1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

generic trojan.xfv - can't get rid of it :(

Discussion in 'Malware and Virus Removal Archive' started by yuvalsh, 2006/07/17.

  1. 2006/07/17
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    Hi,

    I found your forum using google - and I got to the following thread:
    http://www.windowsbbs.com/showthread.php?t=55856

    I have a similar problem : a VOX generic and a XFV generic trojan.

    I got these names after I installed AVG and this is after Norton refused to tell me the name of the trojan and couldn't get rid of it.

    Anyway should I follow the same instructions you gave that guy in that forum? I don't know if it's the same case....

    this is my HJT log:

    Logfile of HijackThis v1.99.1
    Scan saved at 09:57:37, on 17/07/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\TPHDEXLG.EXE
    C:\WINDOWS\system32\TpKmpSVC.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\system32\TpShocks.exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\IBMTOOLS\UTILS\ibmprc.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MAFWTray.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\IBM\Bluetooth Software\BTTray.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\hjt\HijackThis.exe

    R3 - URLSearchHook: (no name) - {5EC19513-F9D6-75D4-9A87-27092F45DE67} - powerdll.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
    O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
    O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
    O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
    O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [nvmun.exe] C:\WINDOWS\system32\nvmun.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Spurl! - http://www.spurl.net/rclick.php
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Spurl! - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Bookmark the current page to Spurl.net - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra button: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O11 - Options group: [JAVA_IBM] Java (IBM)
    O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.ims.tau.ac.il/inc/ScriptX.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/135p/html/gtdownlr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123793940598
    O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{07980B2E-7581-46FC-AB6C-9A42272F393A}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{34B60C49-1FA1-47CB-A1A3-1CD18085E85F}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{6F5A31DE-4877-4D29-A2F9-152B7CC8D6CA}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC4E1F4-E81F-4E98-BD68-536AF291E92D}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9E42551F-8C32-4C1D-9AF0-3E2A57EF6A99}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.147 85.255.112.76
    O17 - HKLM\System\CS1\Services\Tcpip\..\{07980B2E-7581-46FC-AB6C-9A42272F393A}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.147 85.255.112.76
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
    O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
     
    yuvalsh,
    #1
  2. 2006/07/17
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    yuvalsh - Welcome to the Board :)

    Although your problem may be similar to the one you found on WindowsBBS no two computers are the same and the infection patterns will differ.

    Your HJT log shows the presence of a Wareout infection ....

    I quote from the post you found....
    Please do this and we will proceed from there.
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2006/07/17
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    I think it got only worse

    this is the report.txt . things are bad my homepaged is changed It found new trojans....


    Fixwareout ver 1.003
    Last edited 07/1/2006
    Post this report in the forums please

