1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

just a check please!

Discussion in 'Malware and Virus Removal Archive' started by keith 1000, 2007/10/12.

  1. 2007/10/12
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    hi guys
    just wondering if some one could go over this hijackthis log and just double check it for me. i dont think i have any problems but i'm going to do a Norton Ghost, and i dont think it would be a bad idea to just double check it before i waste a couple discs. who knows there could be problems i dont even no about.
    thanks guys i really appreciate it
    keith:)

    Logfile of HijackThis v1.99.1
    Scan saved at 8:54:14 PM, on 12/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WFXSVC.EXE
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\wfxsnt40.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\Symantec\WinFax\wfxctl32.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\System32\svchost.exe
    F:\Documents and Settings\Keith & Carrie\My Documents\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [MSN] service.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170519494906
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170524756093
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
    O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE
     
    keith 1000,
    #1
  2. 2007/10/12
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi Keith :)

    Did you have a recent program crash? Fix the foolowing entry with HijachThis.

    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k


    Then, download Deckard's System Scanner (dss.exe) to your desktop.

    Note: You must be logged onto an account with administrator privileges to complete the following.​

    • Close all applications and windows.
    • Double click on dss.exe to run it and follow the prompts.
    • When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.
    Post the contents of main.txt only for now.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2007/10/12
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    hi dave
    thanks for answering so quickly, i really didn't expect to see anything till tomorrow.
    yes as a matter of fact i did just have a crash, what happened is two weeks ago i had a critical error, and the system crashed. restarted and sent error report to microsoft you know the drill. well the error came back pointing to my logitech webcam, and said to go to the web site and get new software and drivers, so i did!! I got the new stuff and restarted my computer. well even after a reboot my cpu us acting up (freezing on msn, and just all slow in general)
    well i have a ghost image from about 6 months ago so i just figured i would ghost, so i did, and at this time the cam was UNPLUGGED!!!!! so after the copy was done it started up and was running great, back to normal. well after about an hour the system crashed again, i was devistated because the ghost copy i had was so far back it took me that whole hour just doing updates and putting programs back in that i wanted. i thought shoot! i dont want to do this again. so after the cpu rebooted after the critical error and sent error report, i couldnt believe my eyes cause the report came back again pointing to my web cam!!! well the cam wasnt even hooked up, as a matter of fact after the ghost my cpu should have had no idea the the cam even existed, so i couldnt understand why it said it was my cam. so i just left it alone and rebooted again, and after it rebooted it was functioning just fine and has been working fine for a week now (mind you i have not plugged the cam in yet, i'm affraid of it crashing again, and was going to buy a different make). so this leads me to today i want to do a new ghost with the cpu being well up to date for everyday use, if the system ever crashes again.
    some kind of explaination to the letter would be great...sorry about the letter but i just wanted to fill you in about crashing...here is the log :D

    Deckard's System Scanner v20070905.67
    Run by Keith & Carrie on 2007-10-12 23:34:17
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    26: 2007-10-13 03:34:21 UTC - RP28 - Deckard's System Scanner Restore Point
    25: 2007-10-12 15:40:24 UTC - RP27 - Norton AntiVirus post configuration restore point
    24: 2007-10-12 01:42:52 UTC - RP26 - System Checkpoint
    23: 2007-10-10 19:13:49 UTC - RP25 - Software Distribution Service 3.0
    22: 2007-10-10 07:33:17 UTC - RP24 - System Checkpoint


    -- First Restore Point --
    1: 2007-10-03 22:19:35 UTC - RP3 - Software Distribution Service 3.0


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as Keith & Carrie.exe) --------------------------------------

    Logfile of HijackThis v1.99.1
    Scan saved at 11:35:28 PM, on 12/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WFXSVC.EXE
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\wfxsnt40.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\Symantec\WinFax\wfxctl32.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\Keith & Carrie\Desktop\dss.exe
    F:\DOCUME~1\KEITH&~1\MYDOCU~1\HIJACK~1\KEITH&~1.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [MSN] service.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170519494906
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170524756093
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
    O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE


    -- HijackThis Fixed Entries (F:\DOCUME~1\KEITH&~1\MYDOCU~1\HIJACK~1\backups\) --

    backup-20070301-102353-377 O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    backup-20070718-211251-137 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    backup-20070718-211251-307 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    backup-20070718-211251-336 F3 - REG:win.ini: load=C:\WINDOWS\system32\fgrlxogms\winlogon.exe
    backup-20070718-211251-490 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15-3.cab
    backup-20070718-211251-517 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    backup-20070718-211251-527 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    backup-20070718-211251-672 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    backup-20070718-211251-702 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    backup-20070718-211251-753 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    backup-20070718-211251-870 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    backup-20070718-211251-998 F3 - REG:win.ini: run=C:\WINDOWS\system32\fgrlxogms\winlogon.exe
    backup-20070721-212901-139 O4 - Startup: winlogon.lnk = ?
    backup-20070721-213053-867 O4 - Startup: winlogon.lnk = ?
    backup-20070722-222158-757 O4 - Startup: winlogon.lnk = ?
    backup-20071012-233128-283 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R1 GhPciScan (GhostPciScanner) - c:\program files\symantec\norton ghost 2003\ghpciscan.sys <Not Verified; Symantec Corporation; Symantec Ghost PCI Scanner>
    R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
    R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>

    S3 SunkFilt (Alcor Micro Corp - 9360) - c:\windows\system32\drivers\sunkfilt.sys (file missing)
    S3 usbsermpt (Motorola USB Modem Driver for MPT) - c:\windows\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 GhostStartService - c:\program files\symantec\norton ghost 2003\ghoststartservice.exe <Not Verified; Symantec Corporation; Norton Ghost Start Service>
    R2 wfxsvc (WinFax PRO) - c:\windows\system32\wfxsvc.exe <Not Verified; Symantec Corporation; Symantec WinFax PRO>

    S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe


    -- Device Manager: Disabled ----------------------------------------------------

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: NVIDIA nForce Networking Controller
    Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0269\4&133FC320&0&01
    Manufacturer: NVIDIA
    Name: NVIDIA nForce Networking Controller
    PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0269\4&133FC320&0&01
    Service: NVENETFD


    -- Scheduled Tasks -------------------------------------------------------------

    2007-10-12 20:01:09 548 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Keith & Carrie.job
    2007-10-11 23:05:55 326 --a------ C:\WINDOWS\Tasks\WebReg Photosmart C4200 series.job


