1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved COMPUTER NOT RESPONDING/ HIjack this log atttached

Discussion in 'Malware and Virus Removal Archive' started by DeniseB, 2008/04/30.

Page 1 of 2
  1. 2008/04/30
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    [Resolved]COMPUTER NOT RESPONDING/ HIjack this log atttached

    < please note I have another thread running right now that is completely unrelated to this one, totally different computer>

    I installed a new media player called K-Lite Mega Codec Pack, "installation built with Inno Setup" given to me by a friend.

    Since that time, my computer has been running like a snail, I've needed to reboot several times. I have since uninstalled the media player, and did a system restore. Still not running quite right, desktop icons take a while to appear at start up, big delay in response time when programs are open or I click on something, white screens, even printing has a 4-5 minute lag.

    I ran a hijack this log. Is there anything else here you can recommend I do?

    You guys are the greatest, thanks.

    D

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:47:43 PM, on 4/30/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.36.0\HostIE.dll (file missing)
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.36.0\HostIE.dll (file missing)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send Image to Photo Library - file://C:\Documents and Settings\Denise *\Application Data\MGI\PhotoSuite4\Temp\MGI00000.html
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1190465082781
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190491345983
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5513 bytes
     
    DeniseB,
    #1
  2. 2008/04/30
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB

    Please do this.

    Please go to Start > Control Panel > Add/Remove Programs (Windows Vista it’s Programs and Features) and remove the following (if present):


    Zango


    Please note any other programs that you dont recognize in that list and post them in your next response


    Now download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply along with a fresh HijackThis log. Let me know what issues still exist.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.


    Now a Deckards scan.

    Please download Deckard's System Scanner (dss.exe) and save it to your Desktop.
    Note: You must be logged onto an account with administrator privileges to complete the following.
    • Close all other windows before proceeding.
    • Double-click on dss.exe and follow the prompts.
    • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy and then paste the contents of main.txt and extra.txt in your next reply.

    Please post the MBAM log and the dss log.

    Thanks
    Geri
     
    Geri,
    #2


  3. to hide this advert.

  4. 2008/05/01
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    Hi Geri.. thanks for replying so fast.. I will do as you have asked. In the meantime, I did an Adaware complete scan.. Strange that there are so many cookies, I clear them almost every night and also have ATF cleaner that I run. Thought you might like to see those results below:


    Thanks :)


    Infections Found
    Family Id Name Category TAI
    725 Tracking Cookie DataMiner 3
    [600000212] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat 2o7.net s_vi_lex7Fihxxx7Fx7Cgiq /
    [600000212] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat 2o7.net s_vi_jcyonx7Eyjabola /
    [600000415] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.revsci.net rsi_us_1000000 /adserver
    [600000415] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat revsci.net rsi_cls_1000000 /
    [600000415] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat revsci.net rsi_segs_1000000 /
    [600000415] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat revsci.net NETID01 /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tacoda.net TID /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tacoda.net Xsd /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tacoda.net ANRTT /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tacoda.net Tsid /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tacoda.net TData /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tacoda.net Anxd /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tacoda.net Tcc /
    [600000093] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.pointroll.com PRID /
    [600000093] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.pointroll.com PRimp /
    [600000093] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.pointroll.com PRca /
    [600000093] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.pointroll.com PRcp /
    [600000093] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.pointroll.com PRpl /
    [600000093] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.pointroll.com PRcr /
    [600000093] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat ads.pointroll.com PRpc /
    [600000555] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat insightexpressai.com IXAIBanners921 /
    [600000555] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat insightexpressai.com IXAIBannerCounter27921 /
    [600000555] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat insightexpressai.com IXAIFirstHit921 /
    [600000555] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat insightexpressai.com IXAILastHit921 /
    [600000555] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat insightexpressai.com IXAICampaignCounter921 /
    [600000555] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat insightexpressai.com IXAIBannerCounter27926 /
    [600000400] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat anad.tacoda.net /PC /
    [600000085] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat questionmarket.com ES /
    [600000085] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat questionmarket.com CS1 /
    [600000179] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat atdmt.com AA002 /
    [600000050] Browser: Internet Explorer Cookie: C:\Documents and Settings\Denise *\Cookies\index.dat tribalfusion.com ANON_ID /

    9999 MRU Object MRU Object 0
    [1] MRU Path: C:\Documents and Settings\Denise *\Recent Count: 132
    [2] MRU Registry Key: S-1-5-21-507921405-436374069-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603 Count: 4
    [3] MRU Registry Key: S-1-5-21-507921405-436374069-725345543-1004\Software\Microsoft\Internet Explorer\TypedURLs Count: 5
     
    DeniseB,
    #3
  5. 2008/05/01
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    MBAM and HiJack LOGS

    Followed your instructions: MBAM and Hi Jack this below. Zango did not appear in my programs list. But I still it below. I am running a deckards scan now.. and will post that in a separate reply.



