I've tried everything. I need wisdom and help ... please.

Comments

• Shaba

  May 2006 edited May 2006

  Hi djblacksmith.
  
  Download WinPFind.zip -> http://www.bleepingcomputer.com/files/oldtimer/WinPFind.zip and extract it to your C:\ folder. This will create a folder called WinPFind in the C:\ folder. Inside c:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.
  
  When it is done, it will show the results of the scan. Click on the Copy to Clipboard button and then paste the contents of the log in your clipboard as a reply to where you are receiving help.

  0
• djblacksmith

  May 2006 edited May 2006

  Thanks for the reply and the help. I REALLY appreciate it. Here's the lg from WinPFind ...
  
  WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.
  
  If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.
  
  »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
  Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
  Internet Explorer Version: 6.0.2900.2180
  
  »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»
  
  Checking %SystemDrive% folder...
  
  Checking %ProgramFilesDir% folder...
  
  Checking %WinDir% folder...
  
  Checking %System% folder...
  PEC2 7/16/2003 12:20:54 PM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc
  FSG! 11/11/2003 5:00:22 PM 236544 C:\WINDOWS\SYSTEM32\DivXdec.ax
  PTech 5/17/2006 11:23:38 AM 579888 C:\WINDOWS\SYSTEM32\LegitCheckControl.dll
  aspack 8/4/2004 3:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
  Umonitor 8/4/2004 3:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
  UPX! 5/29/2006 4:56:28 PM 288417 C:\WINDOWS\SYSTEM32\SrchSTS.exe
  UPX! 5/29/2006 4:56:28 PM 42496 C:\WINDOWS\SYSTEM32\swreg.exe
  UPX! 5/29/2006 4:56:30 PM 40960 C:\WINDOWS\SYSTEM32\swsc.exe
  winsync 7/16/2003 12:44:22 PM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu
  
  Checking %System%\Drivers folder and sub-folders...
  PTech 8/4/2004 1:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys
  UPX! 11/9/2005 9:07:30 PM 1022432 C:\WINDOWS\SYSTEM32\drivers\VsapiNT.sys
  aspack 11/9/2005 9:07:30 PM 1022432 C:\WINDOWS\SYSTEM32\drivers\VsapiNT.sys
  
  Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts
  
  
  Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
  5/29/2006 8:18:18 PM S 2048 C:\WINDOWS\bootstat.dat
  5/30/2006 10:22:42 AM H 54156 C:\WINDOWS\QTFont.qfn
  5/17/2006 11:24:42 AM S 7160 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WGA.cat
  4/10/2006 1:01:22 PM S 7160 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WgaNotify.cat
  5/30/2006 8:28:42 AM H 1024 C:\WINDOWS\system32\config\default.LOG
  5/29/2006 8:18:18 PM H 1024 C:\WINDOWS\system32\config\SAM.LOG
  5/30/2006 7:40:52 AM H 1024 C:\WINDOWS\system32\config\SECURITY.LOG
  5/30/2006 10:28:54 AM H 20480 C:\WINDOWS\system32\config\software.LOG
  5/30/2006 8:48:00 AM H 1024 C:\WINDOWS\system32\config\system.LOG
  5/29/2006 4:42:52 PM H 1024 C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
  5/27/2006 5:29:34 PM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\ecff0e05-38f9-405a-8c43-2179487dba3e
  5/27/2006 5:29:34 PM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\Preferred
  5/3/2006 8:49:00 PM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\f5955961-67ff-4294-9ac6-e649f08582ff
  5/3/2006 8:49:00 PM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
  5/29/2006 8:21:28 PM H 330 C:\WINDOWS\Tasks\MP Scheduled Scan.job
  5/29/2006 8:18:20 PM H 6 C:\WINDOWS\Tasks\SA.DAT
  