    -- Files created between 2007-09-12 and 2007-10-12 -----------------------------

    2007-10-12 10:44:01 0 d-------- C:\Program Files\PowerISO
    2007-10-09 18:50:10 0 d-------- C:\Documents and Settings\Keith & Carrie\Application Data\Printer Info Cache
    2007-10-09 18:50:09 0 d-------- C:\Documents and Settings\Keith & Carrie\Application Data\Image Zone Express
    2007-10-03 21:29:10 0 d-------- C:\Program Files\Arial Audio Converter
    2007-10-03 21:07:18 0 d-------- C:\Program Files\Common Files\Motorola Shared
    2007-10-03 21:06:06 5936 --a------ C:\Documents and Settings\Keith & Carrie\mqdmwhnt.sys <Not Verified; MCCI; Motorola DM Composite Driver>
    2007-10-03 21:06:06 79328 --a------ C:\Documents and Settings\Keith & Carrie\mqdmserd.sys <Not Verified; MCCI; Motorola USB Diag>
    2007-10-03 21:06:06 92064 --a------ C:\Documents and Settings\Keith & Carrie\mqdmmdm.sys <Not Verified; MCCI; Motorola USB Modem>
    2007-10-03 21:06:06 9232 --a------ C:\Documents and Settings\Keith & Carrie\mqdmmdfl.sys <Not Verified; MCCI; Motorola USB Modem Filter>
    2007-10-03 21:06:06 4048 --a------ C:\Documents and Settings\Keith & Carrie\mqdmcr.sys <Not Verified; MCCI; Motorola USB DIAG>
    2007-10-03 21:06:06 6208 --a------ C:\Documents and Settings\Keith & Carrie\mqdmcmnt.sys <Not Verified; MCCI; Motorola USB DIAG>
    2007-10-03 21:06:06 66656 --a------ C:\Documents and Settings\Keith & Carrie\mqdmbus.sys <Not Verified; MCCI; Motorola DM Composite Driver>
    2007-10-03 21:06:05 6947 --a------ C:\Documents and Settings\Keith & Carrie\1191459965-(null)
    2007-10-03 20:57:15 22768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
    2007-10-03 20:57:15 22768 --a------ C:\Documents and Settings\Keith & Carrie\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
    2007-10-03 20:57:08 0 d-------- C:\Program Files\Motorola Phone Tools
    2007-10-03 20:51:28 0 d-------- C:\Documents and Settings\Keith & Carrie\Application Data\InstallShield
    2007-10-03 20:51:05 0 d-------- C:\Documents and Settings\All Users\Application Data\Avanquest Software
    2007-10-03 20:36:24 0 d-------- C:\Program Files\LiveUpdate
    2007-10-03 20:34:44 0 d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
    2007-10-03 20:08:03 0 d-------- C:\Program Files\MSXML 4.0
    2007-10-03 20:06:48 0 d-------- C:\Program Files\MSBuild
    2007-10-03 20:03:30 0 d-------- C:\WINDOWS\system32\XPSViewer
    2007-10-03 19:09:28 0 d-------- C:\Documents and Settings\All Users\Application Data\WEBREG
    2007-10-03 19:09:05 0 d-------- C:\Documents and Settings\Keith & Carrie\Application Data\HP
    2007-10-03 19:06:32 0 d-------- C:\Documents and Settings\All Users\Application Data\HP
    2007-10-03 19:06:03 0 d-------- C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
    2007-10-03 19:05:52 0 d-------- C:\Program Files\Common Files\HP
    2007-10-03 19:05:34 0 d-------- C:\Program Files\Hewlett-Packard
    2007-10-03 19:05:22 0 d-------- C:\Program Files\Common Files\Hewlett-Packard
    2007-10-03 19:04:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
    2007-10-03 19:02:24 0 d-------- C:\Program Files\HP
    2007-10-03 19:01:15 811 -----n--- C:\WINDOWS\hpomdl13.dat
    2007-10-03 19:01:15 130349 --a------ C:\WINDOWS\hpoins13.dat
    2007-10-03 18:27:49 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2007-10-03 18:27:44 0 d-------- C:\Program Files\MSXML 6.0
    2007-10-03 18:09:09 0 d-------- C:\WINDOWS\system32\SoftwareDistribution


    -- Find3M Report ---------------------------------------------------------------

    2007-10-12 17:42:04 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2007-10-12 11:39:06 0 d-------- C:\Program Files\Norton AntiVirus
    2007-10-12 11:30:28 0 d-------- C:\Program Files\Symantec
    2007-10-12 11:30:17 0 d-------- C:\Program Files\Common Files
    2007-10-12 11:14:25 0 d-------- C:\Documents and Settings\Keith & Carrie\Application Data\Azureus
    2007-10-12 10:50:34 0 d-------- C:\Program Files\Azureus
    2007-10-03 20:57:39 0 d--h----- C:\Program Files\InstallShield Installation Information
    2007-10-03 18:57:33 0 d-------- C:\Program Files\Java


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [22/10/2006 01:22 PM]
    "nwiz "= "nwiz.exe" [22/10/2006 01:22 PM C:\WINDOWS\system32\nwiz.exe]
    "CHotkey "= "zHotkey.exe" [03/06/2003 02:01 PM C:\WINDOWS\zHotkey.exe]
    "SoundMan "= "SOUNDMAN.EXE" [17/11/2006 06:42 AM C:\WINDOWS\soundman.exe]
    "WinFaxAppPortStarter "= "wfxsnt40.exe" [14/02/2000 06:36 PM C:\WINDOWS\system32\WFXSNT40.EXE]
    "NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [22/10/2006 01:22 PM]
    "Babylon Client "= "C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [13/12/2006 05:15 PM]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [12/01/2006 05:40 PM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11 AM]
    "HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [10/12/2006 09:52 PM]
    "WatchDog "= "C:\Program Files\mobile PhoneTools\WatchDog.exe" []
    "PWRISOVM.EXE "= "C:\Program Files\PowerISO\PWRISOVM.EXE" [06/08/2007 08:05 PM]
    "MSN "= "service.exe" []
    "ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [22/01/2007 10:19 PM]
    "Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [12/03/2007 06:30 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 03:56 AM]
    "IncrediMail "= "C:\Program Files\IncrediMail\bin\IncMail.exe" [23/01/2007 09:06 AM]
    "MsnMsgr "= "C:\Program Files\MSN Messenger\MsnMsgr.exe" [19/01/2007 01:54 PM]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [01/06/2006 02:32 PM]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [02/01/2007 9:40:10 PM]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{A213B520-C6C2-11d0-AF9D-008029E1027E} "= C:\Program Files\Symantec\WinFax\WfxSeh32.Dll [27/07/1998 05:54 AM 38400]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
    backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Keith & Carrie^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
    path=C:\Documents and Settings\Keith & Carrie\Start Menu\Programs\Startup\LimeWire On Startup.lnk
    backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt hpqcxs08 hpqddsvc