    Malwarebytes' Anti-Malware 1.11
    Database version: 704

    Scan type: Quick Scan
    Objects scanned: 35048
    Time elapsed: 18 minute(s), 4 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 17
    Registry Values Infected: 2
    Registry Data Items Infected: 0
    Folders Infected: 2
    Files Infected: 3

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.clientdetector (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.clientdetector.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.userprofiles (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\zangoax.userprofiles.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\toolbar.toolbarctl (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\toolbar.toolbarctl.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\toolbar.htmlmenuui (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\toolbar.htmlmenuui.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\Zango@Zango.com (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\Zango 10.3.36.0 (Adware.Zango) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Documents and Settings\All Users\Application Data\ZangoSA (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA.dat (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht (Adware.Zango) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAEULA.mht (Adware.Zango) -> Quarantined and deleted successfully.



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:15:48 AM, on 5/1/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.36.0\HostIE.dll (file missing)
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.36.0\HostIE.dll (file missing)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send Image to Photo Library - file://C:\Documents and Settings\Denise *\Application Data\MGI\PhotoSuite4\Temp\MGI00000.html
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1190465082781
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190491345983
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5503 bytes
     
    DeniseB,
    #4
  6. 2008/05/01
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    Deckards final Scans

    Deckard's System Scanner v20071014.68
    Run by Denise * on 2008-05-01 09:22:36
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    56: 2008-05-01 13:22:55 UTC - RP425 - Deckard's System Scanner Restore Point
    55: 2008-05-01 03:38:21 UTC - RP424 - Restore Operation
    54: 2008-04-30 20:58:16 UTC - RP423 - System Checkpoint
    53: 2008-04-29 15:54:19 UTC - RP422 - System Checkpoint
    52: 2008-04-28 15:22:00 UTC - RP421 - Software Distribution Service 3.0


    -- First Restore Point --
    1: 2008-02-25 00:23:22 UTC - RP370 - System Checkpoint


    Performed disk cleanup.

    Percentage of Memory in Use: 82% (more than 75%).
    Total Physical Memory: 256 MiB (512 MiB recommended).


    -- HijackThis (run as Denise *.exe) -------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:23:26 AM, on 5/1/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
    C:\Documents and Settings\Denise *\Local Settings\Temporary Internet Files\Content.IE5\63WDLKGA\dss[1].exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\DENISE~1.EXE

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send Image to Photo Library - file://C:\Documents and Settings\Denise *\Application Data\MGI\PhotoSuite4\Temp\MGI00000.html
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1190465082781
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190491345983
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5327 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

    backup-20070921-223306-933 O15 - Trusted Zone: *.totalvid.com
    backup-20070930-211506-114 O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    backup-20070930-211506-217 O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
    backup-20070930-211506-246 O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    backup-20070930-211506-268 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    backup-20070930-211506-291 O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    backup-20070930-211506-445 O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    backup-20070930-211506-448 O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    backup-20070930-211506-499 O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe "
    backup-20070930-211506-511 O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    backup-20070930-211506-513 O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    backup-20070930-211506-528 O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE
    backup-20070930-211506-649 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    backup-20070930-211506-731 O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
    backup-20070930-211506-868 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    backup-20070930-211506-947 O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    backup-20070930-211506-958 O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
    backup-20070930-211506-969 O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    backup-20070930-211506-985 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    backup-20080501-092014-571 O2 - BHO: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.36.0\HostIE.dll (file missing)

    -- File Associations -----------------------------------------------------------

    .reg - regfile - shell\open\command - regedit.exe "%1" %*
    .scr - scrfile - shell\open\command - "%1" %*


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R1 ATMhelpr - c:\windows\system32\drivers\atmhelpr.sys <Not Verified; Adobe Systems Incorporated; Adobe Type Manager Deluxe>
    R3 emupia (E-mu Plug-in Architecture Driver) - c:\windows\system32\drivers\emupia2k.sys <Not Verified; Creative Technology Ltd; E-mu Plug-In Architecture>

    S3 catchme - c:\docume~1\denise~1\locals~1\temp\catchme.sys (file missing)


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>


    -- Device Manager: Disabled ----------------------------------------------------

    Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
    Description: Microsoft PS/2 Mouse
    Device ID: ACPI\PNP0F03\4&3A2C8C4B&0
    Manufacturer: Microsoft
    Name: Microsoft PS/2 Mouse
    PNP Device ID: ACPI\PNP0F03\4&3A2C8C4B&0
    Service: i8042prt


    -- Scheduled Tasks -------------------------------------------------------------

    2008-04-23 09:38:16 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


    -- Files created between 2008-04-01 and 2008-05-01 -----------------------------

    2008-05-01 08:47:36 0 d-------- C:\Documents and Settings\Denise *\Application Data\Malwarebytes
    2008-05-01 08:47:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-01 08:47:11 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-04-30 23:35:47 0 d-------- C:\WINDOWS\speech
    2008-04-29 08:40:59 0 d-------- C:\Documents and Settings\Denise *\Application Data\Media Player Classic
    2008-04-28 13:31:49 0 d-------- C:\Program Files\PCOM2.4 CD (D)
    2008-04-03 16:31:12 0 d-------- C:\Documents and Settings\Kids\Application Data\MailFrontier
    2008-04-01 23:59:16 0 d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft


    -- Find3M Report ---------------------------------------------------------------

    2008-04-30 23:36:20 24 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-0000000C-00001102-00000004-00581102}.dat
    2008-04-30 23:36:20 24 --a------ C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000004-00581102}.dat
    2008-04-30 23:36:13 0 d-------- C:\Documents and Settings\Denise *\Application Data\Canon
    2008-04-30 23:35:58 0 d-------- C:\Program Files\Common Files\Real
    2008-04-30 23:35:54 0 d-------- C:\Program Files\Common Files
    2008-04-26 08:10:51 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2008-04-19 20:37:10 0 d-------- C:\Program Files\Apple Software Update
    2008-04-03 14:19:14 0 d-------- C:\Documents and Settings\Denise *\Application Data\Move Networks
    2008-03-29 12:13:27 0 d-------- C:\Program Files\iTunes
    2008-03-29 12:13:01 0 d-------- C:\Program Files\iPod
    2008-03-29 12:09:04 0 d-------- C:\Program Files\QuickTime
    2008-03-28 15:45:16 0 d-------- C:\Program Files\Nova Development
    2008-03-28 15:44:12 0 d-------- C:\Program Files\Common Files\InstallShield
    2008-03-08 16:59:25 0 d-------- C:\Documents and Settings\Denise *\Application Data\Zango
    2008-03-07 15:10:41 0 d-------- C:\Documents and Settings\Denise *\Application Data\WeatherDPA
    2008-03-07 13:40:28 0 d-------- C:\Documents and Settings\Denise *\Application Data\Adobe
    2008-03-07 13:40:20 1158 --a------ C:\WINDOWS\mozver.dat
    2008-03-07 13:00:55 0 d-------- C:\Documents and Settings\Denise *\Application Data\Mozilla


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [01/31/2008 11:13 PM]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/13/2008 11:11 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Works Update Detection "= "C:\Program Files\Microsoft Works\WkDetect.exe" []
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM]
    Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [8/6/2001 8:06:54 PM]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Notification Packages "= :\WINDOWS\syste

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4919bf92-78d5-11dc-8eb8-000347eac726}]
    AutoRun\command- F:\LaunchU3.exe -a




    -- End of Deckard's System Scanner: finished at 2008-05-01 09:25:27 ------------



    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Home Edition (build 2600) SP 2.0
    Architecture: X86; Language: English

    CPU 0: Intel(R) Pentium(R) 4 CPU 1.80GHz
    Percentage of Memory in Use: 82%
    Physical Memory (total/avail): 255.3 MiB / 44.66 MiB
    Pagefile Memory (total/avail): 617.01 MiB / 271.05 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1937.02 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 37.27 GiB total, 21.36 GiB free.
    D: is CDROM (No Media)
    E: is CDROM (No Media)
    G: is Removable (No Media)

    \\.\PHYSICALDRIVE0 - ST340016A - 37.27 GiB - 1 partition
    \PARTITION0 (bootable) - Installable File System - 37.27 GiB - C:

    \\.\PHYSICALDRIVE1 - Canon MP500Storage USB Device



    -- Security Center -------------------------------------------------------------

    AUOptions is scheduled to auto-install.
    Windows Internal Firewall is disabled.

    AntivirusOverride is set.
    FirewallOverride is set.

    FW: ZoneAlarm Security Suite Firewall v7.0.470.000 (Check Point, LTD.)
    AV: ZoneAlarm Security Suite Antivirus v7.0.470.000 (Check Point, LTD.)

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "= "%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "= "C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Disabled:TrueVector Service "
    "%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    " "= ":*:Enabled:Yahoo! Music Jukebox "
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "= "%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\\Program Files\\iTunes\\iTunes.exe "= "C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes "


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Denise *\Application Data
    CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=GDAR-RDYY0ZCGSV
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Denise *
    LOGONSERVER=\\GDAR-RDYY0ZCGSV
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Program Files\QuickTime\QTSystem\
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 1 Stepping 2, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0102
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\DENISE~1\LOCALS~1\Temp
    TMP=C:\DOCUME~1\DENISE~1\LOCALS~1\Temp
    tvdumpflags=8
    USERDOMAIN=GDAR-RDYY0ZCGSV
    USERNAME=Denise *
    USERPROFILE=C:\Documents and Settings\Denise *
    windir=C:\WINDOWS