    Reg Entries that were deleted
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B35B97FDE38A-3C09-3B84-3BB8-EDA6EF58{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\mrbmd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}72B2CC5894FA-CCBB-D9E4-636F-69DA0CAE{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E0B6CD2493AC-EF59-E744-6B7B-4C15AA16{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}86C26AD8A4F3-8F48-88E4-A84F-AE020B53{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8F00229832A7-ACEA-48F4-37A3-1D16579B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}676A0CE63962-4458-B574-7184-64CCBBC4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0FA415F9C0A-DD79-4B44-C46D-054663C9{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}419E4574F892-D508-3D54-0188-680A33F2{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}61A3966FE92D-395B-9F54-65E3-57421B38{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}797667672A6A-C21A-1994-6D71-F4BE84CB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E0DE0CED8299-B4FA-B534-F8C4-05B72883{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0D77A40EB399-7D0A-BDF4-9A34-A43DCD47{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C973025B751A-4C88-5B14-759F-93C8C638{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}522F444B40F8-F5AA-4244-0F35-43DCCE21{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}297E52077A87-E3FB-BF94-C4F3-B6767B22{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}311D7AAFADBC-3809-4A94-CC90-28748255{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}546EA703284D-8869-0A34-0FE5-B62102E7{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CF9C4366E464-D848-F8C4-D2C6-FF4AC4B7{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CE245467D14E-EA8A-9FB4-6CE3-BCA40505{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}94B5598C80BA-9A09-DBE4-4E36-0E1C2B0B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B6669C3325BD-5C29-9ED4-87CC-C161C226{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}37610CA4FF92-17EB-E214-C494-B24E6BD6{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CAAB091AD8F6-1C0A-BFA4-6F50-887BC5F1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C747414CC69F-9818-3434-CFAE-5A718A44{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}73A117ECB68D-4EB8-38E4-DB75-EB151509{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8FBECD3AB1C9-AE69-F064-2C0C-8E218EC4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FEBDD50A6A25-1EFB-2A14-AB10-6D3F7DF3{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D9F5E7C8FD6D-1069-AED4-CBA8-597FECEA{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EA119D519874-47EA-4CC4-2BE0-04C3F643{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}31A9E88C090B-1089-E394-1828-01EA8BD3{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}20A5770DB8BF-56FB-1C94-2B0D-39B34AE1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5362CAFE3313-2B1A-CA14-F017-AE1278C1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C9A48B8FF970-B8DB-8D04-7606-79B118B4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7B7FF2640E1D-D5E8-9D04-9807-DAFD8951{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}72CC7F4ACA19-99EB-1304-57AB-76BABE74{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}17DDB9CC760E-D069-AF54-E669-412DFD3F{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}702E267EF28D-FEBB-C4C4-D989-478AC83D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7C5AD0ABA9A9-E8CA-6304-B707-79963A7E{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8468590DAD78-0179-66E4-E5C2-F445FECD{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}50C0AA2346FB-87BA-7DA4-2243-EAE76D23{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}412A5FA161D1-5F9B-1FB4-876C-731013E0{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5CEA8AB583D7-833B-6C94-B103-0C685DDF{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04F53AA170A3-FA89-8974-2DB9-2F1598BF{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}61DD18F9E976-2598-0664-F6F8-793021B7{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2FEEE57A8862-7D4A-D704-CDEF-E083029C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}10B7B52271EF-724A-B054-0D74-4092F13E{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CCE53BCE61B1-2B68-7C54-0644-3EC93926{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F0454DA5B7DD-FB38-CB34-5FFB-9B9A8264{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7D5BE9C2C0B5-DA18-A804-97E6-EF5F6AB0{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E39E58643DAD-A5E9-7684-2154-BAB5B814{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DC4DCC71B76A-C958-2974-24D4-730C823D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}682B1B89ECF2-48F8-8784-DF81-11DC6121{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B3F7DFA0FEF5-583B-7AB4-2732-237B6357{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C559E2EFF1AC-2A68-78C4-9897-4EA20332{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}98E2F2217489-0768-E864-BA84-43E47EDF{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1794826F4D54-B698-E184-EDD7-918F1898{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F2A03561BD1F-772A-F9B4-1B78-9D7A40C1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EFD93C177929-E479-F034-2B5D-A142026D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}507771338E0D-86A9-3BD4-C8A2-A23EA8DA{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}27750458BF99-6849-8764-B04D-DE235F69{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}56EDE6F35AC8-A3A8-5174-261B-FA2C33AB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5A0B59D6F0D8-8388-0F84-EF07-EF42597C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F31803737807-6E18-DBE4-6870-F4314685{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6385E51EB748-B2C9-7EB4-7AD3-07A3FCE8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5910ABD0FFCE-3C99-9234-4817-0788D801{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6507A2BA58BB-F41A-4FF4-DD0D-9A61D6F6{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FF16BF39DA64-AA4A-9424-3BA2-CB3C8531{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2B3D2334AF61-5D5B-F3B4-1B9A-565D5624{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B23946ED7F58-0EBA-33A4-191F-8A819FCD{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A6D986CBE73F-9E19-FB14-E5CF-6B343A8C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4DB2EBED9970-B3DA-19D4-55BB-6FAD8393{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D99B907AC51E-961A-0D84-9887-BA8D38CA{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EE7B37F402C4-887A-EC04-4AB9-0050CE79{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3306AD05ECB9-6B1B-4A64-E070-E132B760{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8CC16D64F216-D119-4714-8264-E2F52182{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}74F98A34883B-FE39-7A44-48F3-117B9C6D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AF7C6D0A2BC7-800A-79C4-EA66-9AA1955C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EEEAC0352B61-3D58-99D4-23C2-2E542D50{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3A7699492AD8-545B-03C4-B27C-F58B5BA6{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}91B0351AA73E-876B-3264-4A00-492A221D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2E817488EBEC-A3F8-9A04-1441-89C57DDE{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}77AE1F9CA38E-4979-1674-A5C7-20B4128D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DBB8EB6197E3-73DA-B754-C1F5-590D07DB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3CC2A5026248-6D5B-7344-5547-4BA1EF7D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3AC7E7942DCC-828A-2904-34C9-B937EB5B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}56ECD4C81F47-12B9-6D14-CD00-76A1B410{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C467299C9AFE-8FDB-CC24-A0ED-106370BC{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}86152FDF5F39-8E9A-35D4-BBB8-53897BCB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EF42E3E78EC1-3938-3B64-FE1D-667FAAD1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DC647606D50D-D9BA-4CE4-DD82-C7D86E55{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C27EE882EB39-3A0A-2374-140E-A0FAC1E1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}556087D4EFF9-BD3A-57D4-34A1-1A42E9BC{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1B2B33397EDA-647B-8944-A089-E78BC66C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A23A95A06032-9CB8-2514-E9D8-16AAA1DE{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1CA1A2D7160B-0128-0C44-9FF5-C7E67D7D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}58A172009273-2D69-2A94-376A-14047421{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}844401EAF944-9378-C624-33F2-2773F361{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}25FDF2B067CA-7109-58C4-E8A8-BE13E61A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DA4D1F5C7BF7-1F0B-6314-98E4-FF5EBEAA{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9E82FCB28D8B-F3BA-F2F4-5980-19FEFA88{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6286F635155D-28C9-D404-3768-593E526B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F6EAC61946F9-EA2A-4F94-2635-F07C022A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}789A4BAAB30C-D899-F734-7971-A2B3FB61{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ED7823343006-EE6B-0274-A7E8-EA816E26{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\owt
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
    ...

    Microsoft (R) Windows Script Host Version 5.6
    Random Runs removed from HKLM
    "dmbrm.exe "=-
    ...

    PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
    Example ipsec6.exe is legitimate

    »»»»» Search by size and names...
    C:\WINDOWS\SYSTEM32\IPSEC6.EXE
    * csr.exe C:\WINDOWS\System32\CSJMC.EXE