    -- End of Deckard's System Scanner: finished at 2007-10-12 23:36:57 ------------
     
    keith 1000,
    #3
  5. 2007/10/12
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Here's the entry that I'm a bit suspicious of.

    O4 - HKLM\..\Run: [MSN] service.exe

    I was hoping the dss log would give us a bit more of a clue about it, but I'm not seeing anything. Lets do a search for it. Highlight and copy the contents of the quote box below to a blank notepad. Save it to the desktop as;

    Filename: check.bat
    Save as type: All Files (*.*)

    Double click check.bat to run it. It will open check.txt when it completes. Please post it's contents if anything is listed. It will be searching the entire drive, so be patient and wait for it to complete on it's own.

    I would also like you to see what information you can find on the following file's properties.

    C:\Documents and Settings\Keith & Carrie\1191459965-(null)
     
    noahdfear,
    #4
  6. 2007/10/13
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    hey dave
    nothing there on that scan just this

    Volume in drive C has no label.
    Volume Serial Number is 8CE0-55DC

    so i think thats clear. so what do you think about the problem i wrote about the ghost and the cam and all that stuff..

    i checked out that file and opened it in not pad and it seem to bo a file for my motorola cell phone when it hooked up to the cpu, but here it is anyway.
    ; Windows USB Modem Setup File
    ; Copyright (c) 2004 Motorola Inc.
    ; Manufacturers: Motorola

    [Version]
    Signature= "$CHICAGO$ "
    Class=Modem
    ClassGUID={4D36E96D-E325-11CE-BFC1-08002BE10318}
    Provider=%Motorola%
    CatalogFile=USBMOT2000.CAT
    DriverVer=3/22/2006, 3.4.0.2MPT

    [DestinationDirs]
    DefaultDestDir=12

    [SourceDisksNames]

    [SourceDisksFiles]

    ; ----------------------------------------------
    [Manufacturer]
    %Motorola% = Motorola

    [Motorola]
    %USBMOTMODEM% = USB1XCDMA, USB\VID_22B8&PID_2822
    %USBMOTMODEM% = USB1XCDMA, USB\VID_22B8&PID_2A02
    %USBMOTMODEM% = USB1XCDMA, USB\VID_22B8&PID_2A22
    %USBMOTMODEM% = USB1XCDMA, USB\VID_22B8&PID_2A42
    %USBMOTMODEM% = USB1XCDMA, USB\VID_22B8&PID_2A62
    %USBMOTMODEM% = USB1XCDMA, USB\VID_22B8&PID_2A82
    %USBMOTMODEM% = USB1XCDMA, USB\VID_22B8&PID_2805
    %USBMOTMODEM% = USBMOTOROLA_COMMON, USB\VID_22B8&PID_0005
    %USBMOTMODEM% = USBMOTOROLA_COMMON, USB\VID_22B8&PID_1005
    %USBMOTMODEM% = USBMOTOROLA_COMMON, USB\VID_22B8&PID_4802
    %USBMOTMODEM% = USBMOTOROLA_COMMON, USB\VID_22B8&PID_6002
    %USBMOTMODEM% = USBMOTOROLA_COMMON, USB\VID_22B8&PID_5802
    %USBMOTMODEM% = USBMOTOROLA_COMMON, USB\VID_22B8&PID_4902
    %USBMOTMODEM% = USBMOTOROLA_COMMON, USB\VID_22B8&PID_4A02

    ; ----------------------------------------------
    [USB1XCDMA.NT]
    AddReg=All, MDM1XSettings, MDMSettings, MDMResponse
    CopyFiles=USBsys32Drivers

    [USBMOTOROLA_COMMON.NT]
    AddReg=All, MDMSettings, MDMResponse
    CopyFiles=USBsys32Drivers