    -- User Profiles ---------------------------------------------------------------

    Denise * (admin)
    Kids (admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> "C:\Program Files\Creative\SBAudigy\Program\Ctzapxx.EXE" /U /S /R
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    "Doras Carnival Adventure (remove only)" --> "C:\Program Files\Doras Carnival Adventure\Uninstall.exe "
    "Doras Rapido River Rafting Race (remove only)" --> "C:\Program Files\Doras Rapido River Rafting Race\Uninstall.exe "
    Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
    Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
    Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
    Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Adobe Type Manager 4.0 --> C:\WINDOWS\uninst.exe -f "C:\Program Files\Adobe Type Manager\DeIsL1.isu" -c "C:\Program Files\Adobe Type Manager\UNINST.DLL "
    Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
    Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
    ArcSoft PhotoStudio 5.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x9
    Browntech Image Plugin 1.98 --> MsiExec.exe /X{68658FCB-01BB-4980-A7C3-6ADB1E4E0C66}
    Canon MP Navigator 2.0 --> "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
    Canon MP500 --> "C:\WINDOWS\System32\CanonMP Uninstaller Information\{BA4DF4C3-196E-4128-969A-00996B5A46F8}\DelDrv.exe" /U:{BA4DF4C3-196E-4128-969A-00996B5A46F8} /L0x0009
    Canon Utilities Easy-PhotoPrint --> C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
    Disney's The Book of Pooh --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F389ED5D-77EF-11D6-B235-0050DACD394D}\setup.exe" -l0x9 Uninstall
    Doras 3-D Driving Adventure (remove only) --> "C:\Program Files\Doras 3-D Driving Adventure\Uninstall.exe "
    DVD Player --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C1939820-A945-11D4-86F6-0001031E5712}\setup.exe" REMOVEALL
    Easy-WebPrint --> C:\WINDOWS\IsUninst.exe -f "C:\Program Files\Canon\Easy-WebPrint\Uninst.isu "
    Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar4.dll "
    Hamsterball --> "C:\Program Files\Hamsterball\ReflexiveArcade\unins000.exe "
    HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows Media Format SDK (KB902344) --> "C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe "
    Hotfix for Windows Media Format SDK (KB910998) --> "C:\WINDOWS\$NtUninstallKB910998$\spuninst\spuninst.exe "
    iTunes --> MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
    Kaspersky Online Scanner --> C:\WINDOWS\System32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
    La Casa De Dora (remove only) --> "C:\Program Files\La Casa De Dora\Uninstall.exe "
    Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0x9 UNINSTALL
    Logitech IM Video Companion --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{984F10FD-11FD-4BED-8163-92DB81E6A825}\Setup.exe" -l0x9 UNINSTALL
    Logitech ImageStudio --> MsiExec.exe /I{5A24DD7E-7B01-41AC-ADA8-F1776177A3BA}
    Logitech Print Service --> C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG
    Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe "
    MGI PhotoSuite 4 (Remove Only) --> "C:\Program Files\MGI\MGI PhotoSuite 4\System\MGIUninstall.exe" C:\WINDOWS\IsUninst.exe -f "C:\Program Files\MGI\MGI PhotoSuite 4\Uninst.isu" -c "C:\Program Files\MGI\MGI PhotoSuite 4\System\CustomUninstall.dll "
    Microsoft Text-to-Speech Engine 4.0 (English) --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msTTSa22.inf, Uninstall
    Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
    Microsoft Word 2002 --> MsiExec.exe /I{911B0409-6000-11D3-8CFE-0050048383C9}
    Microsoft Works 2002 Setup Launcher --> C:\Program Files\Microsoft Works Suite 2002\Setup\Launcher.exe D:\
    Microsoft Works 6.0 --> MsiExec.exe /I{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}
    Microsoft Works Suite Add-in for Microsoft Word --> MsiExec.exe /I{C3A439E4-7303-491F-A678-CEA36A87D517}
    Move Networks Media Player for Internet Explorer --> C:\Documents and Settings\Denise *\Application Data\Move Networks\ie_bin\Uninst.exe
    MP3 player --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D695F627-7F16-429A-ACE7-57C535AC6ECB}\setup.exe" -l0x9
    NVIDIA Drivers --> C:\WINDOWS\System32\nvudisp.exe UninstallGUI
    OmniPage SE 2.0 --> MsiExec.exe /I{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}
    Portfolio Browser --> MsiExec.exe /X{00D3BDAF-C064-4821-89C5-89105F6C738E}
    QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
    Rhapsody Player Engine --> MsiExec.exe /I{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}
    Sewer Run --> "C:\Program Files\Sewer Run\ReflexiveArcade\unins000.exe "
    Sound Blaster Audigy --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9115E7DB-3B29-445A-802D-11E0AA945B7F}\SETUP.EXE" -l0x9
    Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe "
    Super Bounce Out! --> C:\PROGRA~1\GAMEHO~1\BOUNCE~1\UNWISE.EXE /U C:\PROGRA~1\GAMEHO~1\BOUNCE~1\INSTALL.LOG
    SureThing CD Labeler Deluxe 4 --> C:\WINDOWS\mvuninst\App1\mvuninst.exe "SureThing CD Labeler Deluxe 4 "
    The Print Shop Premier Edition 5.0 --> C:\WINDOWS\uninst.exe -f "C:\The Print Shop Products\The Print Shop Premier Edition 5.0\DeIsL1.isu" -c "C:\The Print Shop Products\The Print Shop Premier Edition 5.0\psfinst.dll "
    Virtools 3D Life Player --> C:\Program Files\Virtools\3D Life Player\WebplayerConfig.exe -u
    ZoneAlarm Security Suite --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe


    -- Application Event Log -------------------------------------------------------

    Event Record #/Type2613 / Error
    Event Submitted/Written: 04/30/2008 11:17:45 PM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application PSPE5.exe, version 1.0.0.210, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Event Record #/Type2612 / Error
    Event Submitted/Written: 04/30/2008 11:17:45 PM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application PSPE5.exe, version 1.0.0.210, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Event Record #/Type2611 / Error
    Event Submitted/Written: 04/30/2008 11:17:45 PM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application PSPE5.exe, version 1.0.0.210, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Event Record #/Type2610 / Error
    Event Submitted/Written: 04/30/2008 11:17:45 PM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application PSPE5.exe, version 1.0.0.210, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Event Record #/Type2609 / Error
    Event Submitted/Written: 04/30/2008 11:17:44 PM
    Event ID/Source: 1002 / Application Hang
    Event Description:
    Hanging application PSPE5.exe, version 1.0.0.210, hang module hungapp, version 0.0.0.0, hang address 0x00000000.



