freakin spyware

BubblemanBubbleman A Desert
edited January 2006 in Spyware & Virus Removal
Was browsing some.... well you know sites and got infected


heres my hijack log

atform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iISystem Wiper\SystemWiper.exe
C:\WINDOWS\system32\w?wexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\Joseph\LOCALS~1\Temp\22D.tmp
C:\DOCUME~1\Joseph\LOCALS~1\Temp\22F.tmp
C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\SpySheriff\SpySheriff.exe
C:\WINDOWS\addff.exe
C:\WINDOWS\system32\windw.exe
C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPROV.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Joseph\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\gpefa.dll/sp.html#12047%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\gpefa.dll/sp.html#12047%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\gpefa.dll/sp.html#12047%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\gpefa.dll/sp.html#12047%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\gpefa.dll/sp.html#12047%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\gpefa.dll/sp.html#12047%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\gpefa.dll/sp.html#12047%resultposition.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0. dll
O2 - BHO: Class - {0FCD3397-0498-446E-A6F7-E41F7343F3C0} - C:\WINDOWS\system32\windw.dll
O2 - BHO: (no name) - {23D51080-8B44-A493-4F37-DB38034E91C8} - C:\WINDOWS\system32\njx.dll (file missing)
O2 - BHO: (no name) - {24A11C1B-D886-FC5A-824A-D91821D99E99} - C:\WINDOWS\system32\ewz.dll (file missing)
O2 - BHO: (no name) - {3753942D-07E9-2565-BF9E-543080D6D0C4} - C:\WINDOWS\system32\mvvyy.dll
O2 - BHO: (no name) - {4B5A11A9-D460-FEB2-61B4-860D80FCF1CF} - C:\WINDOWS\system32\qapxnq.dll (file missing)
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\2.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Class - {94FD5399-31A3-8A09-5871-0DA2D6C8E837} - C:\WINDOWS\sdkxk.dll
O2 - BHO: (no name) - {9DF8C7F5-5335-2AE0-68C3-04A52A1E22C3} - C:\WINDOWS\system32\dvsols.dll (file missing)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {DA2DAC5A-3D97-1942-C55D-38A6FADA39C2} - C:\WINDOWS\system32\aoid.dll (file missing)
O2 - BHO: (no name) - {DEBC7F7E-BCE5-CF6A-B80E-BDBE3B0F65C7} - C:\WINDOWS\system32\bxn.dll (file missing)
O2 - BHO: (no name) - {F6224A4B-D9DF-A454-D74E-8C1DF1344090} - C:\WINDOWS\system32\mcpsrvd.dll (file missing)
O3 - Toolbar: AskCosmo! - {38D2A281-0444-433C-9ED6-A2851795F32A} - C:\Program Files\Cosmo Popup Blocker\TRReaderBar_.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0. dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [*oleurl] C:\WINDOWS\inf\oleurl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [windw.exe] C:\WINDOWS\system32\windw.exe
O4 - HKLM\..\Run: [22F.tmp] C:\DOCUME~1\Joseph\LOCALS~1\Temp\22F.tmp.exe
O4 - HKLM\..\Run: [230.tmp] C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
O4 - HKCU\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
O4 - HKCU\..\Run: [Aida] "C:\Program Files\rdso\eetu.exe" -vt rbnd
O4 - HKCU\..\Run: [Vqjdvw] C:\WINDOWS\system32\w?wexec.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - http://kb.bar.need2find.com/KB/menusearch.html?p=KB
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - C:\Program Files\WINnerTweakSE2\PopUp Blocker.exe (file missing)
O9 - Extra 'Tools' menuitem: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - C:\Program Files\WINnerTweakSE2\PopUp Blocker.exe (file missing)
O9 - Extra button: AskCosmo! - {9BE4715D-8249-4f24-9ED6-3F3543A5A221} - C:\Program Files\Cosmo Popup Blocker\TRReaderBar_.dll
O9 - Extra 'Tools' menuitem: AskCosmo! - {9BE4715D-8249-4f24-9ED6-3F3543A5A221} - C:\Program Files\Cosmo Popup Blocker\TRReaderBar_.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_2.1.1.74.cab
O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0036.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/19b99a44...p/RdxIE601.cab
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} - http://cabs.media-motor.net/cabs/joysaver.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/pages/scanner/WFI.cab

Ohhh please help me oh knowledable folks!!