  Checking for CPL files...
  Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
  Sun Microsystems 6/28/2003 9:56:38 AM 229487 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
  Microsoft Corporation 7/16/2003 12:26:58 PM 187904 C:\WINDOWS\SYSTEM32\main.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
  Microsoft Corporation 7/16/2003 12:31:48 PM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
  NVIDIA Corporation 10/26/2004 1:01:00 PM 73728 C:\WINDOWS\SYSTEM32\nvtuicpl.cpl
  Microsoft Corporation 7/16/2003 12:34:02 PM 36864 C:\WINDOWS\SYSTEM32\nwc.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
  Intel(R) Corporation 12/19/2003 4:39:16 PM 77824 C:\WINDOWS\SYSTEM32\PRAppltW.cpl
  SigmaTel Inc. 10/29/2003 1:40:22 PM 102481 C:\WINDOWS\SYSTEM32\stac97.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
  Microsoft Corporation 7/16/2003 12:41:52 PM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
  Microsoft Corporation 8/4/2004 3:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
  Microsoft Corporation 6/18/2000 3:03:10 PM 106544 C:\WINDOWS\SYSTEM32\TWEAKUI.CPL
  Microsoft Corporation 8/4/2004 3:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
  Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
  Microsoft Corporation 7/16/2003 12:26:58 PM 187904 C:\WINDOWS\SYSTEM32\dllcache\main.cpl
  Microsoft Corporation 7/16/2003 12:31:48 PM 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
  Microsoft Corporation 7/16/2003 12:34:02 PM 36864 C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl
  Microsoft Corporation 7/16/2003 12:41:52 PM 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl
  Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl
  NVIDIA Corporation 1/8/2004 7:26:00 PM 143360 C:\WINDOWS\SYSTEM32\ReinstallBackups\0009\DriverFiles\nvtuicpl.cpl
  
  »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»
  
  Checking files in %ALLUSERSPROFILE%\Startup folder...
  1/18/2005 11:47:54 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
  
  Checking files in %ALLUSERSPROFILE%\Application Data folder...
  1/18/2005 3:33:56 PM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini
  1/19/2005 8:52:08 PM 347 C:\Documents and Settings\All Users\Application Data\hpzinstall.log
  2/17/2006 2:04:34 PM 2145 C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
  
  Checking files in %USERPROFILE%\Startup folder...
  1/18/2005 11:47:54 PM HS 84 C:\Documents and Settings\KDB\Start Menu\Programs\Startup\desktop.ini
  
  Checking files in %USERPROFILE%\Application Data folder...
  1/18/2005 3:33:56 PM HS 62 C:\Documents and Settings\KDB\Application Data\desktop.ini
  
  »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
  SV1 =
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
  
  [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
  HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Adobe.Acrobat.ContextMenu
  {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll
  HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
  {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
  HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
  {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
  HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
  {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
  HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}
  = C:\Program Files\Trend Micro\Internet Security 2006\Tmdshell.dll
  HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
  Start Menu Pin = %SystemRoot%\system32\SHELL32.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}
  = C:\Program Files\Trend Micro\Internet Security 2006\Tmdshell.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
  {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
  {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
  {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
  = %SystemRoot%\system32\SHELL32.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
  = %SystemRoot%\system32\SHELL32.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
  = %SystemRoot%\system32\SHELL32.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
  = %SystemRoot%\system32\SHELL32.dll
  
