful.

11:32:26 #14 Phase 25 File dlgbrnst.cpp, Line 1832
Caching of files completed

11:32:26 #15 Phase 36 File dlgbrnst.cpp, Line 1832
Burn process started at 4x (5,540 KB/s)

11:32:26 #16 Text 0 File ThreadedTransferInterface.cpp, Line 2604
Verifying disc position of item 0 (relocatable, disc pos, no patch infos, orig at #0): write at #0

11:32:26 #17 Text 0 File Cdrdrv.cpp, Line 8332
—- DVD Structure: Physical Format Information (00h) —-
Layer: 0, Address: 0 (0 h), AGID: 0; Length: 2050
Book Type: DVD+R (10), Part Version: 1
Disc Size: 120 mm, Maximum Rate:

Rorschach112

Post #10November 15, 2008, 5:29 PM UTC

Think you made a mistake, thats not the ComboFix log, could you post that log again

john1701

Post #11November 15, 2008, 5:31 PM UTC

Hi there,
I copyed and pasted the wrong log file for COMBOFIX.
Here is the correct one

John

ComboFix 08-11-13.01 - John 2008-11-15 15:08:37.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.517 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\dao350.dll
c:\windows\system32\MSINET.oca
c:\windows\system32\packet.dll
c:\windows\system32\wanpacket.dll
D:\Autorun.inf
L:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PACKET

((((((((((((((((((((((((( Files Created from 2008-10-15 to 2008-11-15 )))))))))))))))))))))))))))))))
.