    »»»»» Misc files

    »»»»» Checking for older varients covered by the Rem3 tool

    »»»»»
    Search five digit cs, dm and jb files
    This WILL/CAN also list Legit Files, Submit them at Virustotal
    C:\WINDOWS\SYSTEM32\CSJMC.EXE 51,257 2006-07-13
    C:\WINDOWS\SYSTEM32\DMBRM.EXE 62,009 2004-08-04
    Other suspects
    Directory of C:\WINDOWS\system32
    {62E618AE-8E7A-4720-B6EE-6003433287DE}.exe
    {16BF3B2A-1797-437F-998D-C03BAAB4A987}.exe
    {A220C70F-5362-49F4-A2AE-9F64916CAE6F}.exe
    {B625E395-8673-404D-9C82-D551536F6826}.exe
    {88AFEF91-0895-4F2F-AB3F-B8D82BCF28E9}.exe
    {AAEBE5FF-4E89-4136-B0F1-7FB7C5F1D4AD}.exe
    {A16E31EB-8A8E-4C85-9017-AC760B2FDF52}.exe
    {163F3772-2F33-426C-8739-449FAE104448}.exe
    {12474041-A673-49A2-96D2-372900271A85}.exe
    {D7D76E7C-5FF9-44C0-8210-B0617D2A1AC1}.exe
    {ED1AAA61-8D9E-4152-8BC9-23060A59A32A}.exe
    {C66CB87E-980A-4498-B746-ADE79333B2B1}.exe
    {CB9E24A1-1A43-4D75-A3DB-9FFE4D780655}.exe
    {1E1CAF0A-E041-4732-A0A3-93BE288EE72C}.exe
    {55E68D7C-28DD-4EC4-AB9D-D05D606746CD}.exe
    {1DAAF766-D1EF-46B3-8393-1CE87E3E24FE}.exe
    {BCB79835-8BBB-4D53-A9E8-93F5FDF25168}.exe
    {CB073601-DE0A-42CC-BDF8-EFA9C992764C}.exe
    {014B1A67-00DC-41D6-9B21-74F18C4DCE65}.exe
    {B5BE739B-9C43-4092-A828-CCD2497E7CA3}.exe
    {D7FE1AB4-7455-4437-B5D6-8426205A2CC3}.exe
    {BD70D095-5F1C-457B-AD37-3E7916BE8BBD}.exe
    {D8214B02-7C5A-4761-9794-E83AC9F1EA77}.exe
    {EDD75C98-1441-40A9-8F3A-CEBE884718E2}.exe
    {D122A294-00A4-4623-B678-E37AA1530B19}.exe
    {6AB5B85F-C72B-4C30-B545-8DA2949967A3}.exe
    {05D245E2-2C32-4D99-85D3-16B2530CAEEE}.exe
    {C5591AA9-66AE-4C97-A008-7CB2A0D6C7FA}.exe
    {D6C9B711-3F84-44A7-93EF-B38843A89F47}.exe
    {28125F2E-4628-4174-911D-612F46D61CC8}.exe
    {067B231E-070E-46A4-B1B6-9BCE50DA6033}.exe
    {97EC0500-9BA4-40CE-A788-4C204F73B7EE}.exe
    {AC83D8AB-7889-48D0-A169-E15CA709B99D}.exe
    {3938DAF6-BB55-4D91-AD3B-0799DEBE2BD4}.exe
    {C8A343B6-FC5E-41BF-91E9-F37EBC689D6A}.exe
    {DCF918A8-F191-4A33-ABE0-85F7DE64932B}.exe
    {4265D565-A9B1-4B3F-B5D5-16FA4332D3B2}.exe
    {1358C3BC-2AB3-4249-A4AA-46AD93FB61FF}.exe
    {6F6D16A9-D0DD-4FF4-A14F-BB85AB2A7056}.exe
    {108D8870-7184-4329-99C3-ECFF0DBA0195}.exe
    {8ECF3A70-3DA7-4BE7-9C2B-847BE15E5836}.exe
    {5864134F-0786-4EBD-81E6-70873730813F}.exe
    {C79524FE-70FE-48F0-8838-8D0F6D95B0A5}.exe
    {BA33C2AF-B162-4715-8A3A-8CA53F6EDE65}.exe
    {96F532ED-D40B-4678-9486-99FB85405772}.exe
    {AD8AE32A-2A8C-4DB3-9A68-D0E833177705}.exe
    {D620241A-D5B2-430F-974E-929771C39DFE}.exe
    {1C04A7D9-87B1-4B9F-A277-F1DB16530A2F}.exe
    {8981F819-7DDE-481E-896B-45D4F6284971}.exe
    {FDE74E34-48AB-468E-8670-9847122F2E89}.exe
    {23302AE4-7989-4C87-86A2-CA1FFE2E955C}.exe
    {7536B732-2372-4BA7-B385-5FEF0AFD7F3B}.exe
    {1216CD11-18FD-4878-8F84-2FCE98B1B286}.exe
    {D328C037-4D42-4792-859C-A67B17CCD4CD}.exe
    {418B5BAB-4512-4867-9E5A-DAD34685E93E}.exe
    {0BA6F5FE-6E79-408A-81AD-5B0C2C9EB5D7}.exe
    {4628A9B9-BFF5-43BC-83BF-DD7B5AD4540F}.exe
    {62939CE3-4460-45C7-86B2-1B16ECB35ECC}.exe
    {E31F2904-47D0-450B-A427-FE17225B7B01}.exe
    {C920380E-FEDC-407D-A4D7-2688A75EEEF2}.exe
    {7B120397-8F6F-4660-8952-679E9F81DD16}.exe
    {FB8951F2-9BD2-4798-98AF-3A071AA35F40}.exe
    {FDD586C0-301B-49C6-B338-7D385BA8AEC5}.exe
    {0E310137-C678-4BF1-B9F5-1D161AF5A214}.exe
    {32D67EAE-3422-4AD7-AB78-BF6432AA0C05}.exe
    {DCEF544F-2C5E-4E66-9710-87DAD0958648}.exe
    {E7A36997-707B-4036-AC8E-9A9ABA0DA5C7}.exe
    {D38CA874-989D-4C4C-BBEF-D82FE762E207}.exe
    {F3DFD214-966E-45FA-960D-E067CC9BDD71}.exe
    {47EBAB67-BA75-4031-BE99-91ACA4F7CC27}.exe
    {1598DFAD-7089-40D9-8E5D-D1E0462FF7B7}.exe
    {4B811B97-6067-40D8-BD8B-079FF8B84A9C}.exe
    {1C8721EA-710F-41AC-A1B2-3133EFAC2635}.exe
    {1EA43B93-D0B2-49C1-BF65-FB8BD0775A02}.exe
    {3DB8AE10-8281-493E-9801-B090C88E9A13}.exe
    {346F3C40-0EB2-4CC4-AE74-478915D911AE}.exe
    {AECEF795-8ABC-4DEA-9601-D6DF8C7E5F9D}.exe
    {3FD7F3D6-01BA-41A2-BFE1-52A6A05DDBEF}.exe
    {4CE812E8-C0C2-460F-96EA-9C1BA3DCEBF8}.exe
    {905151BE-57BD-4E83-8BE4-D86BCE711A37}.exe
    {44A817A5-EAFC-4343-8189-F96CC414747C}.exe
    {1F5CB788-05F6-4AFB-A0C1-6F8DA190BAAC}.exe
    {6DB6E42B-494C-412E-BE71-29FF4AC01673}.exe
    {622C161C-CC78-4DE9-92C5-DB5233C9666B}.exe
    {B0B2C1E0-63E4-4EBD-90A9-AB08C8955B49}.exe
    {50504ACB-3EC6-4BF9-A8AE-E41D764542EC}.exe
    {7B4CA4FF-6C2D-4C8F-848D-464E6634C9FC}.exe
    {7E20126B-5EF0-43A0-9688-D482307AE645}.exe
    {55284782-09CC-49A4-9083-CBDAFAA7D113}.exe
    {22B7676B-3F4C-49FB-BF3E-78A77025E792}.exe
    {12ECCD34-53F0-4424-AA5F-8F04B444F225}.exe
    {836C8C39-F957-41B5-88C4-A157B520379C}.exe
    {74DCD34A-43A9-4FDB-A0D7-993BE04A77D0}.exe
    {38827B50-4C8F-435B-AF4B-9928DEC0ED0E}.exe
    {BC48EB4F-17D6-4991-A12C-A6A276766797}.exe
    {83B12475-3E56-45F9-B593-D29EF6693A16}.exe
    {2F33A086-8810-45D3-805D-298F4754E914}.exe
    {9C366450-D64C-44B4-97DD-A0C9F514AF0B}.exe
    {4CBBCC46-4817-475B-8544-26936EC0A676}.exe
    {B97561D1-3A73-4F84-AECA-7A23892200F8}.exe
    {35B020EA-F48A-4E88-84F8-3F4A8DA62C68}.exe
    {61AA51C4-B7B6-447E-95FE-CA3942DC6B0E}.exe
    {9910D461-7BFA-422C-8A7A-FC61C177CE68}.exe
    {EAC0AD96-F636-4E9D-BBCC-AF4985CC2B27}.exe
    {9D00433C-9861-4FA7-8B34-1E4C93E2EE74}.exe
     