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
  AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3EFB4B77-1E7E-478F-8018-90BBC444F23F}
  =
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
  = C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}
  PCTools Site Guard = C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6BD3C5E5-8049-46A5-93A8-B65D3422CE46}
  =
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}
  AcroIEToolbarHelper Class = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC}
  PCTools Browser Monitor = C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{182EC0BE-5110-49C8-A062-BEB1D02A220B}
  Adobe PDF = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
  &Tip of the Day = %SystemRoot%\System32\shdocvw.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
  =
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping
  MenuText = :
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
  MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}
  ButtonText = Spyware Doctor :
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}
  ButtonText = Research :
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45}
  ButtonText = AIM : C:\Program Files\AIM\aim.exe
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
  ButtonText = Real.com :
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
  ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
  =
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
  Favorites Band = %SystemRoot%\System32\shdocvw.dll
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
  History Band = %SystemRoot%\System32\shdocvw.dll
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
  Explorer Band = %SystemRoot%\System32\shdocvw.dll
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
  {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
  {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  NvCplDaemon RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  Windows Defender "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
  IMAIL Installed = 1
  MAPI Installed = 1
  MSFS Installed = 1
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  Spyware Doctor "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services
  Bonjour Service 2
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk
  path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
  backup C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup
  location Common Startup
  command C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe
  item Acrobat Assistant
  path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
  backup C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup
  location Common Startup
  command C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe
  item Acrobat Assistant
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Norton GoBack.lnk
  path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Norton GoBack.lnk
  backup C:\WINDOWS\pss\Norton GoBack.lnkCommon Startup
  location Common Startup
  command C:\PROGRA~1\NORTON~1\NORTON~3\GBTray.exe
  item Norton GoBack
  path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Norton GoBack.lnk
  backup C:\WINDOWS\pss\Norton GoBack.lnkCommon Startup
  location Common Startup
  command C:\PROGRA~1\NORTON~1\NORTON~3\GBTray.exe
  item Norton GoBack
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Trend Micro Anti-Spyware.lnk
  path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk
  backup C:\WINDOWS\pss\Trend Micro Anti-Spyware.lnkCommon Startup
  location Common Startup
  command C:\PROGRA~1\TRENDM~1\Tmas\Tmas.exe -autostart
  item Trend Micro Anti-Spyware
  path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk
  backup C:\WINDOWS\pss\Trend Micro Anti-Spyware.lnkCommon Startup
  location Common Startup
  command C:\PROGRA~1\TRENDM~1\Tmas\Tmas.exe -autostart
  item Trend Micro Anti-Spyware
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^KDB^Start Menu^Programs^Startup^Adobe Gamma.lnk
  path C:\Documents and Settings\KDB\Start Menu\Programs\Startup\Adobe Gamma.lnk
  backup C:\WINDOWS\pss\Adobe Gamma.lnkStartup
  location Startup
  command C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE
  item Adobe Gamma
  path C:\Documents and Settings\KDB\Start Menu\Programs\Startup\Adobe Gamma.lnk
  backup C:\WINDOWS\pss\Adobe Gamma.lnkStartup
  location Startup
  command C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE
  item Adobe Gamma
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ctfmon.exe
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item ctfmon
  hkey HKCU
  command C:\WINDOWS\system32\ctfmon.exe
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item ctfmon
  hkey HKCU
  command C:\WINDOWS\system32\ctfmon.exe
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DHaxi.exe
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item DHaxi
  hkey HKCU
  command C:\WINDOWS\system32\DHaxi.exe
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item DHaxi
  hkey HKCU
  command C:\WINDOWS\system32\DHaxi.exe
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item iTunesHelper
  hkey HKLM
  command "C:\Program Files\iTunes\iTunesHelper.exe"
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item iTunesHelper
  hkey HKLM
  command "C:\Program Files\iTunes\iTunesHelper.exe"
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\newfrn.exe
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item newfrn
  hkey HKCU
  command C:\Documents and Settings\KDB\Application Data\System Restore\newfrn.exe
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item newfrn
  hkey HKCU
  command C:\Documents and Settings\KDB\Application Data\System Restore\newfrn.exe
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NvCplDaemon
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item NvCpl
  hkey HKLM
  command RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item NvCpl
  hkey HKLM
  command RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\pccguide.exe
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item pccguide
  hkey HKLM
  command "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item pccguide
  hkey HKLM
  command "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\pop06apelt
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item thiselt
  hkey HKLM
  command C:\WINDOWS\thiselt.exe
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item thiselt
  hkey HKLM
  command C:\WINDOWS\thiselt.exe
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PRONoMgr.exe
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item PRONoMgr
  hkey HKLM
  command c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item PRONoMgr
  hkey HKLM
  command c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Pure Networks Port Magic
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item PortAOL
  hkey HKLM
  command "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item PortAOL
  hkey HKLM
  command "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\qudjlfy
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item mejdan
  hkey HKLM
  command c:\windows\system32\mejdan.exe r
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item mejdan
  hkey HKLM
  command c:\windows\system32\mejdan.exe r
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item qttask
  hkey HKLM
  command "C:\Program Files\QuickTime\qttask.exe" -atboottime
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item qttask
  hkey HKLM
  command "C:\Program Files\QuickTime\qttask.exe" -atboottime
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SM1BG
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item SM1BG
  hkey HKLM
  command C:\WINDOWS\SM1BG.EXE
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item SM1BG
  hkey HKLM
  command C:\WINDOWS\SM1BG.EXE
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item jusched
  hkey HKLM
  command C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item jusched
  hkey HKLM
  command C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item realsched
  hkey HKLM
  command "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item realsched
  hkey HKLM
  command "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Tweak UI
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item RUNDLL32
  hkey HKLM
  command RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
  inimapping 0
  key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  item RUNDLL32
  hkey HKLM
  command RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
  inimapping 0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
  system.ini 0
  win.ini 0
  bootini 2
  services 2
  startup 2
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Attachments
  ScanWithAntiVirus 2
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
  {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
  {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
  {0DF44EAA-FF21-4412-828E-260A8728E7F1} =
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
  dontdisplaylastusername 0
  legalnoticecaption
  legalnoticetext
  shutdownwithoutlogon 1
  undockwithoutlogon 1
  