2008-11-15 14:50 . 2008-11-15 14:50 d——– C:\_OTMoveIt
2008-11-15 09:52 . 2008-11-15 09:52 578,560 –a–c— c:\windows\system32\dllcache\user32.dll
2008-11-15 09:46 . 2008-11-15 09:46 d——– c:\windows\ERUNT
2008-11-14 23:38 . 2008-11-15 10:30 d——– C:\SDFix
2008-11-14 16:22 . 2008-11-14 16:22 d——– c:\program files\Trend Micro
2008-11-12 10:52 . 2008-09-04 17:15 1,106,944 —–c— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 10:52 . 2008-10-24 11:21 455,296 —–c— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-08 11:24 . 2008-11-08 11:25 d——– c:\documents and settings\John\Application Data\gears
2008-11-05 17:53 . 2008-11-08 11:48 d——– c:\program files\Phun
2008-10-25 14:19 . 2008-10-27 23:44 d——– c:\program files\Another World
2008-10-24 16:47 . 2008-10-15 16:34 337,408 —–c— c:\windows\system32\dllcache\netapi32.dll
2008-10-22 15:12 . 2008-11-13 22:24 d——– c:\program files\Malwarebytes' Anti-Malware
2008-10-22 15:12 . 2008-10-22 15:12 d——– c:\documents and settings\John\Application Data\Malwarebytes
2008-10-22 15:12 . 2008-10-22 15:12 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-10-22 15:12 . 2008-10-22 16:10 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-22 15:12 . 2008-10-22 16:10 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-10-22 15:10 . 2008-10-22 15:10 d——– c:\program files\ERUNT
2008-10-22 14:19 . 2008-10-22 14:19 d——– c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR
2008-10-16 17:48 . 2008-09-15 12:12 1,846,400 —–c— c:\windows\system32\dllcache\win32k.sys
2008-10-16 17:48 . 2008-09-08 10:41 333,824 —–c— c:\windows\system32\dllcache\srv.sys
2008-10-16 17:47 . 2008-08-14 10:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-16 17:47 . 2008-08-14 10:09 2,145,280 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-16 17:47 . 2008-08-14 09:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-16 17:47 . 2008-08-14 09:33 2,023,936 —–c— c:\windows\system32\dllcache\ntkrpamp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-15 11:20 ——— d—–w c:\documents and settings\John\Application Data\MailWasherPro
2008-11-14 11:27 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-13 16:32 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-13 16:32 ——— d—–w c:\program files\SpywareGuard
2008-11-13 16:32 ——— d—–w c:\program files\SpywareBlaster
2008-11-12 10:46 ——— d—–w c:\program files\Spybot - Search & Destroy
2008-11-11 19:27 ——— d—–w c:\program files\SafeIT Security
2008-11-03 22:34 46,322 —-a-w c:\documents and settings\John\Application Data\wklnhst.dat
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-22 14:18 19,972,128 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-10-22 11:15 234,512 –sha-w c:\windows\system32\drivers\fidbox.idx
2008-10-19 13:31 ——— d—–w c:\program files\Common Files\ACD Systems
2008-10-19 10:11 1,615,872 —-a-w c:\windows\Internet Logs\xDB7.tmp
2008-10-17 13:08 1,613,824 —-a-w c:\windows\Internet Logs\xDB6.tmp
2008-10-17 13:06 1,613,824 —-a-w c:\windows\Internet Logs\xDB5.tmp
2008-10-17 13:04 1,613,824 —-a-w c:\windows\Internet Logs\xDB4.tmp
2008-10-08 10:11 ——— d–h–w c:\program files\InstallShield Installation Information
2008-09-26 11:47 ——— d—–w c:\program files\NOS
2008-09-26 11:47 ——— d—–w c:\documents and settings\All Users\Application Data\NOS
2008-09-25 13:15 ——— d—–w c:\program files\Earth Browser
2008-09-25 13:15 ——— d—–w c:\documents and settings\John\Application Data\com.earthbrowser.air.E6AAAE80A01B4127788876406C965C3EDE131099.1
2008-09-25 13:09 ——— d—–w c:\program files\Common Files\Adobe AIR
2008-09-25 13:06 ——— d—–w c:\documents and settings\John\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-09-23 17:17 1,531,904 —-a-w c:\windows\Internet Logs\xDB3.tmp
2008-09-23 17:12 1,534,976 —-a-w c:\windows\Internet Logs\xDB2.tmp
2008-09-23 16:39 1,529,344 —-a-w c:\windows\Internet Logs\xDB1.tmp
2005-11-13 14:41 108,008 —-a-w c:\documents and settings\John\Application Data\GDIPFONTCACHEV1.DAT
1999-05-07 05:22 8,944 —-a-w c:\windows\inf\USBSCAN.SYS
2003-01-13 11:20 278,528 —-a-w c:\program files\internet explorer\plugins\PanoViewer.dll
1999-04-30 16:00 98,304 —-a-w c:\program files\internet explorer\plugins\UPjpeg.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-12-07 84480]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-12-15 5513216]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-12-15 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2005-01-19 110744]
"DSLAGENTEXE"="c:\program files\Voyager 105 ADSL Modem\dslagent.exe" [2004-05-27 16384]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-12 282624]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"nwiz"="nwiz.exe" [2004-12-15 c:\windows\system32\nwiz.exe]
"CARPService"="carpserv.exe" [2003-03-18 c:\windows\system32\carpserv.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]

c:\documents and settings\John\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448]
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-06-24 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
AOL 9.0 Tray Icon.lnk - c:\program files\AOL 9.0\aoltray.exe [2005-01-27 156784]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"DisableLockWorkstation"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Scribble\\Scribble.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R1 bbcap;bbcap;c:\windows\system32\DRIVERS\bbcap.sys [2006-06-04 2944]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-08-04 76040]
R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2004-10-06 945152]
R3 IMT0521;Inmax USB IMT-0521 Smartcard Reader;c:\windows\system32\Drivers\IMT0521.sys [2003-07-11 34825]
S3 SCR33X USB Smart Card Reader;SCR33X USB Smart Card Reader;c:\windows\system32\DRIVERS\SCR33X2K.sys [2003-12-03 63608]
S3 usbprint;Microsoft USB PRINTER Class;c:\windows\system32\DRIVERS\usbprint.sys [2008-04-13 25856]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - e:\menubox\MenuBox.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{498ac933-7017-11d9-bf8c-806d6172696f}]
\Shell\AutoRun\command - E:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58f3c17e-e13c-11db-b34f-806d6172696f}]
\Shell\AutoRun\command - e:\menubox\MenuBox.exe
.
Contents of the 'Scheduled Tasks' folder

2008-11-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-snpstd3 - c:\windows\vsnpstd3.exe