    yuvalsh,
    #3
  5. 2006/07/17
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Would you please post a new HJT log please - as originally requested.
     
    PeteC,
    #4
  6. 2006/07/18
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    late hijack log

    this is the hijackthis log. I want to say again that the situation seems mmuch worse after I installed the fix. "kill & clean" found itself back into my desktop, my homepage has changed... are you sure the link you gave me is good? or this was supposed to happen?


    Logfile of HijackThis v1.99.1
    Scan saved at 07:49:39, on 19/07/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\TPHDEXLG.EXE
    C:\WINDOWS\system32\TpKmpSVC.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\system32\TpShocks.exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\IBMTOOLS\UTILS\ibmprc.exe
    C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MAFWTray.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\IBM\Bluetooth Software\BTTray.exe
    C:\hjt\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

    R3 - URLSearchHook: (no name) - {5EC19513-F9D6-75D4-9A87-27092F45DE67} - powerdll.dll (file missing)
    R3 - URLSearchHook: (no name) - {0C8C008D-D5FC-4DEE-5047-06F073CB9A6E} - stuffmon.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{2ECB0A6C-37C0-4F97-A705-EABE4744722F}.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{2ECB0A6C-37C0-4F97-A705-EABE4744722F}.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
    O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
    O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
    O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
    O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [ms-its] ActionScr.exe
    O4 - HKLM\..\Run: [zantu] sound64.exe
    O4 - HKLM\..\Run: [imxtr.exe] C:\WINDOWS\system32\imxtr.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe "
    O4 - HKCU\..\Run: [SetupExeDll] slamm.exe
    O4 - HKCU\..\Run: [avpmondll] trycrt.exe
    O4 - HKCU\..\Run: [iesetupdll] driver32.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Spurl! - http://www.spurl.net/rclick.php
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Spurl! - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Bookmark the current page to Spurl.net - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra button: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O9 - Extra button: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\KillAndClean\KillAndClean.exe (HKCU)
    O9 - Extra 'Tools' menuitem: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\KillAndClean\KillAndClean.exe (HKCU)
    O11 - Options group: [JAVA_IBM] Java (IBM)
    O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.ims.tau.ac.il/inc/ScriptX.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/135p/html/gtdownlr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123793940598
    O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{07980B2E-7581-46FC-AB6C-9A42272F393A}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{34B60C49-1FA1-47CB-A1A3-1CD18085E85F}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{6F5A31DE-4877-4D29-A2F9-152B7CC8D6CA}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC4E1F4-E81F-4E98-BD68-536AF291E92D}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9E42551F-8C32-4C1D-9AF0-3E2A57EF6A99}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.147 85.255.112.76
    O17 - HKLM\System\CS1\Services\Tcpip\..\{07980B2E-7581-46FC-AB6C-9A42272F393A}: NameServer = 85.255.113.147,85.255.112.76
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.147 85.255.112.76
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
    O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
     
    yuvalsh,
    #5
  7. 2006/07/19
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    I'm leaving on a trip in about an hour - I will pass this thread over to TeMerc
     
    PeteC,
    #6
  8. 2006/07/19
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    Hello, I will be taking over for Pete.

    First off, lets remove the AVG anti virus, seeing as the Norton app you paid for. Running them both at once must have a noticable effect on performance.

    Don't neccessarily blame Norton for not giving the infection a name. There are many variants of this infection, and typiclally most avs won't have all signitures for all the variants. And this isn't really a virus or a worm, but just an annoying peice of malware.