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]
  
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\comdlg32
  NoBackButton 0
  NoFileMru 0
  
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
  NoDriveTypeAutoRun 145
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
  CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
  WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
  SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  UserInit = C:\WINDOWS\system32\userinit.exe,
  Shell = Explorer.exe
  System =
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
  = crypt32.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
  = cryptnet.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
  = cscdll.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
  = wlnotify.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
  = wlnotify.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
  = sclgntfy.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring
  = c:\WINDOWS\System32\LgNotify.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
  = WlNotify.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
  = wlnotify.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon
  = WgaLogon.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
  = wlnotify.dll
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier
  = WRLogonNTF.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
  Debugger = ntsd -d
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  AppInit_DLLs
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
  WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
  Scan completed on 5/30/2006 10:29:00 AM

  0
• Shaba

  May 2006 edited May 2006

  That's was very useful
  
  1. Please download The Avenger by Swandog46 to your Desktop.

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

  
  2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
  

  Files to delete:
  C:\WINDOWS\system32\DHaxi.exe
  C:\Documents and Settings\KDB\Application Data\System Restore\newfrn.exe
  C:\WINDOWS\thiselt.exe
  c:\windows\system32\mejdan.exe

  
  Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
  
  3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Script file to execute" choose "Input Script Manually".
  • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
  • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
  • Click Done
  • Now click on the Green Light to begin execution of the script
  • Answer "Yes" twice when prompted.

  4. The Avenger will automatically do the following:

  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

  5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply
  
  Also, do a blacklight scan:
  
  Download F-Secure Blacklight and save it to your desktop -> http://www.f-secure.com/blacklight/try.shtml
  
  Doubleclick blbeta.exe, accept the agreement, click Scan, then click Next
  
  You'll see a list what have been found. A log will appear to your desktop, it is named fsbl.xxxxxxx.log (xxxxxxx will be random numbers).
  
  DON'T choose Rename if something was found!
  
  Post also the contents of fsbl.xxxx.log to here (xxxx= random numbers,blacklight log from your desktop)

  0
• djblacksmith

  May 2006 edited May 2006

  Thanks ... here are the logs from Avenger, fresh HJT, and Blacklight ...
  
  Logfile of The Avenger version 1, by Swandog46
  Running from registry key:
  \Registry\Machine\System\CurrentControlSet\Services\geqckacb
  
  *******************
  
  Script file located at: \??\C:\WINDOWS\system32\cfbvyasg.txt
  Script file opened successfully.
  
