1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive I need help with a virus that keeps coming back.

Discussion in 'Malware and Virus Removal Archive' started by JoelChar, 2008/11/24.

  1. 2008/11/24
    JoelChar

    JoelChar Inactive Thread Starter

    Joined:
    2008/11/24
    Messages:
    1
    Likes Received:
    0
    [Inactive] I need help with a virus that keeps coming back.

    my anti virus software (Avg) keeps saying that i have this virus and it keeps coming back. [​IMG] How do i get rid of it for good? i also have used rsit and this is the log

    Logfile of random's system information tool 1.04 (written by random/random)
    Run by SHAZZ at 2008-11-24 09:03:21
    Microsoft Windows XP Professional Service Pack 2
    System drive C: has 112 GB (86%) free of 131 GB
    Total RAM: 1280 MB (47% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:03:29 AM, on 11/24/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe
    C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    C:\Program Files\Zune\ZuneLauncher.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\AVG\AVG8\avgui.exe
    C:\Program Files\AVG\AVG8\avgscanx.exe
    F:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\SHAZZ\Desktop\RSIT.exe
    C:\Program Files\trend micro\SHAZZ.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://z3.invisionfree.com/Rs_Seduction/index.php?act=idx
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://account.ea.com/commerce/bf2bp/code-entry.jsp
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [D-Link RangeBooster G WUA-2340] C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe
    O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe "
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
    O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKCU\..\Run: [Steam] "f:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares Vista\AresVista.exe" -h
    O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 8435 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
    AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-10-24 455960]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-01-28 1554256]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
    Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
    AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-10-24 2055960]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-10-24 2055960]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "D-Link RangeBooster G WUA-2340 "=C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe [2006-09-01 1880064]
    "ANIWZCS2Service "=C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe [2006-06-29 49152]
    "Zune Launcher "=c:\Program Files\Zune\ZuneLauncher.exe [2008-09-12 160160]
    "AppleSyncNotifier "=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-05-27 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-10 289064]
    "AVG8_TRAY "=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-10-24 1234712]
    "MyWebSearch Plugin "=rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL []
    "My Web Search Bar Search Scope Monitor "=C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe [2008-11-08 24688]
    "MyWebSearch Email Plugin "=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe [2008-11-08 32838]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Steam "=f:\program files\steam\steam.exe [2008-10-09 1410296]
    "MsnMsgr "=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
    "SpybotSD TeaTimer "=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-01-28 2097488]
    "ares vista "=C:\Program Files\Ares Vista\AresVista.exe -h []
    "MyWebSearch Email Plugin "=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe [2008-11-08 32838]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "ATI Smart "=2
    "Ati HotKey Poller "=2
    "Avg7UpdSvc "=2

    C:\Documents and Settings\SHAZZ\Start Menu\Programs\Startup
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    Xfire.lnk - C:\Program Files\Xfire\xfire.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS "= "avgrsstx.dll "

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2005-12-01 47104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun "=145

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\WINDOWS\system32\sessmgr.exe "= "C:\WINDOWS\system32\sessmgr.exe:*:Disabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\Program Files\mIRC\mirc.exe "= "C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC "
    "F:\Program Files\Steam\SteamApps\joel_charette\counter-strike source\hl2.exe "= "F:\Program Files\Steam\SteamApps\joel_charette\counter-strike source\hl2.exe:*:Enabled:hl2 "
    "C:\Program Files\Xfire\xfire.exe "= "C:\Program Files\Xfire\xfire.exe:*:Enabled:Xfire "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a26e9ce8-e497-11dc-be0b-806d6172696f}]
    shell\AutoRun\command - D:\Autorun.exe