    Lets go thru some of this log file and remove some things and then run another anti spyware scan as well.

    Below you will find my results and recommendations. Please read ALL instructions carefully BEFORE proceeding.

    Copy the instructions down as we will be working in 'Safe Mode' without Internet connection.

    First download Ewido Anti-Spyware from HERE and save that file to your desktop.
    This is a 30 day trial of the program
    1. Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
    2. Once the setup is complete you will need run ewido and update the definition files.
    3. On the main screen select the icon "Update" then select the "Update now" link.
      • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
    4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
    5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine ".
    6. Under "Reports "
      • Select "Automatically generate report after every scan "
      • Un-Select "Only if threats were found "
    Close ewido anti-spyware, Do Not run a scan just yet, we will shortly

    Reboot, into safe mode, this way:
    Turn on the computer
    Immediately begin tapping the <F8> key.
    Use the arrow keys to highlight Safe Mode and press the <Enter> key.

    Also, enable the 'Show Hidden Folders' option, like this:
    Click Start.
    Open My Computer.
    Select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders.
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm.
    Click OK.

    Please go to Add/Remove, and if found, uninstall the following:
    Kill and Clean

    Run Hijackthis and look over the following entries I have listed, check the boxes next to them and press the "Fix Checked" button with HijackThis. When you are doing this, make sure you have No IE windows, or other browsers open, including this one. Reboot if I have specified below, and post a fresh HijackThis log.


    R3 - URLSearchHook: (no name) - {5EC19513-F9D6-75D4-9A87-27092F45DE67} - powerdll.dll (file missing)

    R3 - URLSearchHook: (no name) - {0C8C008D-D5FC-4DEE-5047-06F073CB9A6E} - stuffmon.dll (file missing)


    O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{2ECB0A6C-37C0-4F97-A705-EABE4744722F}.dll

    O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{2ECB0A6C-37C0-4F97-A705-EABE4744722F}.dll


    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    O4 - HKLM\..\Run: [ms-its] ActionScr.exe

    O4 - HKLM\..\Run: [zantu] sound64.exe

    O4 - HKLM\..\Run: [imxtr.exe] C:\WINDOWS\system32\imxtr.exe

    O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe "

    O4 - HKCU\..\Run: [SetupExeDll] slamm.exe

    O4 - HKCU\..\Run: [avpmondll] trycrt.exe

    O4 - HKCU\..\Run: [iesetupdll] driver32.exe


    O9 - Extra button: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program
    Files\KillAndClean\KillAndClean.exe (HKCU)

    O9 - Extra 'Tools' menuitem: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\KillAndClean\KillAndClean.exe (HKCU)


    O17 - HKLM\System\CCS\Services\Tcpip\..\{07980B2E-7581-46FC-AB6C-9A42272F393A}: NameServer = 85.255.113.147,85.255.112.76

    O17 - HKLM\System\CCS\Services\Tcpip\..\{34B60C49-1FA1-47CB-A1A3-1CD18085E85F}: NameServer = 85.255.113.147,85.255.112.76

    O17 - HKLM\System\CCS\Services\Tcpip\..\{6F5A31DE-4877-4D29-A2F9-152B7CC8D6CA}: NameServer = 85.255.113.147,85.255.112.76

    O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC4E1F4-E81F-4E98-BD68-536AF291E92D}: NameServer = 85.255.113.147,85.255.112.76

    O17 - HKLM\System\CCS\Services\Tcpip\..\{9E42551F-8C32-4C1D-9AF0-3E2A57EF6A99}: NameServer = 85.255.113.147,85.255.112.76

    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.147 85.255.112.76

    O17 - HKLM\System\CS1\Services\Tcpip\..\{07980B2E-7581-46FC-AB6C-9A42272F393A}: NameServer = 85.255.113.147,85.255.112.76

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.147 85.255.112.76

    And search for, then delete, if found, (some may not be present after previous steps) the following files/folders:
    C:\Program Files\KillAndClean<<<<--this folder
    C:\WINDOWS\system32\imxtr.exe<<<--file
    {2ECB0A6C-37C0-4F97-A705-EABE4744722F}.dll<<<--file
    driver32.exe<<<--file
    trycrt.exe<<<--file
    slamm.exe<<<--file
    sound64.exe<<<--file
    ActionScr.exe<<<--file
    stuffmon.dll <<<--file
    powerdll.dll <<<--file

    Return to Ewido
    • Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan ".
    • ewido will now begin the scanning process, be patient this may take a little time.
      Once the scan is complete do the following:
    • If you have any infections you will prompted, then select "Apply all actions "
    • Next select the "Reports" icon at the top.
    • Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
    • Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan and a fresh HJT log file as well.
     
    TeMerc,
    #7
  9. 2006/07/19
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    2 logs as requested

    Logfile of HijackThis v1.99.1
    Scan saved at 23:23:14, on 19/07/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\system32\TpShocks.exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\IBMTOOLS\UTILS\ibmprc.exe
    C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MAFWTray.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\IBM\Bluetooth Software\BTTray.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\TPHDEXLG.EXE
    C:\WINDOWS\system32\TpKmpSVC.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\hjt\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
    O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
    O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
    O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
    O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Spurl! - http://www.spurl.net/rclick.php
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Spurl! - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Bookmark the current page to Spurl.net - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra button: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O11 - Options group: [JAVA_IBM] Java (IBM)
    O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.ims.tau.ac.il/inc/ScriptX.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/135p/html/gtdownlr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123793940598
    O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
    O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
     
    yuvalsh,
    #8
  10. 2006/07/19
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    ewido part 1

    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 22:25:43 19/07/2006

    + Scan result:



    HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj.1 -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj\CLSID -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\ToolBand.ToolBandObj\CurVer -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\gtdownlr_118.ocx -> Adware.Gdown : Cleaned with backup (quarantined).
    C:\music\Elton John - Goodbye Yellow Brick Road - CD1 (SACD to DTS)\DTS player & info\DTS Tools ( DVD Audio 5.1 AC To DTS ).rar/DTS Tools ( DVD Audio 5.1 AC To DTS )\SurCode CD-pro DTS 1.0.9\Crack\sccdprodts.exe -> Backdoor.Theef.111 : Cleaned with backup (quarantined).
    [272] VM_034E0000 -> Downloader.Agent.uj : Error during cleaning.
    [296] VM_00C00000 -> Downloader.Agent.uj : Error during cleaning.
    [928] VM_009E0000 -> Downloader.Agent.uj : Error during cleaning.
    :mozilla.10:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    :mozilla.11:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    :mozilla.150:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    :mozilla.151:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    :mozilla.8:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    :mozilla.9:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Yuval\Cookies\yuval@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Yuval\Cookies\yuval@msnisrael.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    :mozilla.196:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
    :mozilla.22:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
    :mozilla.23:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
    C:\Documents and Settings\Yuval\Cookies\yuval@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined).
    :mozilla.129:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
    :mozilla.130:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
    :mozilla.131:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
    :mozilla.132:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
    :mozilla.133:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
    :mozilla.25:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
    :mozilla.274:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).
    :mozilla.275:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).
    C:\Documents and Settings\Yuval\Cookies\yuval@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
    :mozilla.47:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
    :mozilla.50:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Centrport : Cleaned with backup (quarantined).
    :mozilla.62:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).
    :mozilla.63:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).
    :mozilla.54:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
    :mozilla.55:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
    :mozilla.24:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
    C:\Documents and Settings\Yuval\Cookies\yuval@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
    :mozilla.116:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned with backup (quarantined).
    :mozilla.282:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
    :mozilla.283:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
    C:\Documents and Settings\Yuval\Cookies\yuval@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
    :mozilla.193:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
    :mozilla.194:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
    :mozilla.28:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
    :mozilla.29:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
    :mozilla.30:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
    :mozilla.31:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
    :mozilla.32:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
    :mozilla.160:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined).
    :mozilla.161:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined).
    :mozilla.162:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup (quarantined).
    :mozilla.164:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
    :mozilla.180:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    :mozilla.181:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    :mozilla.182:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    :mozilla.183:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    :mozilla.57:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined).
    :mozilla.58:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined).
    :mozilla.59:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined).
    :mozilla.60:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup (quarantined).
    :mozilla.195:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
    :mozilla.205:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    :mozilla.206:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    :mozilla.210:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
    C:\Documents and Settings\Yuval\Cookies\yuval@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
    :mozilla.17:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    :mozilla.18:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    :mozilla.19:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    :mozilla.20:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    :mozilla.21:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    :mozilla.276:C:\Documents and Settings\Yuval\Application Data\Mozilla\Firefox\Profiles\sjc5m7yx.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
     
    yuvalsh,
    #9
  11. 2006/07/19
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    ewido part 2