  Script file read successfully
  
  Backups directory opened successfully at C:\Avenger
  
  *******************
  
  Beginning to process script file:
  
  
  
  File C:\WINDOWS\system32\DHaxi.exe not found!
  Deletion of file C:\WINDOWS\system32\DHaxi.exe failed!
  
  Could not process line:
  C:\WINDOWS\system32\DHaxi.exe
  Status: 0xc0000034
  
  
  
  File C:\Documents and Settings\KDB\Application Data\System Restore\newfrn.exe not found!
  Deletion of file C:\Documents and Settings\KDB\Application Data\System Restore\newfrn.exe failed!
  
  Could not process line:
  C:\Documents and Settings\KDB\Application Data\System Restore\newfrn.exe
  Status: 0xc0000034
  
  
  
  File C:\WINDOWS\thiselt.exe not found!
  Deletion of file C:\WINDOWS\thiselt.exe failed!
  
  Could not process line:
  C:\WINDOWS\thiselt.exe
  Status: 0xc0000034
  
  
  
  File c:\windows\system32\mejdan.exe not found!
  Deletion of file c:\windows\system32\mejdan.exe failed!
  
  Could not process line:
  c:\windows\system32\mejdan.exe
  Status: 0xc0000034
  
  
  Completed script processing.
  
  *******************
  
  Finished! Terminate.
  
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 11:37:00 AM, on 5/30/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\S24EvMon.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  C:\WINDOWS\system32\nvsvc32.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  C:\WINDOWS\System32\RegSrvc.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\System32\1XConfig.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\WINDOWS\system32\notepad.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\System32\wbem\wmiprvse.exe
  C:\Documents and Settings\KDB\My Documents\Unzip\hijackthis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - Default URLSearchHook is missing
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {3EFB4B77-1E7E-478F-8018-90BBC444F23F} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: (no name) - {6BD3C5E5-8049-46A5-93A8-B65D3422CE46} - (no file)
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
  O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
  O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148953347191
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O20 - Winlogon Notify: Sebring - c:\WINDOWS\System32\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
  O23 - Service: GBPoll - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
  
  
  
  05/30/06 11:39:58 [Info]: BlackLight Engine 1.0.37 initialized
  05/30/06 11:39:58 [Info]: OS: 5.1 build 2600 (Service Pack 2)
  05/30/06 11:39:58 [Note]: 7019 4
  05/30/06 11:39:58 [Note]: 7005 0
  05/30/06 11:40:11 [Note]: 7006 0
  05/30/06 11:40:11 [Note]: 7011 1492
  05/30/06 11:40:11 [Note]: 7026 0
  05/30/06 11:40:11 [Note]: 7026 0
  05/30/06 11:40:53 [Note]: FSRAW library version 1.7.1015
  05/30/06 12:00:11 [Note]: 7007 0

  0
• Shaba

  May 2006 edited May 2006

  Ok, none of those were present.
  
  Please download RootkitRevealer, scan and paste log here http://www.sysinternals.com/Utilities/RootkitRevealer.html
  
  Can you describe those pop ups?

  0
• djblacksmith

  May 2006 edited May 2006

  Description of pop-ups ... okay, they "pop-up" without any prompting of myself, like ... if the computer is online, I don't have to do anything for a website window to open ... then another, and another, up to 10. The sites that are opening seem to be the same each time after I close each window (they opo-up again in minutes). As I am posting this, I'm getting windows, both large and small, opening. Here's a screen shot of the history for this morning (I'm not using the Internet other than to converse with you, so there are no sites that I have visited on my own outside of those you directed me to).
  
  
  
  The log from Rootkit is in my next entry...

  0
• Shaba

  May 2006 edited May 2006

  I'm kinda lost here, but let's try this:
  
  BEFORE BEGINNING, Please read completely through the instructions below and download the files from the links provided. You may want to save or print out these instructions for easier reference.
  