    ;-----------------------------------------------

    [USBsys32Drivers]
    usbsermpt.sys,,,0x20

    ; ----------------------------------------------

    [USB1XCDMA.NT.Services]
    AddService=usbsermpt, 0x00000000, LowerFilter_Service_Inst


    [USBMOTOROLA_COMMON.NT.Services]
    AddService=usbsermpt, 0x00000000, LowerFilter_Service_Inst

    ; ----------------------------------------------

    [USB1XCDMA.NT.HW]
    AddReg=LowerFilterAddReg

    [USBMOTOROLA_COMMON.NT.HW]
    AddReg=LowerFilterAddReg

    [LowerFilterAddReg]
    HKR,, "LowerFilters ",0x00010000, "usbsermpt "

    [LowerFilter_Service_Inst]
    DisplayName= "Motorola USB Modem Driver for MPT "
    ServiceType= 1
    StartType = 3
    ErrorControl = 0
    ServiceBinary = %12%\usbsermpt.sys
    ; ----------------------------------------------
    [All]
    HKR,,FriendlyDriver,,unimodem.vxd
    HKR,,DevLoader,,*vcomm
    HKR,,ConfigDialog,,modemui.dll
    HKR,,EnumPropPages,, "modemui.dll,EnumPropPages "
    HKR,,PortSubClass,1,02
    HKR,,DeviceType,1,01

    [MDM1XSettings]
    ;Set these values to default
    HKR,,MaximumPortSpeed, 1, 00, 84, 03, 00
    HKR,, DCB, 1, 1C,00,00,00, 00,84,03,00, 15,20,00,00, 00,00, 0a,00, 0a,00, 08, 00, 00, 11, 13, 00, 00, 00


    [MDMSettings]
    HKR,, Properties, 1, 00,01,00,00, 00,00,00,00, 00,00,00,00, 00,00,00,00, 00,00,00,00, 30,00,00,00, 00,84,03,00, C0,DA,01,00
    HKR,, InactivityScale, 1, 3c,00,00,00
    HKR, Init, 1,, "AT<cr> "
    HKR, Init, 2,, "AT<cr> "
    HKR, Answer, 1,, "ATA<cr> "
    HKR, Hangup, 1,, "ATHE1<cr> "
    HKR,, Reset,, "AT<cr>"
    HKR, Settings, Prefix,, "AT "
    HKR, Settings, Terminator,, "<cr> "
    HKR, Settings, DialPrefix,, "D "
    HKR, Settings, DialSuffix,, " "
    HKR, Settings, Pulse,, "P "
    HKR, Settings, Tone,, "T "
    HKR, Monitor, 1,, "ATS0=0<cr> "
    HKR, Monitor, 2,, "None "
    HKR, Settings, FlowControl_Off,, "+IFC=0,0 "
    HKR, Settings, FlowControl_Hard,, "+IFC=2,2 "
    HKR, Settings, FlowControl_Soft,, "+IFC=1,1 "