    -- Security Event Log ----------------------------------------------------------

    No Errors/Warnings found.


    -- System Event Log ------------------------------------------------------------

    Event Record #/Type11093 / Warning
    Event Submitted/Written: 04/30/2008 11:16:30 PM / 04/30/2008 11:16:31 PM
    Event ID/Source: 8 / Print
    Event Description:
    Printer Canon MP500 Series Printer was purged.

    Event Record #/Type11092 / Error
    Event Submitted/Written: 04/30/2008 11:02:29 PM
    Event ID/Source: 7011 / Service Control Manager
    Event Description:
    Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.

    Event Record #/Type11065 / Error
    Event Submitted/Written: 04/30/2008 06:21:49 PM
    Event ID/Source: 7011 / Service Control Manager
    Event Description:
    Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.

    Event Record #/Type11064 / Warning
    Event Submitted/Written: 04/30/2008 06:21:48 PM
    Event ID/Source: 256 / PlugPlayManager
    Event Description:
    Timed out sending notification of device interface change to window of "SAS window "

    Event Record #/Type11061 / Error
    Event Submitted/Written: 04/30/2008 06:07:44 PM
    Event ID/Source: 29 / W32Time
    Event Description:
    The time provider NtpClient is configured to acquire time from one or more
    time sources, however none of the sources are currently accessible.
    No attempt to contact a source will be made for 13 minutes.
    NtpClient has no source of accurate time.



    -- End of Deckard's System Scanner: finished at 2008-05-01 09:25:27 ------------
     
    DeniseB,
    #5
  7. 2008/05/01
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB

    Ok please do this.

    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.

    Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these folders (if present):

    C:\Documents and Settings\Denise *\Application Data\Zango

    Please make sure dss.exe is on your desktop.

    ** dss.exe must be on the desktop for the following command to work. **

    Highlight and copy the bolded command below.

    "%userprofile%\desktop\dss.exe" /daft
    • Click Start>Run and paste the command in the run box, then hit enter.
    • An interface of Deckards file association fix will open.
    • Click Scan.
    • Check the box next to the following, then click Fix.
      • .reg
      • .scr
    • Exit when complete.

    Now reboot you computer.

    Please post a new dss log. It will only give you the "main txt" log, that is OK that is all we need this time.

    Let me know how things are.

    Thanks
    Geri
     
    Geri,
    #6
  8. 2008/05/03
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    New Dss scan

    Did everything you said.

    There was a Zango file still in my app data folder. I deleted it and then deleted my recycle bin.


    Also, I don't know if this is related to any of my issues, but whenever I turn on my computer Zone alarm gives me a prompt to allow or deny wkcalrem.exe, and I noticed it in the dss scan.:
    Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [8/6/2001 8:06:54 PM]

    Here is the new log.. Thanks for your help

    Denise


    Deckard's System Scanner v20071014.68
    Run by Denise * on 2008-05-04 00:10:57
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Percentage of Memory in Use: 85% (more than 75%).
    Total Physical Memory: 256 MiB (512 MiB recommended).


    -- HijackThis (run as Denise *.exe) -------------------------------------

    logfile has no content; running clone.
    -- HijackThis Clone ------------------------------------------------------------


    Emulating logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2008-05-04 00:12:05
    Platform: Windows XP Service Pack 2 (5.01.2600)
    MSIE: Internet Explorer (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\system32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Denise *\Desktop\dss.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
    C:\Program Files\Trend Micro\HijackThis\Denise *.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Send Image to Photo Library - file://C:\Documents and Settings\Denise *\Application Data\MGI\PhotoSuite4\Temp\MGI00000.html
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: https://www.windowsbbs.com (HKCU)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1190465082781
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1190491345983
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
    O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


    --
    End of file - 6821 bytes

    -- Files created between 2008-04-04 and 2008-05-04 -----------------------------

    2008-05-01 08:47:36 0 d-------- C:\Documents and Settings\Denise *\Application Data\Malwarebytes
    2008-05-01 08:47:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-01 08:47:11 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-04-30 23:35:47 0 d-------- C:\WINDOWS\speech
    2008-04-29 08:40:59 0 d-------- C:\Documents and Settings\Denise *\Application Data\Media Player Classic
    2008-04-28 13:31:49 0 d-------- C:\Program Files\PCOM2.4 CD (D)