:canflag:

Comments

  • BubblemanBubbleman A Desert
    edited January 2006
    If anyone could take the time to check this log out it would help me alot. ty
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Will take several posts to clean your mess up :).

    First of all you need to update hijackthis to version 1.99.1. Run hijackthis & go to *Config\Misc Tools\Check for update on-line*. If the site is down, go here and download the selfextracting zip version. Remove the old version by opening the program, going to config\misc tools, then uninstall & exit. You then have to delete the file manually. Unzip the new version into the hijackthis folder, or in the case of the self-extracting version, it will self install into your Program Files folder.

    ==

    Download CWShredder 2.19 from here. Run it and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.

    ===============

    Please download the trial version of Ewido Security Suite here:
    http://www.ewido.net/en/download/
    Install it, and update the definitions to the newest files. Do NOT run a scan yet.

    ===============

    Download AboutBuster 5:

    http://www.besttechie.net/tools/AboutBuster5.zip
    http://www.malwarebytes.biz/AboutBuster5.zip

    Once downloaded, unzip it, and put the folder on your desktop. Then double-click on the AboutBuster icon to start the program.

    Click Update. This will start updating AboutBuster with the latest definition database.

    Once it's done updating and you see that dialog, click Ok.

    Close AboutBuster.

    Reboot into safe mode following the instructions here.

    Start AboutBuster and click Begin Removal.

    When the scan is done, click Ok.


    Run Ewido, and do a full scan. During the scan it will prompt you to clean files, click OK.

    Save the logfile from the scan. Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
  • BubblemanBubbleman A Desert
    edited January 2006
    with the new version


    Logfile of HijackThis v1.99.1
    Scan saved at 3:21:54 AM, on 1/2/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Microsoft IntelliType Pro\type32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\DOCUME~1\Joseph\LOCALS~1\Temp\22F.tmp.exe
    C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\iISystem Wiper\SystemWiper.exe
    C:\WINDOWS\system32\w?wexec.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\rdso\eetu.exe
    C:\WINDOWS\mfclj.exe
    C:\WINDOWS\system32\netzv.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\HijackThis\HijackThis.exe
    C:\Program Files\Messenger\msmsgs.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\hclzj.dll/sp.html#12047%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\hclzj.dll/sp.html#12047%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\hclzj.dll/sp.html#12047%resultposition.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cntcj.dll/sp.html#12047%resultposition.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\hclzj.dll/sp.html#12047%resultposition.net
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
    R3 - Default URLSearchHook is missing
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O2 - BHO: (no name) - {23D51080-8B44-A493-4F37-DB38034E91C8} - C:\WINDOWS\system32\njx.dll (file missing)
    O2 - BHO: (no name) - {24A11C1B-D886-FC5A-824A-D91821D99E99} - C:\WINDOWS\system32\ewz.dll (file missing)
    O2 - BHO: (no name) - {3753942D-07E9-2565-BF9E-543080D6D0C4} - C:\WINDOWS\system32\mvvyy.dll
    O2 - BHO: Class - {4A6CF2F7-DDDD-2A8C-FF62-94A72AA7954F} - C:\WINDOWS\appiy32.dll
    O2 - BHO: (no name) - {4B5A11A9-D460-FEB2-61B4-860D80FCF1CF} - C:\WINDOWS\system32\qapxnq.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: Class - {94FD5399-31A3-8A09-5871-0DA2D6C8E837} - C:\WINDOWS\sdkxk.dll
    O2 - BHO: (no name) - {9DF8C7F5-5335-2AE0-68C3-04A52A1E22C3} - C:\WINDOWS\system32\dvsols.dll (file missing)
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {DA2DAC5A-3D97-1942-C55D-38A6FADA39C2} - C:\WINDOWS\system32\aoid.dll (file missing)
    O2 - BHO: (no name) - {DEBC7F7E-BCE5-CF6A-B80E-BDBE3B0F65C7} - C:\WINDOWS\system32\bxn.dll (file missing)
    O2 - BHO: (no name) - {F6224A4B-D9DF-A454-D74E-8C1DF1344090} - C:\WINDOWS\system32\mcpsrvd.dll (file missing)
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [*oleurl] C:\WINDOWS\inf\oleurl.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [windw.exe] C:\WINDOWS\system32\windw.exe
    O4 - HKLM\..\Run: [22F.tmp] C:\DOCUME~1\Joseph\LOCALS~1\Temp\22F.tmp.exe
    O4 - HKLM\..\Run: [230.tmp] C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
    O4 - HKLM\..\Run: [22F.tmp.exe] C:\DOCUME~1\Joseph\LOCALS~1\Temp\22F.tmp.exe
    O4 - HKLM\..\Run: [230.tmp.exe] C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
    O4 - HKLM\..\Run: [netzv.exe] C:\WINDOWS\system32\netzv.exe
    O4 - HKLM\..\RunOnce: [mfclj.exe] C:\WINDOWS\mfclj.exe
    O4 - HKCU\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
    O4 - HKCU\..\Run: [Aida] "C:\Program Files\rdso\eetu.exe" -vt rbnd
    O4 - HKCU\..\Run: [Vqjdvw] C:\WINDOWS\system32\w?wexec.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
    O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Search - http://kb.bar.need2find.com/KB/menusearch.html?p=KB
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - C:\Program Files\WINnerTweakSE2\PopUp Blocker.exe (file missing)
    O9 - Extra 'Tools' menuitem: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - C:\Program Files\WINnerTweakSE2\PopUp Blocker.exe (file missing)
    O9 - Extra button: AskCosmo! - {9BE4715D-8249-4f24-9ED6-3F3543A5A221} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: AskCosmo! - {9BE4715D-8249-4f24-9ED6-3F3543A5A221} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.1.74.cab
    O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0036.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/19b99a44d73f8d35df06/netzip/RdxIE601.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