  First, download Ewido Security Suite.
  
  Next, download Lavasoft's Ad-Aware and the VX2 Cleaner Plug-in. Install Ad-Aware using the default options, then install vx2cleaner_inst.exe, taking all the defaults there as well.
  
  Run Ad-Aware, update to the latest definitions, then click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK", then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.
  
  Reboot your PC and run Ad-Aware again. This time, click on the Start button in Ad-Aware, select "Perform smart system scan" and click Next. Once the scan finishes, click "Next" again. Select all objects found (right click anywhere in the list of found objects and click "Select All Objects"). Click "Next" one more time, then "OK" to confirm the removal.
  
  You will be prompted to set Ad-Aware to run on reboot, click "OK". Exit Ad-Aware and restart your PC once again.
  
  When Ad-Aware starts up, click on "Start", then "Next". Follow the steps above if anything is found, or click "Finish", then exit Ad-Aware.
  
  For a final cleanup, please install and run Ewido.

  1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  2. When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  3. From the main ewido screen, click on update in the left menu, then click the Start update button.
  4. After the update finishes (the status bar at the bottom will display "Update successful")
  5. Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
  6. If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.
  7. When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

  
  Please finish up by rebooting your system once more, and posting a new HijackThis log and the log from the Ewido scan.

  0
• djblacksmith

  May 2006 edited May 2006

  Okay ... I did all as you said, step by step. I already had Ad-Aware installed and updated (though I ran update again) and installed the add-on. The only step that did NOT take place was the "You will be prompted to set Ad-Aware to run on reboot." It did not ask, and I tried to seek the help file to see how to "make it" do that, but was not successful. Everything before and after that one step took place though.
  
  Here is the log for Ewido and a fresh HJT log.
  

  ---

  ewido anti-malware - Scan report

  ---

  
  + Created on: 3:43:14 PM, 5/30/2006
  + Report-Checksum: E1B3E650
  
  + Scan result:
  
  C:\Documents and Settings\KDB\Cookies\kdb@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\KDB\Cookies\kdb@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\KDB\Cookies\kdb@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup
  C:\Documents and Settings\KDB\Cookies\kdb@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup
  C:\Documents and Settings\KDB\Cookies\kdb@anat.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup
  C:\Documents and Settings\KDB\Cookies\kdb@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
  C:\Documents and Settings\KDB\Cookies\kdb@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned with backup
  C:\Documents and Settings\KDB\Cookies\kdb@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
  
  
  ::Report End
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 3:55:45 PM, on 5/30/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\S24EvMon.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\SPYWAR~1\swdoctor.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  C:\WINDOWS\system32\nvsvc32.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  C:\WINDOWS\System32\RegSrvc.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\System32\1XConfig.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Documents and Settings\KDB\My Documents\Unzip\hijackthis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - Default URLSearchHook is missing
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {3EFB4B77-1E7E-478F-8018-90BBC444F23F} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: (no name) - {6BD3C5E5-8049-46A5-93A8-B65D3422CE46} - (no file)
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
  O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
  O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
  O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148953347191
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O20 - Winlogon Notify: Sebring - c:\WINDOWS\System32\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: GBPoll - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe

  0
• Shaba

  May 2006 edited May 2006

  Well, if that didn't help, let's try this:
  
  Download Hoster and unzip it to your desktop.
  
  Open Hoster.
  

