1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved I think I downloaded Malware, Bing.zugotoolbar

Discussion in 'Malware and Virus Removal Archive' started by Blue Skys, 2010/02/20.

Page 1 of 3
  1. 2010/02/20
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    [Resolved] I think I downloaded Malware, Bing.zugotoolbar

    Please forgive me if this seems weird. I have never made a post of any kind. And, I don't know if this post should be here or in another location. I am not very good with Vista, and I find some type of problem I don't understand almost everyday. I have problems with my dvd drive (it will not eject the disk after I back up my files). If I listen to a CD, it may eject or may not. It may play or may not. I can't copy songs from CD's if I have more than one. Auto play doesn't work. My "Windows Live Photo Gallery" tells me that I need "codecs" from the manufacture to see some of my photos (I go to the web site and do not understand what I am really looking for, etc.). So Please forgive me for not realizing right away that I may have a Malware problem. With Vista, I have been so busy putting out fires, I really do not realize a new problem until it hits me in the head.
    So, now to my NEW problem(s) is, all of a sudden when I try to use a search engine (Google, Yahoo, etc), I am redirected to "Bing.zugotool bar.com. This is in the address bar on the top of my screen: hxxp://bing_dot_zugotoolbar.com/s/?...=Bing&q=http://bing.zugotoolbar.com/s/?iesrc=. It then takes you to some site that has nothing to do with what you were looking into.
    Multiple problems have arose since I started this post. I now have 4 screens that will not close when you left click the “X”. They show on the bottom of the screen, and when you bring them up, you have an “hourglass” showing, and nothing I do can close these windows.
    Also, I just found I have a file missing. I always use my personal "Download File" to save things from the internet. And, I can't find that file. The "Public Download File" is there, but a search at the start button can't find my file.
    I'll try to be as precise as possible. Unfortunately, some of the messages I am relaying is not verbatim. These problems have arose over the last week or so. A change I made prior to the problems starting was to run an "Apple Software Update" from my program file, I used my "Start Button ", brought up all files. An update was found for "Quicktime ", I downloaded it, but then I could not install the update. For two days I kept getting a message saying "Administrator settings state you do not have permission to install this program ", (this is not the exact verbage).
    I used the "Windows Vista Solutions" web site to help me, and the suggestions I found said to go to Properties, Security Tab, make sure the check marks were checked in the "Permissions" area for the "Administrator ", they were appropriate and I was logged in as Administrator at the time. I tried again to install to no avail. I tried the second suggestion, to right click and "install as administrator ", I tried that, and the option was not offered.
    I found yet another site, "Vistaheads.com. I searched for my problem, and found someone that seemed to have the same problem. I started to read his post, but, had to leave, I put my PC into sleep mode. I looked the next day also, but could not find the post again. (I checked earlier today and still cannot find the post.) The installation could still not be completed. Sleep mode was used that day also. The next day, I hit the space bar, (to open the PC) and the program started to load on it's own (or it seemed like that). As the update proceeded it came to a spot when it asked if I want to install "Bing.zugotoolbar ", and the box was already checked. I removed the check mark, and hit "install ". The program installed and the last message was "Update was installed correctly" (again, not exact verbage). I did not feel good about this, but no new problems were apparent for a couple of days. Then the first sign of new trouble was the redirection of the browser. I decided to find information pertinent to this issue. I used "Ask" and typed "What is bing.zugotoolbar ", and found many posts stating that it is Malware.
    This is how I found your web site. I searched through out this site and found someone that seemed to have a problem similar to mine. I read the entire post, but, really only understood half of what they were talking about. After reading his entry, I double checked what I could understand. I can not find the program in "My computer ", I then checked under "Computer ", "OS ", checked both "Program files" and "Program Files (x86). Nothing there either.
    Details of my system: Vista Home Premium , Service Pack 2.
    Dell - Inspiron 530S
    Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
    2.50GHz
    G33/G31 Express Chip Set Family
    Ram 4.00
    System 64-bit operating system
    OS (C:) Total Size 451 GB
    Total Free 342 GB
    Internet: Dial up
    I'm running Avira AntiVir Desktop Personal (free edition), which I update all the time. I'm using Windows Firewall (active) have, Windows Defender and Avira AntiVir (virus protection- active). Other Security Settings - "all security setting are set to recommended settings. User Accounts, is turned on. I have "Automatic Windows Update" turned on.
    Last "Full System Scan" today2/20/10
    Daily "each day at 12:00.

    I just looked at my log in Avira and found that this program found "19 viruses or unwanted programs were found.
    I do not know just what more you may need. I suppose you will need the logs, if in actually, the post I added above turns out not to be the same problem. Any thing you may be able to help me with will be greatly appreciated.

    Thanks in advance,

    I was going to preview this post, but, I can't seem to get it to load. I hope this thing just gets to you. Thanks again.