    yikes O_O I appreciate you taking the time with me, now im gonna download those files
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Please go ahead and follow the rest of the instruction and post a new log after.
  • BubblemanBubbleman A Desert
    edited January 2006
    This is after running alot of those programs...

    Logfile of HijackThis v1.98.2
    Scan saved at 3:48:26 PM, on 1/2/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iISystem Wiper\SystemWiper.exe
    C:\Program Files\rdso\eetu.exe
    C:\WINDOWS\system32\w?wexec.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Documents and Settings\Joseph\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
    R3 - Default URLSearchHook is missing
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O2 - BHO: (no name) - {24A11C1B-D886-FC5A-824A-D91821D99E99} - C:\WINDOWS\system32\ewz.dll (file missing)
    O2 - BHO: (no name) - {4B5A11A9-D460-FEB2-61B4-860D80FCF1CF} - C:\WINDOWS\system32\qapxnq.dll (file missing)
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {DEBC7F7E-BCE5-CF6A-B80E-BDBE3B0F65C7} - C:\WINDOWS\system32\bxn.dll (file missing)
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [*oleurl] C:\WINDOWS\inf\oleurl.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [windw.exe] C:\WINDOWS\system32\windw.exe
    O4 - HKLM\..\Run: [230.tmp] C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
    O4 - HKLM\..\Run: [230.tmp.exe] C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
    O4 - HKCU\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
    O4 - HKCU\..\Run: [Aida] "C:\Program Files\rdso\eetu.exe" -vt rbnd
    O4 - HKCU\..\Run: [Vqjdvw] C:\WINDOWS\system32\w?wexec.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
    O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - C:\Program Files\WINnerTweakSE2\PopUp Blocker.exe (file missing)
    O9 - Extra 'Tools' menuitem: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - C:\Program Files\WINnerTweakSE2\PopUp Blocker.exe (file missing)
    O9 - Extra button: AskCosmo! - {9BE4715D-8249-4f24-9ED6-3F3543A5A221} - (no file)
    O9 - Extra 'Tools' menuitem: AskCosmo! - {9BE4715D-8249-4f24-9ED6-3F3543A5A221} - (no file)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.1.74.cab
    O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0036.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/19b99a44d73f8d35df06/netzip/RdxIE601.cab
  • BubblemanBubbleman A Desert
    edited January 2006
    looks cleaned up to me! dont ya think?

    ty for the help
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    I would prefer to see a log from the latest version of hijackthis :). Somehow you have posted one from 1.98.2
    Still not clean yet. Do the following before posting another log;

    Run the PurityScan uninstaller.