  • Click "Make Hosts Writable?" upper right corner (if available)
  • Click "Restore Microsoft's Original Hosts File" and then click OK
  • Close Hoster

  Note; IF you used any custom Hosts (eg. MVPS Hosts), you will have put them back manually

  0
• djblacksmith

  May 2006 edited May 2006

  Greetings ... okay, I ran Hoster as you said, rebooted, and ran a fresh HJT. Here's the log ... (The same pesky windows keep opening
  as we speak)
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 12:39:52 PM, on 5/31/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\S24EvMon.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  C:\WINDOWS\system32\nvsvc32.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  C:\WINDOWS\System32\RegSrvc.exe
  C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  C:\WINDOWS\System32\1XConfig.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
  C:\Documents and Settings\KDB\My Documents\Unzip\hijackthis\HijackThis.exe
  C:\WINDOWS\system32\wuauclt.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - Default URLSearchHook is missing
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {3EFB4B77-1E7E-478F-8018-90BBC444F23F} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {6BD3C5E5-8049-46A5-93A8-B65D3422CE46} - (no file)
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
  O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
  O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148953347191
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: Sebring - c:\WINDOWS\System32\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: GBPoll - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe

  0
• Shaba

  May 2006 edited May 2006

  Ok, next this
  
  Boot in safe mode.
  
  Open HijackThis, click open misc tools section.
  Checkmark those twose small boxes (list also minor sections (full) and list empty sections (complete)) and press generate startuplist log and yes. Save that log and send it here.

  0
• djblacksmith

  May 2006 edited May 2006

  Done ... here's the log ...
  
  StartupList report, 5/31/2006, 1:49:34 PM
  StartupList version: 1.52.2
  Started from : C:\Documents and Settings\KDB\My Documents\Unzip\hijackthis\HijackThis.EXE
  Detected: Windows XP SP2 (WinNT 5.01.2600)
  Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  * Using default options
  * Including empty and uninteresting sections
  * Showing rarely important sections
  ==================================================
  
  Running processes:
  
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\Documents and Settings\KDB\My Documents\Unzip\hijackthis\HijackThis.exe
  

  ---

  
  Listing of startup folders:
  
  Shell folders Startup:
  [C:\Documents and Settings\KDB\Start Menu\Programs\Startup]
  *No files*
  
  Shell folders AltStartup:
  *Folder not found*
  
  User shell folders Startup:
  *Folder not found*
  
  User shell folders AltStartup:
  *Folder not found*
  
  Shell folders Common Startup:
  [C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
  *No files*
  
  Shell folders Common AltStartup:
  *Folder not found*
  
  User shell folders Common Startup:
  *Folder not found*
  
  User shell folders Alternate Common Startup:
  *Folder not found*
  

  ---

  
  Checking Windows NT UserInit:
  
  [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  UserInit = C:\WINDOWS\system32\userinit.exe,
  
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
  *Registry key not found*
  
  [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  *Registry value not found*
  
  [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
  *Registry key not found*
  

  ---

  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  
  NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  MSConfig = C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
  

  ---

  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  
  *No values found*
  

  ---

  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  
  (Default) =
  

  ---

  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
  
  *No values found*
  

  ---

  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  
  *Registry key not found*
  

  ---

  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  
  *No values found*
  

  ---

  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
  
  *No values found*
  

  ---

  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  
  *No values found*
  

  ---

  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
  
  *No values found*
  

  ---

  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  
  *Registry key not found*
  

  ---

  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
  
  *Registry key not found*
  

  ---

  
  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
  
  *Registry key not found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  
  [OptionalComponents]
  *No values found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  *No subkeys found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  *No subkeys found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
  *No subkeys found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  *Registry key not found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  *No subkeys found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
  *No subkeys found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  *No subkeys found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
  *No subkeys found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  *Registry key not found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
  *Registry key not found*
  

  ---

  
  Autorun entries in Registry subkeys of:
  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
  *Registry key not found*
  