    -- Find3M Report ---------------------------------------------------------------

    2008-05-04 00:07:05 24 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-0000000C-00001102-00000004-00581102}.dat
    2008-05-04 00:07:05 24 --a------ C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000004-00581102}.dat
    2008-04-30 23:36:13 0 d-------- C:\Documents and Settings\Denise *\Application Data\Canon
    2008-04-30 23:35:58 0 d-------- C:\Program Files\Common Files\Real
    2008-04-30 23:35:54 0 d-------- C:\Program Files\Common Files
    2008-04-26 08:10:51 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2008-04-19 20:37:10 0 d-------- C:\Program Files\Apple Software Update
    2008-04-03 14:19:14 0 d-------- C:\Documents and Settings\Denise *\Application Data\Move Networks
    2008-03-29 12:13:27 0 d-------- C:\Program Files\iTunes
    2008-03-29 12:13:01 0 d-------- C:\Program Files\iPod
    2008-03-29 12:09:04 0 d-------- C:\Program Files\QuickTime
    2008-03-28 15:45:16 0 d-------- C:\Program Files\Nova Development
    2008-03-28 15:44:12 0 d-------- C:\Program Files\Common Files\InstallShield
    2008-03-07 15:10:41 0 d-------- C:\Documents and Settings\Denise *\Application Data\WeatherDPA
    2008-03-07 13:40:28 0 d-------- C:\Documents and Settings\Denise *\Application Data\Adobe
    2008-03-07 13:40:20 1158 --a------ C:\WINDOWS\mozver.dat
    2008-03-07 13:00:55 0 d-------- C:\Documents and Settings\Denise *\Application Data\Mozilla


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [01/31/2008 11:13 PM]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/13/2008 11:11 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Works Update Detection "= "C:\Program Files\Microsoft Works\WkDetect.exe" []
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM]
    Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [8/6/2001 8:06:54 PM]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Notification Packages "= :\WINDOWS\syste

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4919bf92-78d5-11dc-8eb8-000347eac726}]
    AutoRun\command- F:\LaunchU3.exe -a




    -- End of Deckard's System Scanner: finished at 2008-05-04 00:14:36 ------------
     
    DeniseB,
    #7
  9. 2008/05/04
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB
    If you don't use it, You should be able to disable that in Microsoft Works Options. or stop it from starting at start up.

    To do it that way.
    Click "Start" > Run > type in msconfig in the run box, click OK.
    Click the "StartUp" tab
    Find the file wkcalrem.exe and uncheck it, click Apply then OK

    You will have to restart your computer.At the infromation box that pops up after restart, put a check in "Don't show this.. ".and click OK.


    I'm not seeing a Anti-Virus program running on the system, This is a must have,
    There are a couple to choose from here,
    http://www.windowsbbs.com/showthread.php?t=67958
    Please download only 1 (one).

    Now lets get a on-line scan.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.


    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks the ActiveX download, allow it, click on "Accept" again

    You will be prompted to install an ActiveX component from Kaspersky, Click Yes or Install.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will start the program and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #8
  10. 2008/05/05
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    The Cal. reminder was taken care of, thanks

    Not sure why you're not seeing a virus protection, I have Zone Alarm Internet Security Suite. I downloaded the free AVG, and just disabled the virus protection in my Zone alarm, I didn't want to uninstall ZA because I paid for it... but I thought it might be beneficial to run a different scan in case ZA missed something. Will this be too conflicting? I will post the results below.

    Q:
    when I dl'd the free AVG a program called VersionTracker Pro was installed, it compiled a list of outdated drivers from the categories of image, media, net, printer and usb. How do I update these drivers myself without purchasing the program for 29.99? I thought windows update took care of this, but apparently not since my updates are u.t.d.

    ** I already have ATF cleaner and run it daily.
    I also have spybot, adaware, and the new program you suggested, MBAM.

    AVG did not find ANY threats.... just some tracking cookies which I went in and deleted.

    will run Kaspersky now, and post when complete.


    Thanks
    Denise
     
    Last edited: 2008/05/05
    DeniseB,
    #9
  11. 2008/05/05
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB

    OK a registry key was pointed out to me that needs to be fixed.

    So please do this and follow the instructions carefully.


    Highlight and copy the contents of the code box below to a blank notepad. Save it to the desktop as;

    Filename: fix.reg
    Save as type: All Files (*.*)

    Code:
    REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
 "Notification Packages "=hex(7):73,63,65,63,6c,69,00,00
    Double click fix.reg and allow it to merge with the registry.


    Next, highlight and copy the contents of the code box below.

    Code:
    reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa | findstr  "Notification" > "%userprofile%\desktop\lsa.txt "
start notepad  "%userprofile%\desktop\lsa.txt "
exit
cls
    Click Start>Run and type cmd then hit enter to open a command window. Right click in the command window and select paste. The command window will close on it's own.

    Post the contents of the log that opens and do not reboot the machine until you get the OK to do so.

    Thanks
    Geri
     
    Geri,
    #10
  12. 2008/05/06
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    Notification Packages REG_MULTI_SZ scecli\0\0



    Geri,

    Just wondering if you still want to see the Kaspersky scan
    and
    if AVG is going to conflict with Zone Alarm Security Suite.

    Please advise.