    [MDMResponse]
    HKR, Responses, "0<cr> ", 1, 00, 00, 00,00,00,00, 00,00,00,00 ; OK - Command executed
    HKR, Responses, "1<cr> ", 1, 02, 00, 00,00,00,00, 00,00,00,00 ; CONNECT - Connection
    HKR, Responses, "2<cr> ", 1, 08, 00, 00,00,00,00, 00,00,00,00 ; RING - Ring signal indicated
    HKR, Responses, "3<cr> ", 1, 04, 00, 00,00,00,00, 00,00,00,00 ; NO CARRIER
    HKR, Responses, "4<cr> ", 1, 03, 00, 00,00,00,00, 00,00,00,00 ; ERROR - Invalid command
    HKR, Responses, "6<cr> ", 1, 05, 00, 00,00,00,00, 00,00,00,00 ; NO DIALTONE - No dial tone detected
    HKR, Responses, "7<cr> ", 1, 06, 00, 00,00,00,00, 00,00,00,00 ; BUSY - Engaged (busy) signal
    HKR, Responses, "8<cr> ", 1, 07, 00, 00,00,00,00, 00,00,00,00 ; NO ANSWER
    HKR, Responses, "<cr><lf>OK<cr><lf> ", 1, 00, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>RING<cr><lf> ", 1, 08, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>ERROR<cr><lf> ", 1, 03, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>NO DIALTONE<cr><lf> ", 1, 05, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>NO DIAL TONE<cr><lf> ",1, 05, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>BUSY<cr><lf> ", 1, 06, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>NO CARRIER<cr><lf> ", 1, 04, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>NO ANSWER<cr><lf> ", 1, 07, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT<cr><lf> ", 1, 02, 00, 00,00,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 300<cr><lf> ", 1, 02, 00, 2C,01,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 600<cr><lf> ", 1, 02, 00, 58,02,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 1200<cr><lf> ", 1, 02, 00, B0,04,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 2400<cr><lf> ", 1, 02, 00, 60,09,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 4800<cr><lf> ", 1, 02, 00, C0,12,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 7200<cr><lf> ", 1, 02, 00, 20,1C,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 9600<cr><lf> ", 1, 02, 00, 80,25,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 12000<cr><lf> ", 1, 02, 00, E0,2E,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 14400<cr><lf> ", 1, 02, 00, 40,38,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 16800<cr><lf> ", 1, 02, 00, A0,41,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 19200<cr><lf> ", 1, 02, 00, 00,4B,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 21600<cr><lf> ", 1, 02, 00, 60,54,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 24000<cr><lf> ", 1, 02, 00, C0,5D,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 26400<cr><lf> ", 1, 02, 00, 20,67,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 28800<cr><lf> ", 1, 02, 00, 80,70,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 31200<cr><lf> ", 1, 02, 00, e0,79,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 33600<cr><lf> ", 1, 02, 00, 40,83,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 38400<cr><lf> ", 1, 02, 00, 00,96,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 57600<cr><lf> ", 1, 02, 00, 00,E1,00,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 115200<cr><lf> ", 1, 02, 00, 00,C2,01,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 115,200<cr><lf> ", 1, 02, 00, 00,C2,01,00, 00,00,00,00
    HKR, Responses, "<cr><lf>CONNECT 230400<cr><lf> ", 1, 02, 00, 00,84,03,00, 00,00,00,00


    ; ----------------------------------------------

    [Strings]
    Motorola = "Motorola "
    USBMOTMODEM = "Motorola USB Modem"


    and what about that other entry do you want me to get rid of it????
    thanks again
     
    keith 1000,
    #5
  7. 2007/10/13
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Yes, fix the following entry with HijackThis.

    O4 - HKLM\..\Run: [MSN] service.exe

    The file appears OK.

    Frankly, I have no idea how it's possible you got a crash related to the cam on a ghost image where the cam had never been loaded. :confused:

    Everything else appears to be in order. If you want to do one more check before creating a new image, I would recommend an online scan. Links and instructions here. No need to post anything unless an infection is found.
     
    noahdfear,
    #6
  8. 2007/10/15
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    hi dave
    here is a HJT. log and a kaspersky scan, and looking at the online scan the only real thing i can see is the norton quarintine on my other hard-drive. it has another operating system on it that also works on this computer, i us it to do things like, for instance ghost this drive i'm working on....but again here they are please give them a once over
    thanks keith

    Logfile of HijackThis v1.99.1
    Scan saved at 10:28:10 AM, on 15/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WFXSVC.EXE
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\wfxsnt40.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\Symantec\WinFax\wfxctl32.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
    C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~3.EXE
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Keith & Carrie\My Documents\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170519494906
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170524756093
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
    O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE
     
    keith 1000,
    #7
  9. 2007/10/15
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Monday, October 15, 2007 10:25:39 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 15/10/2007
    Kaspersky Anti-Virus database records: 436036
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\

    Scan Statistics:
    Total number of scanned objects: 156371
    Number of viruses found: 6
    Number of infected objects: 29
    Number of suspicious objects: 0
    Duration of the scan process: 02:03:21