    I have tried 3 times not and as soon as I hit enter, my screen shows my tab change from "windows BBS - Post New Thread to the word "loading ", but the little circle (showing me it is working) just stays still. I will keep trying. Also, something new, I can not scan my computer now with Windows Defender. I can open the Security Center, go to Windows Defender, hit scan, nothing happens. I also tried going through the Control Panel, to Security, Windows Defender, left click, and the little hand just stays there. Now remember, I have a session of Defender running, (it is on the Quarantine Screen) I cannot close it. Left or right click gives you nothing. It just shows the cursor.

    I will try to submit this to you again. My screen just blinks very fast and goes to the bing.zugotoolbar.com and sits there. I tried using Windows Defender to see what programs are running, so I can close Defender, but left or right click does nothing.

    I tried again to submit this to you, (I do get a screen stating that I am sending information over an unencrypted connection, I left click continue, and this is what I get each time. hxxp://bing_dot_zugotoolbar.com/s/?...=Bing&q=http://bing.zugotoolbar.com/s/?iesrc= And, a circle that is standing still.

    I have been using my "Back" and "Forward" buttons to bring me back to this screen. I disconnected my internet connection and started it again. Lets see if that helps. I really don't want to loose this post.

    I can not believe this, I submitted this, and it loaded, but the screen response is telling I am not logged on. So, I tried to log in and it said "Your submission could not be processed because you have logged in since the previous page was loaded." What does that mean? Now, my token has expired.

    To finally get this to you, I opened another tab for your site, logged off, then on. I copied the original post from the other tab and pasted it here.
    So now, after 6 hours of trying to get this to you, here it is. My dial up is very slow. On Monday 2/22/10 or on the 23rd, I may be able to get rid of the dial up. I hope.
    Thanks again,

    [I made links not clickable - Broni]
     
    Last edited by a moderator: 2010/02/20
    Blue Skys,
    #1
  2. 2010/02/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Read this post, then post the requested log(s).
     
    broni,
    #2


  3. to hide this advert.

  4. 2010/02/22
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Broni,
    Thanks for being so quick, but I have a question before we start. I really don't want to develop bad habits when using threads. And since this was my first ever, please help.

    I read the information you requested, my question, did I ***** up when I wrote to post my question? To much information, not enough, etc. The only thing I belive you may have been referring to is at the beginning of the post, I listed multiple problems I have had with using Vista. I thought you would need this information to make a determation as to if my problem was software or a possible Malware issue. If this is not how it is done. Please let me know.
    As to the request about the download, I can down load the mirror to the desktop, but I have never sent logs to anyone. If you would let me know just how this is done, I will be glad to take care of it.
    Thanks again!
     
    Blue Skys,
    #3
  5. 2010/02/22
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Broni,
    I was going to do the download, and I realized two things: Where would I find an example of a script blocking program to make sure it is off? Would that be like a firewall, or Windows Defender? And, when I download a program (actually anything) it go to a little window (I think it is from Firefox), you can see it loading, but I am never given the chance to say "Where to save it ". It only has, OPEN, OPEN FILE LOCATION, SELECT ALL, ETC. Items like that, so if you know how to get around this please let me know so I can save the file to my desktop as requested. Thanks once more.
    I downloaded the Mirror1 and I ran it. I now have the two files you asked for and they are saved on my desk top. I still need help getting them to you. I tried to copy and paste, because that is all I knew to do. But obviously that did not work. So please let me know what to do from here.
    PS. I still would like to know about the above two questions.
     
    Last edited: 2010/02/22
    Blue Skys,
    #4
  6. 2010/02/22
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Regarding all info you provided, you did fine. The more we know, the better.
    What is the cause of your problems?
    We'll know more, when we make sure, your computer is clean.

    Copy and paste is the way to go. What happened?
     
    broni,
    #5
  7. 2010/02/23
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    I went to my desktop and right clicked and hit copy. I then brought up this screen and came to this exact spot and right clicked again to paste the copy of the file. The only things I had as options were "Delete" and "Select All ". Paste is grayed out.

    I just tried it again and the same thing happens. Am I trying to copy to the wrong area? If so, where should I go? And, as always, thanks a bunch!!
     
    Blue Skys,
    #6
  8. 2010/02/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You have to open DDS logs in Notepad, select all text, then copy and paste the content into your next reply.
     
    broni,
    #7
  9. 2010/02/24
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    DDS (Ver_09-12-01.01) - NTFSX64
    Run by Charlotte at 18:02:29.18 on Mon 02/22/2010
    Internet Explorer: 8.0.6001.18882 BrowserJavaVersion: 1.6.0_17
    Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.4084.1938 [GMT -5:00]