    Thanks
    Denise
     
    DeniseB,
    #11
  13. 2008/05/06
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB
    OK that's what we needed to see.

    You can only have one ( 1 ) real time protection anti-virus running at a time.

    If you have one that is real time and one you just run as a on demand scanner only.
    Then that is OK

    Make sure you update the on demand scanner one before you run a scan.

    One thing to keep in mind here...
    If it isn't broke, don't fix it.
    If those programs are running and working fine, then I suggest leaving them be.
    If you feel that they need/want to be updated then I would check your computer manufacturers web site first to see if there are updates for them there . They normally keep that up to date if the driver needs updated. Go by the make and model of your computer.

    Windows Updates does not usually update drivers for hardware installed on your system, because different hardware is installed on different computers.

    I do need to see a on-line Kaspersky scan.

    Thanks
    Geri
     
    Geri,
    #12
  14. 2008/05/07
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    Kaspersky Scan Below

    Geri, which one is the real time? Is that ZA?

    See Kaspersky below, it found a bunch of stuff!

    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, May 07, 2008 1:27:58 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 7/05/2008
    Kaspersky Anti-Virus database records: 743585


    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    A:\
    C:\
    D:\
    E:\

    Scan Statistics
    Total number of scanned objects 54591
    Number of viruses found 1
    Number of infected objects 0
    Number of suspicious objects 8
    Duration of the scan process 01:55:21

    Infected Object Name Virus Name Last Action
    C:\Documents and Settings\All Users\Application Data\avg8\emc\Log\emc.log Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\avg8\Log\avgrs.log Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\avg8\Log\avgui.log Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\avg8\Log\avgwd.log Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\avg8\Log\commonpriv.log Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\MailFrontier\reginfo.xml Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

    C:\Documents and Settings\Denise *\Application Data\MailFrontier\ASD.log Object is locked skipped

    C:\Documents and Settings\Denise *\Application Data\VersionTracker Pro\vtlog.txt Object is locked skipped

    C:\Documents and Settings\Denise *\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Inbox.dbx/[From WellsFargo online Banking ][Date Sun, 30 Sep 2007 18:40:25 +0530]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Inbox.dbx MailMSOutlook5: suspicious - 1 skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Sent Items.dbx/[From "Denise *" ][Date Wed, 23 Apr 2008 22:50:41 -0400]/text/[From paypal@securesuite.net]/UNNAMED/[From ][Date Sat, 26 Apr 2008 04:44:41 +0200]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Sent Items.dbx/[From "Denise *" ][Date Wed, 23 Apr 2008 22:50:41 -0400]/text/[From paypal@securesuite.net]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Sent Items.dbx/[From "Denise *" ][Date Wed, 23 Apr 2008 22:50:41 -0400]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Sent Items.dbx MailMSOutlook5: suspicious - 3 skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\ZoneAlarm Phishing Mail.dbx/[From ][Date Sat, 26 Apr 2008 04:44:41 +0200]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\ZoneAlarm Phishing Mail.dbx MailMSOutlook5: suspicious - 1 skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\History\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\History\History.IE5\MSHist012008050620080507\index.dat Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\Temp\~DF4CA4.tmp Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\Temp\~DF87C4.tmp Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\Temp\~DF87F2.tmp Object is locked skipped

    C:\Documents and Settings\Denise *\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Denise *\ntuser.dat Object is locked skipped

    C:\Documents and Settings\Denise *\NTUSER.DAT.LOG Object is locked skipped

    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    C:\System Volume Information\_restore{9B3A9E55-0B5E-4984-8035-0717AC161956}\RP430\change.log Object is locked skipped

    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

    C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped

    C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped

    C:\WINDOWS\Internet Logs\GDAR-RDYY0ZCGSV.ldb Object is locked skipped

    C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped

    C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped

    C:\WINDOWS\SchedLgU.Txt Object is locked skipped

    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

    C:\WINDOWS\Sti_Trace.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\default Object is locked skipped

    C:\WINDOWS\system32\config\default.LOG Object is locked skipped

    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

    C:\WINDOWS\system32\config\SAM Object is locked skipped

    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

    C:\WINDOWS\system32\config\software Object is locked skipped

    C:\WINDOWS\system32\config\software.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\system Object is locked skipped

    C:\WINDOWS\system32\config\system.LOG Object is locked skipped

    C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped

    C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped

    C:\WINDOWS\system32\h323log.txt Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

    C:\WINDOWS\Temp\ZLT0715d.TMP Object is locked skipped

    C:\WINDOWS\Temp\ZLT07160.TMP Object is locked skipped

    C:\WINDOWS\wiadebug.log Object is locked skipped

    C:\WINDOWS\wiaservc.log Object is locked skipped

    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    DeniseB,
    #13
  15. 2008/05/07
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB
    You said this...
    I downloaded the free AVG, and just disabled the virus protection in my Zone alarm

    So AVG Free should be running real time.
    I'm not sure why you did this? ZA is a good program and like you said you paid for it, so why not use it?
    If it was me I would remove AVG, and reinable ZA, then if at any time you want a second opinion run a on-line scan with Kaspersky, if it happens to find something come here and ask us and post the Kaspersky log.