    ==

    Please read these instructions carefully and print them out! Be sure to follow ALL instructions!

    Download smitRem.zip and save the file to your desktop.
    Can also be downloaded from here; http://www.downloads.subratam.org/smitRem.exe
    Right click on the file and extract it to it's own folder on the desktop.

    Place a shortcut to Panda ActiveScan on your desktop.

    Please download the trial version of Ewido Security Suite here:
    http://www.ewido.net/en/download/

    Please read Ewido Setup Instructions
    Install it, and update the definitions to the newest files. Do NOT run a scan yet.

    If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
    Ad-Aware SE Setup
    Don't run it yet!

    Next, please reboot your computer in SafeMode by doing the following:
    1. Restart your computer
    2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
    3. Instead of Windows loading as normal, a menu should appear
    4. Select the first option, to run Windows in Safe Mode.
    Now scan with HJT and place a checkmark next to each of the following items:

    ===================================================
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - {24A11C1B-D886-FC5A-824A-D91821D99E99} - C:\WINDOWS\system32\ewz.dll (file missing)
    O2 - BHO: (no name) - {4B5A11A9-D460-FEB2-61B4-860D80FCF1CF} - C:\WINDOWS\system32\qapxnq.dll (file missing)
    O2 - BHO: (no name) - {DEBC7F7E-BCE5-CF6A-B80E-BDBE3B0F65C7} - C:\WINDOWS\system32\bxn.dll (file missing)

    O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
    ===================================================

    Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
    Wait for the tool to complete and disk cleanup to finish.

    The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


    Open Ad-aware and do a full scan. Remove all it finds.


    Run Ewido:
    • Click on scanner
    • Click Complete System Scan and the scan will begin.
    • During the scan it will prompt you to clean files, click OK
    • When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
    • When the scan is finished, click the Save report button at the bottom of the screen.
    • Save the report to your desktop
    Close Ewido

    Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.

    Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan. Make sure the autoclean box is checked!
    Save the scan log and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log by using Add Reply.
  • BubblemanBubbleman A Desert
    edited January 2006
    I have a question, what is so important about safemode then scanning in normal?
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Because there are only the very basic apps running whilst in safe mode, it is more likely that what we are removing is not 'in use' and therefore easier to remove :).
  • BubblemanBubbleman A Desert
    edited January 2006
    Well I cleaned alot of the stuff up, I have NO signs of spyware! Not that I know of.

    Here is my hijack log and scan logs...
    ewido anti-malware - Scan report

    + Created on: 12:10:25 PM, 1/3/2006
    + Report-Checksum: FB8F38B0

    + Scan result:

    :mozilla.6:C:\Documents and Settings\Joseph\Application Data\Mozilla\Firefox\Profiles\6lnnq2um.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    :mozilla.7:C:\Documents and Settings\Joseph\Application Data\Mozilla\Firefox\Profiles\6lnnq2um.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    C:\Documents and Settings\Joseph\Cookies\joseph@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\Joseph\Cookies\joseph@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
    C:\Documents and Settings\Joseph\Cookies\joseph@cs.sexcounter[2].txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
    C:\Documents and Settings\Joseph\Cookies\joseph@statcounter[1].txt -> Spyware.Cookie.Statcounter : Cleaned with backup


    ::Report End

    ewido anti-malware - Scan report

    + Created on: 3:13:01 PM, 1/2/2006
    + Report-Checksum: 2B0942D0

    + Scan result:

    HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
    C:\Documents and Settings\Joseph\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5157872c-6caed70f.zip/Gummy.class -> Trojan.Java.Femad : Cleaned with backup
    C:\Documents and Settings\Joseph\Cookies\joseph@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\Joseph\Cookies\joseph@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
    C:\Documents and Settings\Joseph\Cookies\joseph@stat.onestat[2].txt -> Spyware.Cookie.Onestat : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0452168.ini:ehclz -> Downloader.Agent.bc : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0452200.exe -> Trojan.Agent.bi : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0452201.exe -> Spyware.DatingCity : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0452202.dll -> Spyware.MyWebSearch : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0452203.DLL -> Spyware.MyWebSearch : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0452204.DLL -> Spyware.MyWebSearch : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP734\A0452223.exe -> Downloader.Agent.td : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP734\A0452438.dll -> Downloader.Agent.bc : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP734\A0452439.dll -> Downloader.Agent.bc : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP734\A0452450.exe -> Downloader.Agent.td : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP734\A0452470.ini:ehclz -> Downloader.Agent.bc : Cleaned with backup
    C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}