    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    FW: PC-cillin Internet Security - Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Program Files\Dell\DellDock\DockLogin.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\AERTSr64.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files (x86)\APC\APC PowerChute Personal Edition\mainserv.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio64.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RAVCpl64.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files (x86)\Digital Line Detect\DLG.exe
    C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files (x86)\Java\jre6\bin\jusched.exe
    C:\Program Files\Dell\DellDock\DellDock.exe
    C:\Program Files (x86)\APC\APC PowerChute Personal Edition\apcsystray.exe
    C:\Windows\splwow64.exe
    C:\Windows\helppane.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RAVCpl64.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files (x86)\Upromise\UpromiseTray.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files (x86)\Digital Line Detect\DLG.exe
    C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Dell\DellDock\DellDock.exe
    C:\Program Files (x86)\Java\jre6\bin\jusched.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\APC\APC PowerChute Personal Edition\apcsystray.exe
    C:\Windows\splwow64.exe
    C:\Program Files (x86)\Internet Explorer\IELowutil.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\Charlotte\Documents\Desktop\dds.scr
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://Bing.zugo.com/?cfg=2-71-0-e8MD
    uWindow Title = Internet Explorer provided by Dell
    uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5081226
    mLocal Page = c:\windows\syswow64\blank.htm
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files (x86)\yahoo!\companion\installs\cpn\yt.dll
    uURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - c:\program files (x86)\search toolbar\tbhelper.dll
    mWinlogon: Userinit=userinit.exe
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files (x86)\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Smart-Shopper: {4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} - c:\program files (x86)\smart-shopper\bin\2.5.1\Smrt-Shpr.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files (x86)\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files (x86)\google\google toolbar\GoogleToolbar.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files (x86)\google\googletoolbarnotifier\4.1.805.1852\swg.dll
    BHO: DCA BHO: {b49699fc-1665-4414-a1cb-c4a2a4a13eec} - c:\program files (x86)\upromise\dca-bho.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files (x86)\dell\bae\BAE.dll
    BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files (x86)\msn\toolbar\3.0.1125.0\msneshellx.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files (x86)\windows live\toolbar\wltcore.dll
    BHO: Upromise TurboSaver: {edc0f17f-f4b7-47e4-b73e-887faeb376fa} - c:\program files (x86)\upromise\upromisetoolbar.dll
    BHO: TBSB05974 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files (x86)\search toolbar\tbcore3.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files (x86)\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files (x86)\google\google toolbar\GoogleToolbar.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files (x86)\windows live\toolbar\wltcore.dll
    TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files (x86)\msn\toolbar\3.0.1125.0\msneshellx.dll
    TB: Upromise TurboSaver: {06e58e5e-f8cb-4049-991e-a41c03bd419e} - c:\program files (x86)\upromise\upromisetoolbar.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files (x86)\yahoo!\companion\installs\cpn\yt.dll
    TB: Search Toolbar: {0c8413c1-fad1-446c-8584-be50576f863e} - c:\program files (x86)\search toolbar\tbcore3.dll
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    EB: SmartShopper: {8bcb5337-ec01-4e38-840c-a964f174255b} - c:\program files (x86)\smart-shopper\bin\2.5.1\Smrt-Shpr.dll
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    uRun: [Upromise Tray] c:\program files (x86)\upromise\UpromiseTray.exe
    uRun: [Weather] c:\program files (x86)\aws\weatherbug\Weather.exe 1
    uRun: [Pareto_Update] c:\program files (x86)\common files\paretologic\uus2\Pareto_Update.exe
    uRun: [WMPNSCFG] c:\program files (x86)\windows media player\WMPNSCFG.exe
    mRun: [Microsoft Default Manager] "c:\program files (x86)\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
    mRun: [avgnt] "c:\program files (x86)\avira\antivir desktop\avgnt.exe" /min
    mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime
    StartupFolder: c:\users\charlo~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
    StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\apcups~1.lnk - c:\program files (x86)\apc\apc powerchute personal edition\Display.exe
    StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files (x86)\digital line detect\DLG.exe
    StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\kodake~1.lnk - c:\program files (x86)\kodak\kodak easyshare software\bin\EasyShare.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - c:\program files (x86)\upromise\upromisetoolbar.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll
    IE: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - {6FAC4823-815E-4361-836E-46D65ED2550B} - c:\program files (x86)\smart-shopper\bin\2.5.1\Smrt-Shpr.dll
    IE: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - {4CF088BD-BE95-40a5-BE9B-677F8683EDEA} - c:\program files (x86)\smart-shopper\bin\2.5.1\Smrt-Shpr.dll
    Trusted Zone: google.com
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    TCP: {3F571984-8185-4021-8231-3C596A17027E} = 64.179.43.190 69.95.31.250
    TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    TB-X64: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - No File
    TB-X64: {0C8413C1-FAD1-446C-8584-BE50576F863E} - No File
    EB-X64: {8BCB5337-EC01-4E38-840C-A964F174255B} - No File
    mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun-x64: [RtHDVCpl] RAVCpl64.exe
    mRun-x64: [Skytel] Skytel.exe
    mRun-x64: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun-x64: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun-x64: [Persistence] c:\windows\system32\igfxpers.exe
    mRun-x64: [CanonSolutionMenu] "c:\program files (x86)\canon\solutionmenu\CNSLMAIN.exe" /logon
    mRun-x64: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\charlo~1\appdata\roaming\mozilla\firefox\profiles\zh5wtzxu.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://Bing.zugo.com/?cfg=2-71-0-e8MD\n
    FF - prefs.js: keyword.URL - hxxp://bing.zugotoolbar.com/s/?iesrc=IE-Address&site=Bing&q=
    FF - component: c:\users\charlotte\appdata\roaming\mozilla\firefox\profiles\zh5wtzxu.default\extensions\{896642e4-c556-4ed3-85d1-9ac431603e7d}\components\Engine.dll
    FF - plugin: c:\program files (x86)\mozilla firefox\plugins\NPcol400.dll
    FF - plugin: c:\program files (x86)\windows live\photo gallery\NPWLPG.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
    c:\program files (x86)\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
    c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
    c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