.
——- Supplementary Scan ——-
.
R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.targa.co.uk/
R1 -: HKCU-Internet Settings,ProxyServer =
R1 -: HKCU-Internet Settings,ProxyOverride = ;*.local
O8 -: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 -: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 -: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 -: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 -: { - c:\program files\Messenger\msmsgs.exe
O9 -: {c:\program files\Messenger\msmsgs.exe - -
O15 -: Trusted Zone: *.download.com

O16 -: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} - hxxp://www.alamy.com/uploader/alamy_uploader.cab
c:\windows\Downloaded Program Files\alamy_uploader.ocx
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-15 15:15:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Windows Defender\MsMpEng.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\scardsvr.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2008-11-15 15:24:27 - machine was rebooted [John]
ComboFix-quarantined-files.txt 2008-11-15 15:24:22

Pre-Run: 85,377,662,976 bytes free
Post-Run: 85,261,262,848 bytes free

228 — E O F — 2008-11-13 15:30:30

Rorschach112

Post #12November 15, 2008, 5:32 PM UTC

Hello

Please download the OTMoveIt3 by OldTimer or from here.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{498ac933-7017-11d9-bf8c-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58f3c17e-e13c-11db-b34f-806d6172696f}]

:Files

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

john1701

Post #13November 15, 2008, 10:18 PM UTC

Hello, The Kaspersky scan took some time but it finished eventually. I had to install JAVA to get it to work I hope that was OK. Here are the scan results I did notice that there are a number of Quarantined files from Norton, I got rid of Norton some time ago, should they still be there? BYE John MOVEIT ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E\\ deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{498ac933-7017-11d9-bf8c-806d6172696f}\\ deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58f3c17e-e13c-11db-b34f-806d6172696f}\\ deleted successfully. ========== FILES ========== ========== COMMANDS ========== File delete failed. C:\DOCUME~1\John\LOCALS~1\Temp\~DF5CE6.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\John\LOCALS~1\Temp\~DF5D2F.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\CWLGUVAOCFIIRCUPM\2040 scheduled to be deleted on reboot. Windows Temp folder emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11152008_173523 Files moved on Reboot… File C:\DOCUME~1\John\LOCALS~1\Temp\~DF5CE6.tmp not found! File C:\DOCUME~1\John\LOCALS~1\Temp\~DF5D2F.tmp not found! File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\CWLGUVAOCFIIRCUPM\2040 scheduled to be moved on reboot. MWAM Malwarebytes' Anti-Malware 1.30 Database version: 1400 Windows 5.1.2600 Service Pack 3 15/11/2008 17:44:47 mbam-log-2008-11-15 (17-44-47).txt Scan type: Quick Scan Objects scanned: 52544 Time elapsed: 4 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) KASPERSKY ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Saturday, November 15, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, November 15, 2008 15:59:11 Records in database: 1386080 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan statistics: Files scanned: 295709 Threat name: 15 Infected objects: 20 Suspicious objects: 1 Duration of the scan: 03:46:25 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\017071EA.exe Infected: Trojan.Win32.Small.fb 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\01741BE6.exe Infected: Trojan.Win32.Small.fb 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\157501C8.cab Infected: not-a-virus:Downloader.Win32.WinFixer.ar 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E6C48AA.htm Infected: Exploit.JS.XMLCore.b 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E7072A7.htm Infected: Trojan-Downloader.JS.Agent.cd 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E731CA3.htm Infected: Trojan-Downloader.JS.Agent.bx 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1ED83234.htm Infected: Exploit.HTML.VML.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\20E4376A.wmf Infected: Exploit.Win32.IMG-WMF.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2AD15CCB.tif Suspicious: Exploit.Win32.IMG-WMF 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2F5F01A8.htm Infected: Trojan-Downloader.VBS.Mscount.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\31164182.wmf Infected: Exploit.Win32.IMG-WMF.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3F8E5951.htm Infected: Trojan-Downloader.VBS.Mscount.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4313722F.exe Infected: Trojan.Win32.Small.fb 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69F17C73.htm Infected: Trojan-Downloader.HTML.Agent.aq 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6BC50936.anr Infected: Trojan-Downloader.Win32.Ani.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\70ED4DAC.cab Infected: not-a-virus:Downloader.Win32.WinFixer.ar 1 C:\Documents and Settings\John\Local Settings\Application Data\Identities\{D82983AC-438A-4528-8649-AE93B418CBBB}\Microsoft\Outlook Express\Sent Items.dbx Infected: Trojan-Spy.HTML.Bankfraud.hs 2 C:\Documents and Settings\John\My Documents\My Downloads\old stuff\xtreme.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1 C:\Documents and Settings\John\My Documents\My Downloads\old stuff\xtreme.exe Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k 1 C:\Documents and Settings\John\My Documents\My Downloads\old stuff\xtreme.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1 The selected area was scanned.