    C:\WINDOWS\system32\{EAC0AD96-F636-4E9D-BBCC-AF4985CC2B27}.exe -> Trojan.Hoster : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{014B1A67-00DC-41D6-9B21-74F18C4DCE65}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{05D245E2-2C32-4D99-85D3-16B2530CAEEE}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{067B231E-070E-46A4-B1B6-9BCE50DA6033}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{0BA6F5FE-6E79-408A-81AD-5B0C2C9EB5D7}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{0E310137-C678-4BF1-B9F5-1D161AF5A214}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{108D8870-7184-4329-99C3-ECFF0DBA0195}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1216CD11-18FD-4878-8F84-2FCE98B1B286}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{12474041-A673-49A2-96D2-372900271A85}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{12ECCD34-53F0-4424-AA5F-8F04B444F225}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1358C3BC-2AB3-4249-A4AA-46AD93FB61FF}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1598DFAD-7089-40D9-8E5D-D1E0462FF7B7}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{163F3772-2F33-426C-8739-449FAE104448}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{16BF3B2A-1797-437F-998D-C03BAAB4A987}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1C04A7D9-87B1-4B9F-A277-F1DB16530A2F}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1C8721EA-710F-41AC-A1B2-3133EFAC2635}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1DAAF766-D1EF-46B3-8393-1CE87E3E24FE}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1E1CAF0A-E041-4732-A0A3-93BE288EE72C}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1EA43B93-D0B2-49C1-BF65-FB8BD0775A02}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{1F5CB788-05F6-4AFB-A0C1-6F8DA190BAAC}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{22B7676B-3F4C-49FB-BF3E-78A77025E792}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{23302AE4-7989-4C87-86A2-CA1FFE2E955C}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{28125F2E-4628-4174-911D-612F46D61CC8}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{2F33A086-8810-45D3-805D-298F4754E914}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{32D67EAE-3422-4AD7-AB78-BF6432AA0C05}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{346F3C40-0EB2-4CC4-AE74-478915D911AE}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{35B020EA-F48A-4E88-84F8-3F4A8DA62C68}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{38827B50-4C8F-435B-AF4B-9928DEC0ED0E}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{3938DAF6-BB55-4D91-AD3B-0799DEBE2BD4}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{3DB8AE10-8281-493E-9801-B090C88E9A13}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{3FD7F3D6-01BA-41A2-BFE1-52A6A05DDBEF}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{418B5BAB-4512-4867-9E5A-DAD34685E93E}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{4265D565-A9B1-4B3F-B5D5-16FA4332D3B2}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{44A817A5-EAFC-4343-8189-F96CC414747C}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{4628A9B9-BFF5-43BC-83BF-DD7B5AD4540F}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{47EBAB67-BA75-4031-BE99-91ACA4F7CC27}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{4B811B97-6067-40D8-BD8B-079FF8B84A9C}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{4CBBCC46-4817-475B-8544-26936EC0A676}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{4CE812E8-C0C2-460F-96EA-9C1BA3DCEBF8}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{50504ACB-3EC6-4BF9-A8AE-E41D764542EC}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{55284782-09CC-49A4-9083-CBDAFAA7D113}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{55E68D7C-28DD-4EC4-AB9D-D05D606746CD}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{5864134F-0786-4EBD-81E6-70873730813F}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{61AA51C4-B7B6-447E-95FE-CA3942DC6B0E}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{622C161C-CC78-4DE9-92C5-DB5233C9666B}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{62939CE3-4460-45C7-86B2-1B16ECB35ECC}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{62E618AE-8E7A-4720-B6EE-6003433287DE}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{6AB5B85F-C72B-4C30-B545-8DA2949967A3}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{6DB6E42B-494C-412E-BE71-29FF4AC01673}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{6F6D16A9-D0DD-4FF4-A14F-BB85AB2A7056}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{74DCD34A-43A9-4FDB-A0D7-993BE04A77D0}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{7536B732-2372-4BA7-B385-5FEF0AFD7F3B}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{7B120397-8F6F-4660-8952-679E9F81DD16}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{7B4CA4FF-6C2D-4C8F-848D-464E6634C9FC}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{7E20126B-5EF0-43A0-9688-D482307AE645}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{836C8C39-F957-41B5-88C4-A157B520379C}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{83B12475-3E56-45F9-B593-D29EF6693A16}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{88AFEF91-0895-4F2F-AB3F-B8D82BCF28E9}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{8981F819-7DDE-481E-896B-45D4F6284971}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{8ECF3A70-3DA7-4BE7-9C2B-847BE15E5836}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{905151BE-57BD-4E83-8BE4-D86BCE711A37}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{96F532ED-D40B-4678-9486-99FB85405772}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{97EC0500-9BA4-40CE-A788-4C204F73B7EE}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{9C366450-D64C-44B4-97DD-A0C9F514AF0B}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{A16E31EB-8A8E-4C85-9017-AC760B2FDF52}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{A220C70F-5362-49F4-A2AE-9F64916CAE6F}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{AAEBE5FF-4E89-4136-B0F1-7FB7C5F1D4AD}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{AC83D8AB-7889-48D0-A169-E15CA709B99D}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{AD8AE32A-2A8C-4DB3-9A68-D0E833177705}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{AECEF795-8ABC-4DEA-9601-D6DF8C7E5F9D}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{B0B2C1E0-63E4-4EBD-90A9-AB08C8955B49}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{B5BE739B-9C43-4092-A828-CCD2497E7CA3}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{B625E395-8673-404D-9C82-D551536F6826}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{B97561D1-3A73-4F84-AECA-7A23892200F8}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{BA33C2AF-B162-4715-8A3A-8CA53F6EDE65}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{BC48EB4F-17D6-4991-A12C-A6A276766797}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{BCB79835-8BBB-4D53-A9E8-93F5FDF25168}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{BD70D095-5F1C-457B-AD37-3E7916BE8BBD}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{C5591AA9-66AE-4C97-A008-7CB2A0D6C7FA}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{C66CB87E-980A-4498-B746-ADE79333B2B1}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{C79524FE-70FE-48F0-8838-8D0F6D95B0A5}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{C8A343B6-FC5E-41BF-91E9-F37EBC689D6A}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{C920380E-FEDC-407D-A4D7-2688A75EEEF2}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{CB073601-DE0A-42CC-BDF8-EFA9C992764C}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{CB9E24A1-1A43-4D75-A3DB-9FFE4D780655}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D122A294-00A4-4623-B678-E37AA1530B19}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D328C037-4D42-4792-859C-A67B17CCD4CD}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D38CA874-989D-4C4C-BBEF-D82FE762E207}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D620241A-D5B2-430F-974E-929771C39DFE}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D6C9B711-3F84-44A7-93EF-B38843A89F47}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D7D76E7C-5FF9-44C0-8210-B0617D2A1AC1}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D7FE1AB4-7455-4437-B5D6-8426205A2CC3}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{D8214B02-7C5A-4761-9794-E83AC9F1EA77}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{DCEF544F-2C5E-4E66-9710-87DAD0958648}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{DCF918A8-F191-4A33-ABE0-85F7DE64932B}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{E31F2904-47D0-450B-A427-FE17225B7B01}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{E7A36997-707B-4036-AC8E-9A9ABA0DA5C7}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{ED1AAA61-8D9E-4152-8BC9-23060A59A32A}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{EDD75C98-1441-40A9-8F3A-CEBE884718E2}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{F3DFD214-966E-45FA-960D-E067CC9BDD71}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{FB8951F2-9BD2-4798-98AF-3A071AA35F40}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{FDD586C0-301B-49C6-B338-7D385BA8AEC5}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{FDE74E34-48AB-468E-8670-9847122F2E89}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).


    ::Report end
     
    yuvalsh,
    #10
  12. 2006/07/19
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    OK, that last log file looks all clear, are you experiencing any more unwanted symptoms? Let me know.

    Note* You still need to remove that AVG, there will be conflicts among the two avs, leaving a potential for a security gap.

    We have 3 more things to do, to help ensure you have removed all the little 'leftovers' which may be hiding:

    Empty the TIF (Temporary Internet Files)
    Delete all the files in (and any subfolders of) the C:\Windows\Temp folder
    The app below will help with temp files.
    Index.dat Suite

    Also, delete all your cookies, and empty your recycle bin. But remember, by deleting your cookies, you will have to re-enter any passwords and log-in info for any sites you are usually required to do so with.

    This would also be a good time to set a new system restore point for your machine.
    Set New System Restore Point. Do not do this unless there are no other user accounts to be diagnosed.

    Also, as you are an XP user, if there are any other accounts on this machine, they too, must be cleaned with AdAware, Spybot S&D, then HJT. Not all infections are global, nor are all the HJT fixes global. You can post each user account here into this thread, but please, do only one at a time to avoid confusion.