    ============= SERVICES / DRIVERS ===============

    R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2008-12-26 53488]
    R2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSr64.exe [2008-12-26 86016]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\avira\antivir desktop\sched.exe [2009-7-27 108289]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files (x86)\avira\antivir desktop\avguard.exe [2009-7-27 185089]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-7-27 74880]
    R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-9-23 155648]
    R3 CAXHWBS2;CAXHWBS2;c:\windows\system32\drivers\CAXHWBS2.sys [2008-12-26 411136]
    S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-8-16 89920]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648]
    S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968]
    S4 TmPfw;Trend Micro Personal Firewall;c:\progra~2\trendm~1\intern~1\tmpfw.exe --> c:\progra~2\trendm~1\intern~1\TmPfw.exe [?]

    ============== File Associations ===============

    JSEFile=c:\windows\syswow64\WScript.exe "%1" %*

    =============== Created Last 30 ================

    2010-02-13 18:15:59 0 d-----w- c:\users\charlo~1\appdata\roaming\PeerNetworking
    2010-02-10 22:25:31 4698184 ----a-w- c:\windows\system32\ntoskrnl.exe
    2010-02-10 21:43:52 1425480 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2010-02-10 21:43:49 40448 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
    2010-02-10 21:15:49 453632 ----a-w- c:\windows\system32\drivers\srv.sys
    2010-02-10 21:15:49 142336 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2010-02-10 18:56:41 273408 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2010-02-10 18:56:41 135168 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2010-02-06 15:04:06 2146 ----a-w- c:\users\charlotte\.recently-used.xbel
    2010-01-30 16:23:33 0 d-----w- c:\users\charlo~1\appdata\roaming\E-centives
    2010-01-30 12:49:57 0 d-----w- c:\users\charlo~1\appdata\roaming\Blitware
    2010-01-30 12:05:32 0 d-----w- c:\program files (x86)\Search Toolbar
    2010-01-30 11:55:25 0 d-----w- c:\program files (x86)\Driver Robot
    2010-01-30 11:05:59 0 d-----w- c:\program files (x86)\File Extension Finder