Rorschach112

Post #14November 16, 2008, 12:06 AM UTC

Delete this file C:\Documents and Settings\John\My Documents\My Downloads\old stuff\xtreme.exe And post a new HJT log

john1701

Post #15November 16, 2008, 11:03 AM UTC

Hi There,

Deleted the file and ran HJT.

New HJT Log below

Thanks

John

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:00:46, on 16/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\FireTrust\MailWasher Free\MailWasher.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.targa.co.uk/
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.targa.co.uk/
O15 - Trusted Zone: http://*.akamai.net
O15 - Trusted Zone: http://www.amazon.co.uk
O15 - Trusted Zone: http://content.ancestry.co.uk
O15 - Trusted Zone: http://search.ancestry.co.uk
O15 - Trusted Zone: http://www.ancestry.co.uk
O15 - Trusted Zone: http://akamai.avg.com
O15 - Trusted Zone: http://update.avg.com
O15 - Trusted Zone: http://akamai.avg.cz
O15 - Trusted Zone: http://backup.avg.cz
O15 - Trusted Zone: http://download.avg.cz
O15 - Trusted Zone: http://files2.avg.cz
O15 - Trusted Zone: http://www.botanicalkeys.co.uk
O15 - Trusted Zone: http://www.brightminds.co.uk
O15 - Trusted Zone: http://www.download.com
O15 - Trusted Zone: *.download.com
O15 - Trusted Zone: http://akamai.avg.com.edgesuite.net
O15 - Trusted Zone: http://akamai.avg.cz.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.com.edgesuite.net
O15 - Trusted Zone: http://akamai.grisoft.cz.edgesuite.net
O15 - Trusted Zone: http://www.freebmd.org.uk
O15 - Trusted Zone: http://www.galaxyzoo.org
O15 - Trusted Zone: http://www.genesreunited.com
O15 - Trusted Zone: http://www.google.co.uk
O15 - Trusted Zone: http://akamai.grisoft.com
O15 - Trusted Zone: http://free.grisoft.com
O15 - Trusted Zone: http://uodate.grisoft.com
O15 - Trusted Zone: http://www.grisoft.com
O15 - Trusted Zone: http://akamai.grisoft.cz
O15 - Trusted Zone: http://download.grisoft.cz
O15 - Trusted Zone: http://files2.grisoft.cz
O15 - Trusted Zone: http://www.hotmail.com
O15 - Trusted Zone: http://www.lidl.co.uk
O15 - Trusted Zone: http://login.live.com
O15 - Trusted Zone: http://www.msn.co.uk
O15 - Trusted Zone: http://by102fd.bay102.hotmail.msn.com
O15 - Trusted Zone: http://uk.msn.com
O15 - Trusted Zone: http://www.msn.com
O15 - Trusted Zone: http://www.nationalarchives.gov.uk
O15 - Trusted Zone: http://www.netto.co.uk
O15 - Trusted Zone: http://www.networkmagic.com
O15 - Trusted Zone: http://www.open.ac.uk
O15 - Trusted Zone: http://www.scotlandspeople.gov.uk
O15 - Trusted Zone: http://www.spatial-literacy.org
O15 - Trusted Zone: http://www.symantec.com
O15 - Trusted Zone: http://www.zonealarm.com
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.uclan.ac.uk/other/iss/remote/wficat.cab
O16 - DPF: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} (AlamyUploader Class) - http://www.alamy.com/uploader/alamy_uploader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106832058390
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-03.sun.com/s/ESD5/JSCDL/jre…ows-i586-jc.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 12729 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] brastk.exe found after scan

✨ Ask AI

Ask AI