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-10-14_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0BFD1BF2.exe Infected: Backdoor.Win32.SdBot.cap skipped
    C:\Documents and Settings\Keith & Carrie\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\History\History.IE5\MSHist012007101220071013\index.dat Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\History\History.IE5\MSHist012007101420071015\index.dat Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\Temp\flaA9D.tmp Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\Temp\~DFDC52.tmp Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Keith & Carrie\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
    C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
    C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
    C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
    C:\Program Files\Norton AntiVirus\Savrt\0284NAV~.TMP Object is locked skipped
    C:\Program Files\Norton AntiVirus\Savrt\0775NAV~.TMP Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK.WFD Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK.WFF Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK.WFG Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK.WFR Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK.WFX Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK2.WFD Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK2.WFG Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BK2.WFX Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BKS.WFD Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BKS.WFG Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\MY-PH-BKS.WFX Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status.WFD Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status.WFF Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status.WFG Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status.WFR Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status.WFX Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status2.WFD Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status2.WFG Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status2.WFX Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status3.WFD Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status3.WFG Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\Status3.WFX Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\StatusS.WFD Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\StatusS.WFG Object is locked skipped
    C:\Program Files\Symantec\WinFax\Data\StatusS.WFX Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{485BCDE0-6F5D-44AC-ADFB-FC4AD5FDC45E}\RP26\A0003754.exe Infected: Backdoor.Win32.SdBot.cap skipped
    C:\System Volume Information\_restore{485BCDE0-6F5D-44AC-ADFB-FC4AD5FDC45E}\RP29\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\img1972.zip/IMG1972.pif Infected: Backdoor.Win32.SdBot.cap skipped
    C:\WINDOWS\img1972.zip ZIP: infected - 1 skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    F:\azureus programs\PowerISO.v3.8.Keymaker.Only-AGAiN\PowerISO.v3.8.Keymaker.Only-AGAiN\PowerISO.v3.8.Keymaker.Only-AGAiN\services.exe Infected: Backdoor.Win32.SdBot.cap skipped
    F:\azureus programs\PowerISO.v3.8.Keymaker.Only-AGAiN\PowerISO.v3.8.Keymaker.Only-AGAiN.rar/PowerISO.v3.8.Keymaker.Only-AGAiN/keygin.exe Infected: Backdoor.Win32.SdBot.cap skipped
    F:\azureus programs\PowerISO.v3.8.Keymaker.Only-AGAiN\PowerISO.v3.8.Keymaker.Only-AGAiN.rar RAR: infected - 1 skipped
    F:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\IM\Identities\{E22A1154-23B8-4E07-824E-686722A46A43}\Message Store\Deleted Items.imm/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:37:42 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:41:01 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:42:43 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:44:48 -0600]/UNNAMED/[From Citizens Bank <identdep_op6447290047@citizensbank.com>][Date Sun, 24 Oct 2004 20:56:24 +0500]/UNNAMED/html Infected: Trojan-Spy.HTML.Citifraud.ai skipped
    F:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\IM\Identities\{E22A1154-23B8-4E07-824E-686722A46A43}\Message Store\Deleted Items.imm/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:37:42 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:41:01 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:42:43 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:44:48 -0600]/UNNAMED/[From Citizens Bank <identdep_op6447290047@citizensbank.com>][Date Sun, 24 Oct 2004 20:56:24 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
    F:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\IM\Identities\{E22A1154-23B8-4E07-824E-686722A46A43}\Message Store\Deleted Items.imm/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:37:42 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:41:01 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:42:43 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:44:48 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
    F:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\IM\Identities\{E22A1154-23B8-4E07-824E-686722A46A43}\Message Store\Deleted Items.imm/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:37:42 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:41:01 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:42:43 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
    F:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\IM\Identities\{E22A1154-23B8-4E07-824E-686722A46A43}\Message Store\Deleted Items.imm/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:37:42 -0600]/UNNAMED/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:41:01 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
    F:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\IM\Identities\{E22A1154-23B8-4E07-824E-686722A46A43}\Message Store\Deleted Items.imm/[From "D & D Stanton" <stants@telus.net>][Date Sat, 23 Oct 2004 18:37:42 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Citifraud.ai skipped
    F:\Documents and Settings\Keith & Carrie\Local Settings\Application Data\IM\Identities\{E22A1154-23B8-4E07-824E-686722A46A43}\Message Store\Deleted Items.imm Mail: infected - 6 skipped
    F:\Program Files\Norton AntiVirus\Quarantine\15C47D42.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\17A41932.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\41497217.tmp Infected: Backdoor.Win32.SdBot.bti skipped
    F:\Program Files\Norton AntiVirus\Quarantine\4CF30425.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\51F56704.dll Infected: Packed.Win32.PePatch.hu skipped
    F:\Program Files\Norton AntiVirus\Quarantine\52787675.dll Infected: Packed.Win32.PePatch.hu skipped
    F:\Program Files\Norton AntiVirus\Quarantine\56095F2B.exe/data.rar/winit.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\56095F2B.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\56095F2B.exe RarSFX: infected - 2 skipped
    F:\Program Files\Norton AntiVirus\Quarantine\56095F2B.exe CryptFF: infected - 2 skipped
    F:\Program Files\Norton AntiVirus\Quarantine\629C16B9.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\6B584362.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\738E137F.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\Program Files\Norton AntiVirus\Quarantine\7A37302B.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    F:\WINDOWS\system32\ÊØÃûÕßÕ÷·Ã¾°Ã¦.exe Infected: Packed.Win32.Klone.af skipped

    Scan process completed.
     
    keith 1000,
    #8
  10. 2007/10/15
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Open Norton and remove the Quarantined item(s).