    ==================== Find3M ====================

    2010-02-20 22:19:15 16322 ----a-w- c:\users\charlo~1\appdata\roaming\wklnhst.dat
    2010-01-14 16:12:06 212352 ------w- c:\windows\system32\MpSigStub.exe
    2010-01-02 07:08:29 1147904 ----a-w- c:\windows\system32\wininet.dll
    2010-01-02 07:03:21 77312 ----a-w- c:\windows\system32\iesetup.dll
    2010-01-02 07:03:21 132096 ----a-w- c:\windows\system32\iesysprep.dll
    2010-01-02 06:38:20 916480 ----a-w- c:\windows\syswow64\wininet.dll
    2010-01-02 06:38:04 1208832 ----a-w- c:\windows\syswow64\urlmon.dll
    2010-01-02 06:36:10 206848 ----a-w- c:\windows\syswow64\occache.dll
    2010-01-02 06:33:34 5942784 ----a-w- c:\windows\syswow64\mshtml.dll
    2010-01-02 06:33:32 594432 ----a-w- c:\windows\syswow64\msfeeds.dll
    2010-01-02 06:33:32 55296 ----a-w- c:\windows\syswow64\msfeedsbs.dll
    2010-01-02 06:32:51 25600 ----a-w- c:\windows\syswow64\jsproxy.dll
    2010-01-02 06:32:33 71680 ----a-w- c:\windows\syswow64\iesetup.dll
    2010-01-02 06:32:33 1985536 ----a-w- c:\windows\syswow64\iertutil.dll
    2010-01-02 06:32:33 164352 ----a-w- c:\windows\syswow64\ieui.dll
    2010-01-02 06:32:33 109056 ----a-w- c:\windows\syswow64\iesysprep.dll
    2010-01-02 06:32:32 55808 ----a-w- c:\windows\syswow64\iernonce.dll
    2010-01-02 06:32:32 184320 ----a-w- c:\windows\syswow64\iepeers.dll
    2010-01-02 06:32:32 11070464 ----a-w- c:\windows\syswow64\ieframe.dll
    2010-01-02 06:32:26 387584 ----a-w- c:\windows\syswow64\iedkcs32.dll
    2010-01-02 05:25:39 162816 ----a-w- c:\windows\system32\ieUnatt.exe
    2010-01-02 04:57:00 133632 ----a-w- c:\windows\syswow64\ieUnatt.exe
    2010-01-02 04:56:50 173056 ----a-w- c:\windows\syswow64\ie4uinit.exe
    2010-01-02 04:56:14 13312 ----a-w- c:\windows\syswow64\msfeedssync.exe
    2009-12-09 21:24:52 51200 ----a-w- c:\windows\inf\infpub.dat
    2009-12-09 21:24:52 143360 ----a-w- c:\windows\inf\infstrng.dat
    2009-12-04 18:52:22 14848 ----a-w- c:\windows\system32\tsbyuv.dll
    2009-12-04 18:51:44 1570816 ----a-w- c:\windows\system32\quartz.dll
    2009-12-04 18:50:40 25600 ----a-w- c:\windows\system32\msyuv.dll
    2009-12-04 18:50:37 38400 ----a-w- c:\windows\system32\msvidc32.dll
    2009-12-04 18:50:33 15872 ----a-w- c:\windows\system32\msrle32.dll
    2009-12-04 18:49:49 54272 ----a-w- c:\windows\system32\iyuv_32.dll
    2009-12-04 18:30:05 12288 ----a-w- c:\windows\syswow64\tsbyuv.dll
    2009-12-04 18:29:41 1314816 ----a-w- c:\windows\syswow64\quartz.dll
    2009-12-04 18:28:52 22528 ----a-w- c:\windows\syswow64\msyuv.dll
    2009-12-04 18:28:51 31744 ----a-w- c:\windows\syswow64\msvidc32.dll
    2009-12-04 18:28:51 123904 ----a-w- c:\windows\syswow64\msvfw32.dll
    2009-12-04 18:28:49 13312 ----a-w- c:\windows\syswow64\msrle32.dll
    2009-12-04 18:28:27 82944 ----a-w- c:\windows\syswow64\mciavi32.dll
    2009-12-04 18:28:21 50176 ----a-w- c:\windows\syswow64\iyuv_32.dll
    2009-12-04 18:27:12 91136 ----a-w- c:\windows\syswow64\avifil32.dll
    2009-10-28 06:27:19 86016 ----a-w- c:\windows\inf\infstor.dat
    2009-10-28 06:27:19 665600 ----a-w- c:\windows\inf\drvindex.dat
    2008-01-21 03:21:59 174 --sha-w- c:\program files\desktop.ini
    2008-01-21 03:21:59 174 --sha-w- c:\program files (x86)\desktop.ini
    2006-11-02 15:14:56 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
    2006-11-02 15:14:56 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
    2006-11-02 15:14:56 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
    2006-11-02 15:14:56 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
    2006-11-02 10:52:12 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
    2006-11-02 10:52:12 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
    2006-11-02 10:52:10 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
    2006-11-02 10:52:10 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
    2009-11-09 20:08:07 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
    2009-11-17 00:14:18 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
    2009-10-16 15:15:08 245760 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
    2009-10-29 12:48:54 16384 --sha-w- c:\windows\temp\cookies\index.dat
    2009-10-29 12:48:54 32768 --sha-w- c:\windows\temp\history\history.ie5\index.dat
    2009-10-29 12:48:54 32768 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat
    2008-12-26 19:28:01 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

    ============= FINISH: 18:03:10.05 ===============
     
    Blue Skys,
    #8
  10. 2010/02/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very good :)
    I need 2nd part too.
     
    broni,
    #9
  11. 2010/02/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    This is very same part. We need Attach.txt content.
     
    broni,
    #10
  12. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-12-01.01)

    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume3
    Install Date: 12/26/2008 7:02:03 AM
    System Uptime: 2/21/2010 10:51:53 AM (32 hours ago)

    Motherboard: Dell Inc. | | 0RY007
    Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz | Socket 775 | 2500/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 451 GiB total, 342.095 GiB free.
    D: is FIXED (NTFS) - 15 GiB total, 5.994 GiB free.
    E: is CDROM (UDF)

    ==== Disabled Device Manager Items =============

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Microsoft ISATAP Adapter
    Device ID: ROOT\*ISATAP\0001
    Manufacturer: Microsoft
    Name: Microsoft ISATAP Adapter #2
    PNP Device ID: ROOT\*ISATAP\0001
    Service: tunnel