    ======List of files/folders created in the last 3 months======

    2008-11-24 09:01:33 ----D---- C:\Program Files\trend micro
    2008-11-24 09:01:28 ----D---- C:\rsit
    2008-11-16 21:21:46 ----D---- C:\Documents and Settings\SHAZZ\Application Data\Xfire
    2008-11-16 21:21:40 ----D---- C:\Program Files\Xfire
    2008-11-08 14:04:19 ----D---- C:\Program Files\FunWebProducts
    2008-11-08 14:04:17 ----D---- C:\Program Files\MyWebSearch
    2008-11-07 18:55:21 ----D---- C:\Documents and Settings\SHAZZ\Application Data\DivX
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\vxblock.dll
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxsfs.dll
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxinsi64.exe
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxinsa64.exe
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxhpinst.exe
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxdrv.dll
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxcpyi64.exe
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxcpya64.exe
    2008-11-07 18:54:12 ----N---- C:\WINDOWS\system32\pxafs.dll
    2008-11-07 18:54:11 ----N---- C:\WINDOWS\system32\pxwave.dll
    2008-11-07 18:54:11 ----N---- C:\WINDOWS\system32\pxmas.dll
    2008-11-07 18:54:11 ----N---- C:\WINDOWS\system32\px.dll
    2008-11-07 18:53:40 ----D---- C:\Program Files\DivX
    2008-11-04 17:12:54 ----HDC---- C:\WINDOWS\$NtUninstallwinusb0100$
    2008-11-04 17:12:05 ----HDC---- C:\WINDOWS\$NtUninstallWudf01007$
    2008-11-04 16:56:06 ----HDC---- C:\WINDOWS\$NtUninstallKB932716-v2$
    2008-11-04 16:55:35 ----N---- C:\WINDOWS\system32\imapi2fs.dll
    2008-11-04 16:55:35 ----N---- C:\WINDOWS\system32\imapi2.dll
    2008-11-04 15:06:39 ----D---- C:\Program Files\LimeWire
    2008-10-29 20:25:14 ----A---- C:\WINDOWS\system32\xfcodec.dll
    2008-10-28 17:36:00 ----A---- C:\WINDOWS\system32\divx_xx0c.dll
    2008-10-28 17:36:00 ----A---- C:\WINDOWS\system32\divx_xx07.dll
    2008-10-28 17:35:58 ----A---- C:\WINDOWS\system32\divx_xx11.dll
    2008-10-28 17:35:58 ----A---- C:\WINDOWS\system32\divx_xx0a.dll
    2008-10-28 17:35:56 ----A---- C:\WINDOWS\system32\DivX.dll
    2008-10-24 12:46:29 ----HD---- C:\$AVG8.VAULT$
    2008-10-24 10:50:45 ----A---- C:\WINDOWS\system32\avgrsstx.dll
    2008-10-24 10:50:39 ----D---- C:\Documents and Settings\SHAZZ\Application Data\AVGTOOLBAR
    2008-10-24 10:50:30 ----D---- C:\Program Files\AVG
    2008-10-24 10:50:29 ----D---- C:\Documents and Settings\All Users\Application Data\avg8
    2008-09-25 03:03:44 ----A---- C:\WINDOWS\system32\DivXsm.exe
    2008-09-25 03:03:38 ----A---- C:\WINDOWS\system32\dtu100.dll
    2008-09-25 03:03:38 ----A---- C:\WINDOWS\system32\dpl100.dll
    2008-09-25 03:03:34 ----A---- C:\WINDOWS\system32\dpuGUI10.dll
    2008-09-25 03:03:32 ----A---- C:\WINDOWS\system32\dpv11.dll
    2008-09-25 03:03:32 ----A---- C:\WINDOWS\system32\dpus11.dll
    2008-09-25 03:03:32 ----A---- C:\WINDOWS\system32\dpuGUI11.dll
    2008-09-25 03:03:30 ----A---- C:\WINDOWS\system32\dpu11.dll
    2008-09-25 03:03:30 ----A---- C:\WINDOWS\system32\dpu10.dll
    2008-09-25 03:03:18 ----A---- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2008-09-19 16:57:34 ----A---- C:\WINDOWS\system32\qt-dx331.dll
    2008-09-19 16:55:58 ----A---- C:\WINDOWS\system32\ssldivx.dll
    2008-09-19 16:55:58 ----A---- C:\WINDOWS\system32\libdivx.dll
    2008-09-19 16:55:10 ----A---- C:\WINDOWS\system32\dtu100.dll.manifest
    2008-09-19 16:55:10 ----A---- C:\WINDOWS\system32\dpl100.dll.manifest
    2008-09-19 16:54:18 ----A---- C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-09-12 18:48:22 ----A---- C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
    2008-09-12 18:46:32 ----A---- C:\WINDOWS\system32\ZuneBusEnum.exe
    2008-09-12 18:32:14 ----A---- C:\WINDOWS\system32\ZuneTcp2Udp.dll
    2008-09-12 18:32:12 ----A---- C:\WINDOWS\system32\ZuneRegUtil.dll
    2008-09-12 18:32:12 ----A---- C:\WINDOWS\system32\ZunePTDNS.dll
    2008-09-12 18:32:10 ----A---- C:\WINDOWS\system32\ZuneNetProxy.dll
    2008-08-27 16:19:00 ----A---- C:\WINDOWS\system32\WUDFUpdate_01007.dll
    2008-08-27 16:19:00 ----A---- C:\WINDOWS\system32\WinUSBCoInstaller.dll