    Delete the following files.

    C:\WINDOWS\img1972.zip
    F:\WINDOWS\system32\EOI–OáOöú_ø‘.exe
    The contents of F:\Program Files\Norton AntiVirus\Quarantine
    Empty the recycle bin.


    Log onto your F: system again, empty the Deleted Items folder in Incredimail.
    Empty the recycle bin.

    Now, clear System Restore points on both systems.

    Clear past system restore points and create a new one.
    Right click My Computer and select Properties. On the System Restore tab, check the box to turn System Restore off. Click Apply. Now, uncheck the box and click Apply. Click OK, then OK to close the System Properties dialog.

    Verify a new restore point was created.
    Click Start>All Programs>Accessories>System Tools>System Restore
    Select 'Restore my computer to an earlier time', then click next.
    You should have a newly created System Checkpoint available. If so, click Cancel. If not, click Back and select 'Create a restore point' then click Next. Give the restore point a name and click next.

    That should wrap things up Keith :)
     
    noahdfear,
    #9
  11. 2007/10/16
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    hey dave all done so here is one last report, as you will see i changed from norton anti, to kaspersky anti, thats the only change.

    Logfile of HijackThis v1.99.1
    Scan saved at 3:56:56 PM, on 16/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WFXSVC.EXE
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\wfxsnt40.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    c:\progra~1\azureus\Azureus.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Documents and Settings\Keith & Carrie\My Documents\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170519494906
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170524756093
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
    O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
    O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
    O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
    O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE
     
    keith 1000,
    #10
  12. 2007/10/16
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi Keith,

    Did you uninstall Norton? It appears to have left a lot behind if you did. Recommend you download the Norton Removal Tool and run it to clean up any leftovers. Reboot when complete.
     
    noahdfear,
    #11
  13. 2007/10/16
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    hey thanks! ya i did uninstall it, it left that much behind did it? ok thanks for the removal tool. i will do that now! for the rest of it, how does it look?
    thanks dave,,,,,
    keith
     
    keith 1000,
    #12
  14. 2007/10/16
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    hey dave can ya point out any specific lines that i should remove because i went through with the removal and it actually removes everything from symantec, i have ghost and winfax also, so to use the removal tool i have to reinstall those programs, i just would like to clean up the anti-virus parts..
    keith
     
    keith 1000,
    #13
  15. 2007/10/16
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    You'd have better luck re-installing those 2 symantec products than removing just the antivirus manually. Norton hooks so deep into the system that complete manual removal is nearly impossible.

    What I'm able to see in the HijackThis log is the 04 Run entry (startup) and the 023 Symantec entries (services), though I cannot determine exactly which ones (besides the obvious) might be required for WinFax and Ghost to function properly. As far as I know they can run independently of any of the other Symantec products/services, but I cannot guarantee it.
     
    noahdfear,
    #14
  16. 2007/10/17
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    ok then. i will remove everything from symantec then reboot then post one last log. ok? thanks
     
    keith 1000,
    #15
  17. 2007/10/17
    keith 1000

    keith 1000 Inactive Thread Starter

    Joined:
    2006/10/23
    Messages:
    72
    Likes Received:
    0
    ok dave all symantec stuff is gone, so here is one last log although i have installed a microsoft life-cam vx-3000

    Logfile of HijackThis v1.99.1
    Scan saved at 2:58:30 PM, on 17/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\zHotkey.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
    C:\WINDOWS\vVX3000.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Keith & Carrie\My Documents\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe "
    O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe "
    O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170519494906
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170524756093
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
    O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    again thanks
    keith
     
    keith 1000,
    #16
  18. 2007/10/17
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks good Keith. Well done! :)
     
    noahdfear,
    #17

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...