    ==== System Restore Points ===================

    RP309: 1/24/2010 4:09:09 PM - Paint.NET v3.5.2
    RP310: 1/27/2010 7:11:26 PM - Windows Update
    RP311: 1/28/2010 8:08:58 PM - Windows Update
    RP312: 1/29/2010 1:32:01 PM - Removed Clip Art Collection
    RP313: 1/30/2010 11:01:37 AM - Windows Backup
    RP314: 2/1/2010 1:19:45 PM - Windows Update
    RP315: 2/4/2010 11:35:17 PM - Windows Update
    RP316: 2/6/2010 12:59:59 PM - Windows Backup
    RP317: 2/6/2010 1:02:09 PM - Installed Apple Application Support
    RP318: 2/6/2010 1:04:04 PM - Installed Apple Application Support
    RP319: 2/6/2010 1:09:27 PM - Windows Backup
    RP320: 2/6/2010 6:12:35 PM - Removed Clip Art Collection
    RP321: 2/6/2010 6:45:06 PM - Installed QuickTime
    RP322: 2/6/2010 6:53:34 PM - Installed QuickTime
    RP323: 2/8/2010 2:21:07 PM - Installed QuickTime
    RP324: 2/8/2010 4:35:46 PM - Installed QuickTime
    RP325: 2/8/2010 4:56:25 PM - Installed QuickTime
    RP326: 2/8/2010 5:08:58 PM - Installed QuickTime
    RP327: 2/8/2010 5:10:08 PM - Installed QuickTime
    RP328: 2/8/2010 5:16:26 PM - Installed QuickTime
    RP329: 2/8/2010 5:38:12 PM - Installed QuickTime
    RP330: 2/8/2010 6:56:20 PM - Installed QuickTime
    RP331: 2/8/2010 11:25:28 PM - Windows Update
    RP332: 2/11/2010 4:02:20 PM - Windows Update
    RP333: 2/13/2010 10:41:05 AM - Windows Update
    RP334: 2/13/2010 11:11:25 AM - Windows Backup
    RP335: 2/14/2010 1:34:32 AM - Installed QuickTime
    RP336: 2/15/2010 1:29:52 PM - Windows Update
    RP337: 2/16/2010 4:08:59 PM - Scheduled Checkpoint
    RP338: 2/18/2010 9:24:14 AM - Scheduled Checkpoint
    RP339: 2/19/2010 12:00:13 AM - Scheduled Checkpoint
    RP340: 2/19/2010 1:55:14 PM - Windows Update
    RP341: 2/20/2010 11:24:21 AM - Windows Backup
    RP342: 2/21/2010 11:31:32 AM - Scheduled Checkpoint
    RP343: 2/22/2010 12:00:06 AM - Scheduled Checkpoint
    RP344: 2/22/2010 5:05:37 PM - Windows Update

    ==== Installed Programs ======================

    AbiWord 2.6.4
    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 Plugin
    Adobe Flash Player ActiveX
    Adobe Reader 9.3
    APC PowerChute Personal Edition
    Apple Application Support
    Apple Software Update
    Art Explosion Greeting Card Factory Express
    Art Explosion Scrapbook Factory
    Avira AntiVir Personal - Free Antivirus
    Browser Address Error Redirector
    Canon MP Navigator EX 1.0
    Canon MX310 series User Registration
    Canon Utilities Easy-PhotoPrint EX
    Canon Utilities My Printer
    Canon Utilities Solution Menu
    CCScore
    Choice Guard
    Clip Art Collection
    Compatibility Pack for the 2007 Office system
    Dell-eBay
    Dell Best of Web
    Dell Driver Download Manager
    Dell Getting Started Guide
    Digital Line Detect
    Driver Robot 1.0.9.13
    EDocs
    ESSBrwr
    ESSCDBK
    ESScore
    ESSgui
    ESSini
    ESSPCD
    ESSPDock
    ESSSONIC
    ESSTOOLS
    essvatgt
    EZ Cards (remove only)
    fflink
    FoxyTunes for Firefox
    Frosty Games
    Gimp 2.6.2 Debug
    Google Toolbar for Internet Explorer
    GoToAssist 8.0.0.514
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    InstallMgr
    Java(TM) 6 Update 17
    Java(TM) 6 Update 7
    kgcbaby
    kgcbase
    kgchday
    kgchlwn
    kgcinvt
    kgckids
    kgcmove
    kgcvday
    KODAK EASYSHARE Gallery Upload ActiveX Control
    Kodak EasyShare software
    KSU
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB953297)
    Microsoft Default Manager
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Research AutoCollage 2008 version 1.1
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Works
    Mozilla Firefox (3.6)
    MSN Toolbar
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    netbrdg
    NetWaiting
    Notifier
    OfotoXMI
    Photo Explosion SE
    Quicken WillMaker Plus 2005
    QuickTime
    Realtek High Definition Audio Driver
    Roxio Creator Audio
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio Update Manager
    Scrapbook Flair
    Scrapbooks Please Uploader
    SFR
    SHASTA
    SKIN0001
    SKINXSDK
    SmartShopper
    staticcr
    tooltips
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Upromise TurboSaver (remove only)
    VPRINTOL
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Player Firefox Plugin
    WIRELESS
    Wyyo 1.0 build 137
    Yahoo! Toolbar

    ==== End Of File ===========================
     
    Blue Skys,
    #11
  13. 2010/02/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scan.***

    STEP 1. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    RESTART COMPUTER

    STEP 3. Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #12
  14. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.44
    Database version: 3795
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18882

    2/26/2010 4:56:50 AM
    mbam-log-2010-02-26 (04-56-50).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 283029
    Time elapsed: 53 minute(s), 23 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 38
    Registry Values Infected: 0
    Registry Data Items Infected: 1
    Folders Infected: 8
    Files Infected: 9