    3/31/2005 12:56:27 AM

    -- Registry --
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

    No Items Found

    -- Registry --
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    DwlClient C:\Program Files\Common Files\Dell\EUSW\Support.exe
    Dell AIO Printer A940 "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
    *oleurl C:\WINDOWS\inf\oleurl.exe
    ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
    TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    -- Registry --
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

    No Items Found

    -- Registry --
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

    No Items Found

    -- Registry --
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce

    No Items Found

    -- Start Menu - Current User --
    No Items Found

    -- Start Menu - All Users --
    DESKTOP.INI

    -- Disabled Items --
    eetu
    BCMSMMSG
    bargains
    ?hkdsk
    CosmoPopupBlocker
    crlt32
    wshxmw
    eDonkey2000
    hkcmd
    igfxtray
    NeroCheck
    qttask
    Steam
    TBPS
    realsched

    Ultimate Pop-up Blocker
    UPDt0a4B
    ViewMgr
    WToolsA
    z
    Adobe Reader Speed Launch
    America Online 9.0 Tray Icon
    Microsoft Broadband Networking
    WinZip Quick Pick
    OpenOffice.org 1.1.4

    -- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon --
    Explorer.exe

    -- Running Processes --
    System Idle Process
    System
    smss.exe \SystemRoot\System32\smss.exe
    csrss.exe
    winlogon.exe winlogon.exe
    services.exe C:\WINDOWS\system32\services.exe
    lsass.exe C:\WINDOWS\system32\lsass.exe
    svchost.exe C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    ccSetMgr.exe "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
    SNDSrvc.exe "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"
    SPBBCSvc.exe "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"
    ccEvtMgr.exe "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
    acsd.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    navapsvc.exe "C:\Program Files\Norton AntiVirus\navapsvc.exe"
    NPFMntor.exe "C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe"
    snmp.exe C:\WINDOWS\System32\snmp.exe
    svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
    symlcsvc.exe "C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE"
    wdfmgr.exe
    alg.exe
    explorer.exe C:\WINDOWS\Explorer.EXE
    Support.exe "C:\Program Files\Common Files\Dell\EUSW\Support.exe"
    dlbabmgr.exe "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
    ccApp.exe "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    dlbabmon.exe "C:\Program Files\Dell AIO Printer A940\dlbabmon.exe"
    qttask.exe "C:\Program Files\QuickTime\qttask.exe" -atboottime
    NotifyAlert.exe "C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe" timer
    realsched.exe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    svchost.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    msmsgs.exe "C:\Program Files\Messenger\msmsgs.exe" -Embedding
    wuauclt.exe "C:\WINDOWS\system32\wuauclt.exe" /RunStoreAsComServer Local\[3ec]SUSDS0b4571aa27a7df46a5fbf29704af9f75
    wuauclt.exe "C:\WINDOWS\system32\wuauclt.exe"
    StartupTracker3.exe "C:\Documents and Settings\Joseph\Desktop\All Folder In ONE AFIO\StartupTracker3\StartupTracker3.exe"
    wmiprvse.exe

    -- Running Services --

    Name: ALG
    Description: Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\alg.exe

    Name: AOL ACS
    Description:
    Startup Mode: Auto
    Run from: C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

    Name: AudioSrv
    Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: BITS
    Description: Transfers files in the background using idle network bandwidth. If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information. If this service is disabled, any services that explicitly depend on it may fail to transfer files if they do not have a fail safe mechanism to transfer files directly through IE in case BITS has been disabled.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: Browser
    Description: Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: ccEvtMgr
    Description: Symantec Event Manager
    Startup Mode: Auto
    Run from: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

    Name: ccSetMgr
    Description: Symantec Settings Manager
    Startup Mode: Auto
    Run from: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"