    Now here is what Kaspersky found.
    Microsoft\Outlook Express\Inbox.dbx/ From WellsFargo online Banking
    Microsoft\Outlook Express\Sent Items.dbx From paypalatsecuresuite.net]/
    Microsoft\Outlook Express\ZoneAlarm Phishing Mail.dbx

    So you need to open up Outlook Express and delete everything in your sent items folder, everything in the ZoneAlarm Phishing Mail.dbx this from your inbox...From WellsFargo online Banking and then delete everthing in your deleted items folder.

    Then run another Kaspersky scan and post the new log.

    Thanks
    Geri
     
    Geri,
    #14
  16. 2008/05/08
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    New Kaspersky

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Thursday, May 08, 2008 10:51:38 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 9/05/2008
    Kaspersky Anti-Virus database records: 748659
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 54392
    Number of viruses found: 1
    Number of infected objects: 0
    Number of suspicious objects: 4
    Duration of the scan process: 01:17:21

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\MailFrontier\reginfo.xml Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Application Data\MailFrontier\ASD.log Object is locked skipped
    C:\Documents and Settings\Denise *\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Inbox.dbx/[From WellsFargo online Banking <security@online.wellsfargo.com>][Date Sun, 30 Sep 2007 18:40:25 +0530]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\Inbox.dbx MailMSOutlook5: suspicious - 1 skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\ZoneAlarm Phishing Mail.dbx/[From <paypal@securesuite.net>][Date Sat, 26 Apr 2008 04:44:41 +0200]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Identities\{989B38F9-B8C3-46F0-82B1-3646FB1EEBF1}\Microsoft\Outlook Express\ZoneAlarm Phishing Mail.dbx MailMSOutlook5: suspicious - 1 skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Temp\~DF571A.tmp Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\ntuser.dat Object is locked skipped
    C:\Documents and Settings\Denise *\NTUSER.DAT.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{9B3A9E55-0B5E-4984-8035-0717AC161956}\RP433\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
    C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
    C:\WINDOWS\Internet Logs\GDAR-RDYY0ZCGSV.ldb Object is locked skipped
    C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
    C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{E718883A-C696-4FCD-93FE-350720152914}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
    C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\ZLT0066e.TMP Object is locked skipped
    C:\WINDOWS\Temp\ZLT07520.TMP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    DeniseB,
    #15
  17. 2008/05/09
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB
    Ok you got some of them but not all.

    Please go back to Outlook Express, look for and delete these.

    Inbox folder
    [From WellsFargo online Banking <security@online.wellsfargo.com>][Date Sun, 30 Sep 2007 18:40:25 +0530

    ZoneAlarm Phishing Mail folder
    [From <paypal@securesuite.net>][Date Sat, 26 Apr 2008 04:44:41 +0200

    Then delete everything in your deleted items folder.

    Let me know if you found them.
    If so please run Kaspersky again.

    Thanks
    Geri
     
    Geri,
    #16
  18. 2008/05/10
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    ??

    Geri,
    Those items were not there when I checked...
    I deleted everything before I ran the scan.. that is so strange.

    I will run it again and post the results below.

    Thanks
    Denise
     
    DeniseB,
    #17
  19. 2008/05/10
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    new kaspersky

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Sunday, May 11, 2008 12:15:43 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 11/05/2008
    Kaspersky Anti-Virus database records: 755297
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 55229
    Number of viruses found: 0
    Number of infected objects: 0
    Number of suspicious objects: 0
    Duration of the scan process: 01:07:05

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\MailFrontier\reginfo.xml Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Application Data\MailFrontier\ASD.log Object is locked skipped
    C:\Documents and Settings\Denise *\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\History\History.IE5\MSHist012008051020080511\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Temp\~DFBE75.tmp Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Temp\~DFBE99.tmp Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Temp\~DFDC25.tmp Object is locked skipped
    C:\Documents and Settings\Denise *\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Denise *\ntuser.dat Object is locked skipped
    C:\Documents and Settings\Denise *\NTUSER.DAT.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{9B3A9E55-0B5E-4984-8035-0717AC161956}\RP435\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
    C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
    C:\WINDOWS\Internet Logs\GDAR-RDYY0ZCGSV.ldb Object is locked skipped
    C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
    C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{375B62B0-E5E4-4A7C-A918-A45DD3F98457}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
    C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\ZLT0339d.TMP Object is locked skipped
    C:\WINDOWS\Temp\ZLT033a1.TMP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    DeniseB,
    #18
  20. 2008/05/11
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi DeniseB
    OK Great That shows clean.

    How are things running?

    You can delete any tools you were asked to download and the files/folders or logs they created, There will be newer versions if ever needed again any way.

    Delete dss.exe and the folder C:\Deckard

    Malwarebytes' Anti-Malware you can keep if you want.

    Let me know how things are.

    Thanks
    Geri
     
    Geri,
    #19
  21. 2008/05/11
    DeniseB

    DeniseB Inactive Thread Starter

    Joined:
    2007/09/18
    Messages:
    70
    Likes Received:
    0
    Thanks Geri.... you were so helpful!

    God Bless
     
    DeniseB,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...