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\smart-shopper.hbax (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{305c6cb1-9d31-4489-881d-5a8e2dc3fe14} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e79b1445-dfea-4bef-a786-e0c0f33c863b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{4cf088bd-be95-40a5-be9b-677f8683edea} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{6fac4823-815e-4361-836e-46d65ed2550b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{911f251e-34fd-465e-b6ce-df00ff49a6be} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{fe4f1649-8909-49c0-87ba-24d65120db46} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.hbax.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.hbinfoband (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.hbinfoband.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebutton (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebutton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttona (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttona.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttonb (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttonb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{90f62ef7-58d1-4e8e-bb3e-cfb10ba9e47b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{b2b92bc9-e149-4ee8-a93e-0b8cfb329808} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{022c671f-6cba-4a03-a8f9-3b3a361b235a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{8ad815fc-607b-419f-8b70-d345a507a54e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wyyo (Adware.Zwangi) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\smart-shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Wyyo (Adware.Wyyo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Program Files (x86)\PC MightyMax 2009 (Rogue.PcMightyMax) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Wyyo (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\ProgramData\Wyyo (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\Bin\2.5.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing (Adware.SmartShopper) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Program Files (x86)\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\$Recycle.Bin\S-1-5-21-2703132291-4135161347-3693838283-1000\$R1OBWIO\PCMightyMax2009_164.EXE (Rogue.PCMightyMax) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Wyyo\uninstall.exe (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\ProgramData\Wyyo\wyyo137.exe (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\Uninst.exe (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\antiphishing.html (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\phishAlert.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\x.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\xActive.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
     
    Blue Skys,
    #13
  15. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Broni,
    Sorry about loading the same log over. I was able to download step one above and it updated it's self fine then ran fine. I went through the steps you provided. (step one only), due to the hour of the morning. But, I wanted to make sure you had the log from step one, before I hung it up for the night. I tried twice. Each time, the little circle kept moving like it was loading to you, but, I checked my dial up screen, and the bytes in the sent and receive were not moving. It just stopped. I checked the connection and it was fine. I used my back button to get back to the previous screen and then it started transmitting again just fine. So I tried again, and the exact same thing happened. I have the log on my desk top and I will try to download to you later this A.M.

    And, you did not mention that i would get a small window open up stating that "I have chosen to open "bbs-728x90.html, which is a :Firefox Document from http://www.infinisource.com. Then it asked what Firefox do with this file?
    open with (Firefox (default) ), Save file (which was already picked for me). So I did nothing with this file. I will deal with the transmitting the log from the scan in Step 1 and the bbs file when I get up and back at this.
    And thanks a lot for all of the help thus far. At least I do feel I am doing something to get my PC cleaned up.

    Have a good day and I'll get back to this as soon as I can.
     
    Blue Skys,
    #14
  16. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.44
    Database version: 3795
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18882

    2/26/2010 4:56:50 AM
    mbam-log-2010-02-26 (04-56-50).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 283029
    Time elapsed: 53 minute(s), 23 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 38
    Registry Values Infected: 0
    Registry Data Items Infected: 1
    Folders Infected: 8
    Files Infected: 9

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\smart-shopper.hbax (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{305c6cb1-9d31-4489-881d-5a8e2dc3fe14} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e79b1445-dfea-4bef-a786-e0c0f33c863b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{4cf088bd-be95-40a5-be9b-677f8683edea} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{6fac4823-815e-4361-836e-46d65ed2550b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{911f251e-34fd-465e-b6ce-df00ff49a6be} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{fe4f1649-8909-49c0-87ba-24d65120db46} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.hbax.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.hbinfoband (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.hbinfoband.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebutton (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebutton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttona (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttona.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttonb (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.iebuttonb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{90f62ef7-58d1-4e8e-bb3e-cfb10ba9e47b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{b2b92bc9-e149-4ee8-a93e-0b8cfb329808} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{022c671f-6cba-4a03-a8f9-3b3a361b235a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{8ad815fc-607b-419f-8b70-d345a507a54e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wyyo (Adware.Zwangi) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\smart-shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Wyyo (Adware.Wyyo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Program Files (x86)\PC MightyMax 2009 (Rogue.PcMightyMax) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Wyyo (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\ProgramData\Wyyo (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\Bin\2.5.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing (Adware.SmartShopper) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Program Files (x86)\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\$Recycle.Bin\S-1-5-21-2703132291-4135161347-3693838283-1000\$R1OBWIO\PCMightyMax2009_164.EXE (Rogue.PCMightyMax) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Wyyo\uninstall.exe (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\ProgramData\Wyyo\wyyo137.exe (Adware.Zwangi) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\Uninst.exe (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\antiphishing.html (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\phishAlert.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\x.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\Smart-Shopper\cs\antiphishing\xActive.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
     
    Blue Skys,
    #15
  17. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Broni,

    I am sorry, I do not really know just what happened. As I stated, I could not get the scan you needed to load so I used the "Go Advanced" to try and get it to you and this is where I ended up.

    Did I mess up our entire thread? I hope not. Please let me know what to do with the open file I received, please. I do not understand, but I just received a 2nd document (the same as the first one, as stated in my last post. Now I have two of the same thing.

    I really don't know what is going on. Just let me know what to do, and I will do it. I did not save either of the www.infinisource.com documents since your instructions said not to do anything until we get this thing cleaned up. But, like I said, just let me know what you want me to do.