    ======List of files/folders modified in the last 3 months======

    2008-11-24 09:03:28 ----D---- C:\WINDOWS\Temp
    2008-11-24 09:01:47 ----D---- C:\WINDOWS\Prefetch
    2008-11-24 09:01:33 ----RD---- C:\Program Files
    2008-11-24 08:56:33 ----D---- C:\Program Files\Mozilla Firefox
    2008-11-24 08:47:26 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-11-24 08:28:02 ----D---- C:\Documents and Settings\SHAZZ\Application Data\NoNameScript
    2008-11-23 17:10:42 ----D---- C:\Program Files\mIRC
    2008-11-22 19:15:32 ----A---- C:\WINDOWS\SchedLgU.Txt
    2008-11-20 15:27:29 ----D---- C:\Documents and Settings\SHAZZ\Application Data\LimeWire
    2008-11-16 21:21:44 ----D---- C:\WINDOWS\system32
    2008-11-16 20:39:01 ----D---- C:\Documents and Settings\SHAZZ\Application Data\teamspeak2
    2008-11-14 15:48:32 ----D---- C:\Program Files\SwiftKit
    2008-11-14 12:22:45 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2008-11-14 12:22:30 ----D---- C:\WINDOWS\system32\drivers
    2008-11-08 14:30:30 ----D---- C:\WINDOWS
    2008-11-08 14:04:21 ----D---- C:\Program Files\Internet Explorer
    2008-11-07 18:48:58 ----A---- C:\WINDOWS\NeroDigital.ini
    2008-11-04 19:17:04 ----D---- C:\WINDOWS\.jagex_cache_32
    2008-11-04 17:43:10 ----RSD---- C:\WINDOWS\assembly
    2008-11-04 17:43:10 ----D---- C:\WINDOWS\Microsoft.NET
    2008-11-04 17:13:03 ----HD---- C:\WINDOWS\inf
    2008-11-04 17:12:25 ----A---- C:\WINDOWS\imsins.BAK
    2008-11-04 17:06:56 ----D---- C:\Program Files\Zune
    2008-11-04 17:01:24 ----SHD---- C:\WINDOWS\Installer
    2008-11-04 17:01:24 ----SHD---- C:\Config.Msi
    2008-11-04 16:55:45 ----HD---- C:\WINDOWS\$hf_mig$
    2008-11-04 15:06:01 ----D---- C:\Documents and Settings\SHAZZ\Application Data\Apple Computer
    2008-11-03 08:28:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
    2008-10-28 06:43:11 ----SD---- C:\Documents and Settings\SHAZZ\Application Data\Microsoft
    2008-10-24 10:50:17 ----D---- C:\WINDOWS\WinSxS
    2008-10-23 15:22:49 ----D---- C:\Program Files\PokerStars
    2008-10-10 17:23:32 ----D---- C:\Documents and Settings\SHAZZ\Application Data\Ventrilo
    2008-09-12 18:32:14 ----A---- C:\WINDOWS\system32\ZuneUsbTransport.dll
    2008-09-12 18:32:08 ----A---- C:\WINDOWS\system32\ZuneMTPZ.dll

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-04 37376]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-10-24 97928]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-10-24 26824]
    R2 ANIO;ANIO Service; \??\C:\WINDOWS\system32\ANIO.SYS []
    R2 aslm75;aslm75; \??\C:\WINDOWS\system32\drivers\aslm75.sys []
    R2 zumbus;Zune Bus Enumerator Driver; C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-09-12 40832]
    R3 A5AGU;D-Link USB Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\A5AGU.sys [2006-05-08 347648]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-12-01 1412608]
    R3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
    R3 Egatebus;Egatebus; C:\WINDOWS\system32\drivers\egatebus.sys [2006-05-19 15328]
    R3 Egaterdr;Egaterdr; C:\WINDOWS\system32\drivers\egaterdr.sys [2006-05-19 13440]
    R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
    R3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
    R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
    R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
    R3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
    R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
    R3 WinUSB;WinUSB; C:\WINDOWS\system32\DRIVERS\WinUSB.sys [2006-11-02 39368]
    R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2007-09-13 19352]
    R3 WmXlCore;Logitech Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2007-09-13 51608]
    R3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-01-18 83328]
    S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
    S3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2004-12-16 42496]
    S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
    S3 ggflt;SEMC USB Flash Driver Filter; C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-03-10 13352]
    S3 ggsemc;SEMC USB Flash Driver; C:\WINDOWS\system32\DRIVERS\ggsemc.sys [2008-03-10 20520]
    S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-10 32000]
    S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
    S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
    S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
    S3 w810bus;Sony Ericsson W810 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\w810bus.sys []
    S3 WmFilter;Logitech Gaming HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2007-09-13 29976]
    S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2007-09-13 14744]
    S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-10 116040]
    R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-10-24 231704]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
    R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-02-27 66872]
    R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
    R2 ZuneBusEnum;Zune Bus Enumerator; c:\WINDOWS\system32\ZuneBusEnum.exe [2008-09-12 61856]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-10 532264]
    R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
    S2 ANIWZCSdService;ANIWZCSd Service; C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe [2006-07-03 49152]
    S2 MyWebSearchService;My Web Search Service; C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe [2008-11-08 28762]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
    S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
    S3 ZuneNetworkSvc;Zune Network Sharing Service; c:\Program Files\Zune\ZuneNss.exe [2008-09-12 5119392]
    S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service; c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-09-12 245664]
    S4 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-12-01 393216]
    S4 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-12-01 520192]
    S4 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
    S4 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-03-14 779824]
    S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
    S4 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
    S4 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

    -----------------EOF-----------------
     
  2. 2008/11/24
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    JoelChar - Welcome to WindowsBBS :)

    I have moved your post to the appropriate forum - Malware & Virus Removal.

    Actually you do not have a virus - the AVG report shows you have 4 tracking cookies - these are harmless although may be considered an invasion of your privacy. Note that your screenshot shows ....

    Threats found - 0

    You can control cookie behaviour through Tools > Internet Options > Privacy.
     

  3. to hide this advert.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.