    Name: CryptSvc
    Description: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

    Name: DcomLaunch
    Description: Provides launch functionality for DCOM services.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost -k DcomLaunch

    Name: Dhcp
    Description: Manages network configuration by registering and updating IP addresses and DNS names.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: Dnscache
    Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService

    Name: ERSvc
    Description: Allows error reporting for services and applictions running in non-standard environments.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: Eventlog
    Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\services.exe

    Name: EventSystem
    Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: FastUserSwitchingCompatibility
    Description: Provides management for applications that require assistance in a multiple user environment.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: helpsvc
    Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: HTTPFilter
    Description: This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k HTTPFilter

    Name: lanmanserver
    Description: Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: lanmanworkstation
    Description: Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: LmHosts
    Description: Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

    Name: navapsvc
    Description: Handles Norton AntiVirus Auto-Protect events.
    Startup Mode: Auto
    Run from: "C:\Program Files\Norton AntiVirus\navapsvc.exe"

    Name: Netman
    Description: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: Nla
    Description: Collects and stores network configuration and location information, and notifies applications when this information changes.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: NPFMntor
    Description: Detects installation of Symantec Firewall clients
    Startup Mode: Auto
    Run from: "C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe"

    Name: PlugPlay
    Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\services.exe

    Name: PolicyAgent
    Description: Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\lsass.exe

    Name: ProtectedStorage
    Description: Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\lsass.exe

    Name: RasMan
    Description: Creates a network connection.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: RpcSs
    Description: Provides the endpoint mapper and other miscellaneous RPC services.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost -k rpcss

    Name: SamSs
    Description: Stores security information for local user accounts.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\lsass.exe

    Name: Schedule
    Description: Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: seclogon
    Description: Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: SENS
    Description: Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

    Name: SharedAccess
    Description: Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: ShellHWDetection
    Description:
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: SNDSrvc
    Description: Symantec Network Drivers Service
    Startup Mode: Auto
    Run from: "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"

    Name: SNMP
    Description: Includes agents that monitor the activity in network devices and report to the network console workstation.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\snmp.exe

    Name: SPBBCSvc
    Description: Symantec SPBBC
    Startup Mode: Auto
    Run from: "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"

    Name: srservice
    Description: Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: SSDPSRV
    Description: Enables discovery of UPnP devices on your home network.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

    Name: stisvc
    Description: Provides image acquisition services for scanners and cameras.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc

    Name: Symantec Core LC
    Description: Symantec Core LC
    Startup Mode: Auto
    Run from: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    Name: TapiSrv
    Description: Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: TermService
    Description: Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.
    Startup Mode: Manual
    Run from: C:\WINDOWS\System32\svchost -k DComLaunch

    Name: Themes
    Description: Provides user experience theme management.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: TrkWks
    Description: Maintains links between NTFS files within a computer or across computers in a network domain.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

    Name: UMWdf
    Description: Enables Windows user mode drivers.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\wdfmgr.exe

    Name: w32time
    Description: Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

    Name: WebClient
    Description: Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

    Name: winmgmt
    Description: Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

    Name: wscsvc
    Description: Monitors system security settings and configurations.
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

    Name: wuauserv
    Description: Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site.
    Startup Mode: Auto
    Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

    Name: WZCSVC
    Description: Provides automatic configuration for the 802.11 adapters
    Startup Mode: Auto
    Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs




    Hijack log



    Logfile of HijackThis v1.99.1
    Scan saved at 10:46:11 PM, on 1/3/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iISystem Wiper\SystemWiper.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Program Files\World of Warcraft\BNUpdate.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [*oleurl] C:\WINDOWS\inf\oleurl.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [windw.exe] C:\WINDOWS\system32\windw.exe
    O4 - HKLM\..\Run: [230.tmp] C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
    O4 - HKLM\..\Run: [230.tmp.exe] C:\DOCUME~1\Joseph\LOCALS~1\Temp\230.tmp.exe
    O4 - HKCU\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
    O4 - HKCU\..\Run: [Aida] "C:\Program Files\rdso\eetu.exe" -vt rbnd
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.1.74.cab
    O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0036.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/19b99a44d73f8d35df06/netzip/RdxIE601.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Sign In or Register to comment.