    Thanks again, you have been very patient and I appreciate it very much.
     
    Blue Skys,
    #16
  18. 2010/02/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Malwarebytes log posted just fine. Please, proceed with next steps.
     
    broni,
    #17
  19. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Broni:
    Step 2 completed
    I downloaded the GMER and ran the scan. It came back with "no errors found ". I saved the file, and of course there was nothing to copy and paste. I am going to do step 3 now.

    And, I know what you said about not adding anything to my PC (software, etc). But, to my dismay, I have no choice. My dial up internet connection is going away today. I ordered a AT&T wireless stick to try and get a connection that is actually usable. I was told when you insert it into the usb port the software automaticlly downloads. I hope this does not ***** up any of our work. But, with the connection I have now, it takes hours to download a 1mg file.

    I hope the files I give you will still be able to help us figure this problem out. Thanks, and after installation I hope to be back tonight.
     
    Blue Skys,
    #18
  20. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:07:16 PM, on 2/26/2010
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18882)
    Boot mode: Normal

    Running processes:
    C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe
    C:\Program Files (x86)\Upromise\UpromiseTray.exe
    C:\Program Files (x86)\Digital Line Detect\DLG.exe
    C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files (x86)\Java\jre6\bin\jusched.exe
    C:\Program Files (x86)\APC\APC PowerChute Personal Edition\apcsystray.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\Search Toolbar\tbhelper.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
    O2 - BHO: DCA - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files (x86)\Upromise\dca-bho.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
    O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O2 - BHO: TBSB05974 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll
    O3 - Toolbar: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Search Toolbar - {0C8413C1-FAD1-446C-8584-BE50576F863E} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll
    O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Upromise Tray] C:\Program Files (x86)\Upromise\UpromiseTray.exe
    O4 - HKCU\..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1
    O4 - HKCU\..\Run: [Pareto_Update] C:\Program Files (x86)\Common Files\ParetoLogic\UUS2\Pareto_Update.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
    O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
    O4 - Global Startup: APC UPS Status.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O9 - Extra button: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O9 - Extra 'Tools' menuitem: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    O13 - Gopher Prefix:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3F571984-8185-4021-8231-3C596A17027E}: NameServer = 64.179.43.190 69.95.31.250
    O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files (x86)\APC\APC PowerChute Personal Edition\mainserv.exe
    O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
    O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
    O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
    O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
    O23 - Service: XAudioService - Unknown owner - C:\Windows\system32\DRIVERS\xaudio64.exe (file missing)

    --
    End of file - 10724 bytes
     
    Blue Skys,
    #19
  21. 2010/02/26
    Blue Skys

    Blue Skys Inactive Thread Starter

    Joined:
    2010/02/19
    Messages:
    110
    Likes Received:
    0
    The problem with posting the log from HijackThis is the same as I ran into last night. The little circle is moving but on my internet log I show nothing is coming or going. Ii did notice that as soon as I hit "Post Quick Reply" the next screen I get is a ad from Mozilla trying to redirect me to some type of malware remover. I'll try the Go Advanced, button again. Oh yes, Two more things. 1.) I noticed on the above post "*" are in place of a word I used. I did not say anything bad, is this normal or did I do something incorrect? 2.) Should I delete the logs(and programs) that I have posted to you, or do I need to keep them. I thought I saw something about it, but I just could not find where it was mentioned. Thanks again for all of your help!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:07:16 PM, on 2/26/2010
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18882)
    Boot mode: Normal

    Running processes:
    C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe
    C:\Program Files (x86)\Upromise\UpromiseTray.exe
    C:\Program Files (x86)\Digital Line Detect\DLG.exe
    C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files (x86)\Java\jre6\bin\jusched.exe
    C:\Program Files (x86)\APC\APC PowerChute Personal Edition\apcsystray.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\Search Toolbar\tbhelper.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
    O2 - BHO: DCA - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files (x86)\Upromise\dca-bho.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
    O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O2 - BHO: TBSB05974 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll
    O3 - Toolbar: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Search Toolbar - {0C8413C1-FAD1-446C-8584-BE50576F863E} - C:\Program Files (x86)\Search Toolbar\tbcore3.dll
    O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Upromise Tray] C:\Program Files (x86)\Upromise\UpromiseTray.exe
    O4 - HKCU\..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1
    O4 - HKCU\..\Run: [Pareto_Update] C:\Program Files (x86)\Common Files\ParetoLogic\UUS2\Pareto_Update.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
    O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
    O4 - Global Startup: APC UPS Status.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O9 - Extra button: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O9 - Extra 'Tools' menuitem: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    O13 - Gopher Prefix:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3F571984-8185-4021-8231-3C596A17027E}: NameServer = 64.179.43.190 69.95.31.250
    O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files (x86)\APC\APC PowerChute Personal Edition\mainserv.exe
    O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
    O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
    O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
    O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
    O23 - Service: XAudioService - Unknown owner - C:\Windows\system32\DRIVERS\xaudio64.exe (file missing)

    --
    End of file - 10724 bytes
     
    Blue Skys,
    #20
Page 1 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...