    Here is a link which describes how security apps work with WIN XP machines.
    XP User Accts Security Apps Operation

    Now that you have regained control of your machine, lets keep it clean. Please follow the links below to ensure the highest possible level of protection against any further invasions. The links and the apps are some of the most highly regarded apps in the field of security/protection & detection. Run AdAware & Spybot at least once a week, depending on your surfing habits.
    Spybot Search & Destroy v1.4
    Ad-Aware SE Free v1.06r

    With AdAware and Spybot: DL, install then check for updates, then scan, repair/remove/quarantine anything found. Reboot before next scan with whichever app is next.

    To further prevent the installation of ad/mal/spyware, DL the apps below, which are just as good the fight against ad/mal/spyware as AdAware & Spybot S&D:

    SpywareBlaster
    With SpywareBlaster v3.5.1 , just DL, install and check for updates, enable Internet Explorer protection, and your done! I don't recommend using IE restricted sites protection as it's not a very large database. Use IE-SPYADs below.

    To avoid known malware infested sites from loading in IE install IESPY ADS.
    And MVPS Hosts File will accomplish a similar tactic and provide another layer of protection.

    And to prevent unknown applications from being inserted to start up on your machine install WinPatrol v10.0.1.

    Another thing I would suggest, is to install SiteAdvisor. It gives sites a few different 'ratings' and while not fool proof, a good additional layer of information about many sites.

    Links for tutorials for all the apps I mentioned can be found on my site as well.

    Confused about which apps are good or not? Read about Rogue/Approved Anti Security apps

    And just because you have security apps installed, they are useless unless updated regularly. Keep track of updates for ALL your security needs here:
    Calendar of Updates

    Subscribe to update alerts for all the above security apps here.

    You can also see my own ongoing security testing with all the above apps proving how securely you can safe with them installed.
    TeMerc Test Box Forum

    Happy surfing!!
    Tom :D
     
    TeMerc,
    #11
  13. 2006/07/20
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    thanks a lot

    Hey Tom,

    Thanks a lot for your help! I'll follow the steps the second I get back home.
    I was just wondering if you think Norton is better than AVG? and is Norton the AV program you would recommend?

    thanks again
     
    yuvalsh,
    #12
  14. 2006/07/20
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    You're quite welcome.

    Of the two, Norton would be my choice. Mostly because it is a pay for software and will give you a more robust tool for protection. Yes, it can be a bit of a CPU hog, but that also depends on your system spex. I run it and don't have any problems, with 256RAM. AVG is a great choice if you're on a budget, I run it on the other machines here.

    Hope that helps some.
     
    TeMerc,
    #13
  15. 2006/07/20
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    back again

    I just came home and found messeges of trojan on my computer......

    I guess it wasn't gone...

    this is the log:

    Logfile of HijackThis v1.99.1
    Scan saved at 20:06:12, on 20/07/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\system32\TpShocks.exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\IBMTOOLS\UTILS\ibmprc.exe
    C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MAFWTray.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\IBM\Bluetooth Software\BTTray.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\TPHDEXLG.EXE
    C:\WINDOWS\system32\TpKmpSVC.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\hjt\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
    O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
    O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
    O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
    O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Spurl! - http://www.spurl.net/rclick.php
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Spurl! - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Bookmark the current page to Spurl.net - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra button: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O11 - Options group: [JAVA_IBM] Java (IBM)
    O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.ims.tau.ac.il/inc/ScriptX.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/135p/html/gtdownlr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123793940598
    O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
    O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe


    **** this is so frustrating.... thanks again for your help
     
    yuvalsh,
    #14
  16. 2006/07/20
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    What messages did you get and from which av?

    You MUST uninstall whichever one you're not using, reboot the system, then see what type of alerts you're getting.

    Both AVs are still on the system and running.
     
    TeMerc,
    #15
  17. 2006/07/23
    yuvalsh

    yuvalsh Inactive Thread Starter

    Joined:
    2006/07/17
    Messages:
    9
    Likes Received:
    0
    no good no good

    It's not gone. or maybe there's a new one. Here's the deal, I have wireless at my home so when I'm not there the Laptop can connect automatically. But no one is brousing or downloading anything. When I come back home I have tons of messeges from Norton AV "Trojan virus" - no specifcs, and that it couldn't delete it. I tried scanning on Safe mode - nothing comes up. This is the latest HTJ (not from safe mode):

    Logfile of HijackThis v1.99.1
    Scan saved at 23:54:21, on 23/07/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\TPHDEXLG.EXE
    C:\WINDOWS\system32\TpKmpSVC.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\system32\TpShocks.exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\IBMTOOLS\UTILS\ibmprc.exe
    C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MAFWTray.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\IBM\Bluetooth Software\BTTray.exe
    C:\hjt\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
    O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
    O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
    O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
    O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
    O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Spurl! - http://www.spurl.net/rclick.php
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Spurl! - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Bookmark the current page to Spurl.net - {057AB0AA-0896-44A7-9940-1D3118C870FB} - http://www.spurl.net/rclick.php (file missing) (HKCU)
    O9 - Extra button: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Spurl bar - {104D0F17-ED01-4E81-8EFF-53E956FC6D49} - Shdocvw.dll (file missing) (HKCU)
    O11 - Options group: [JAVA_IBM] Java (IBM)
    O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX 5.5 Basic) - http://www.ims.tau.ac.il/inc/ScriptX.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/135p/html/gtdownlr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123793940598
    O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
    O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

    thanks....
     
    yuvalsh,
    #16
  18. 2006/07/23
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    Thanks for removing the AVG.

    OK, nothing in the log.

    I need to know exactly what Norton says it is finding, names so forth and I also need to know the file path of each instance of the alerts.
     
    TeMerc,
    #17

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...