  ---

  
  File association entry for .EXE:
  HKEY_CLASSES_ROOT\exefile\shell\open\command
  
  (Default) = "%1" %*
  

  ---

  
  File association entry for .COM:
  HKEY_CLASSES_ROOT\comfile\shell\open\command
  
  (Default) = "%1" %*
  

  ---

  
  File association entry for .BAT:
  HKEY_CLASSES_ROOT\batfile\shell\open\command
  
  (Default) = "%1" %*
  

  ---

  
  File association entry for .PIF:
  HKEY_CLASSES_ROOT\piffile\shell\open\command
  
  (Default) = "%1" %*
  

  ---

  
  File association entry for .SCR:
  HKEY_CLASSES_ROOT\scrfile\shell\open\command
  
  (Default) = "%1" /S
  

  ---

  
  File association entry for .HTA:
  HKEY_CLASSES_ROOT\htafile\shell\open\command
  
  (Default) = C:\WINDOWS\System32\mshta.exe "%1" %*
  

  ---

  
  File association entry for .TXT:
  HKEY_CLASSES_ROOT\txtfile\shell\open\command
  
  (Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
  

  ---

  
  Enumerating Active Setup stub paths:
  HKLM\Software\Microsoft\Active Setup\Installed Components
  (* = disabled by HKCU twin)
  
  [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
  StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP
  
  [>{26923b43-4d38-484f-9b9e-de460746276c}] *
  StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
  
  [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
  StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
  
  [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
  StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
  
  [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
  StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  
  [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
  StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
  
  [{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
  StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
  
  [{4b218e3e-bc98-4770-93d3-2731b9329278}] *
  StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
  
  [{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
  StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
  
  [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
  StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub
  
  [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
  StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
  
  [{89820200-ECBD-11cf-8B85-00AA005B4340}] *
  StubPath = regsvr32.exe /s /n /i:U shell32.dll
  
  [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
  StubPath = %SystemRoot%\system32\ie4uinit.exe
  
  [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
  StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
  

  ---

  
  Enumerating ICQ Agent Autostart apps:
  HKCU\Software\Mirabilis\ICQ\Agent\Apps
  
  *Registry key not found*
  

  ---

  
  Load/Run keys from C:\WINDOWS\WIN.INI:
  
  load=*INI section not found*
  run=*INI section not found*
  
  Load/Run keys from Registry:
  
  HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
  HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
  HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
  HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
  HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
  HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
  HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
  HKCU\..\Windows NT\CurrentVersion\Windows: load=
  HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
  HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
  

  ---

  
  Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
  
  Shell=*INI section not found*
  SCRNSAVE.EXE=*INI section not found*
  drivers=*INI section not found*
  
  Shell & screensaver key from Registry:
  
  Shell=Explorer.exe
  SCRNSAVE.EXE=*Registry value not found*
  drivers=*Registry value not found*
  
  Policies Shell key:
  
  HKCU\..\Policies: Shell=*Registry key not found*
  HKLM\..\Policies: Shell=*Registry value not found*
  

  ---

  
  Checking for EXPLORER.EXE instances:
  
  C:\WINDOWS\Explorer.exe: PRESENT!
  
  C:\Explorer.exe: not present
  C:\WINDOWS\Explorer\Explorer.exe: not present
  C:\WINDOWS\System\Explorer.exe: not present
  C:\WINDOWS\System32\Explorer.exe: not present
  C:\WINDOWS\Command\Explorer.exe: not present
  C:\WINDOWS\Fonts\Explorer.exe: not present
  

  ---

  
  Checking for superhidden extensions:
  
  .lnk: HIDDEN! (arrow overlay: yes)
  .pif: HIDDEN! (arrow overlay: yes)
  .exe: not hidden
  .com: not hidden
  .bat: not hidden
  .hta: not hidden
  .scr: not hidden
  .shs: HIDDEN!
  .shb: HIDDEN!
  .vbs: not hidden
  .vbe: not hidden
  .wsh: not hidden
  .scf: HIDDEN! (arrow overlay: NO!)
  .url: HIDDEN! (arrow overlay: yes)
  .js: not hidden
  .jse: not hidden
  

  ---

  
  Verifying REGEDIT.EXE integrity:
  
  - Regedit.exe found in C:\WINDOWS
  - .reg open command is normal (regedit.exe %1)
  - Company name OK: 'Microsoft Corporation'
  - Original filename OK: 'REGEDIT.EXE'
  - File description: 'Registry Editor'
  
  Registry check passed
  

  ---

  
  Enumerating Browser Helper Objects:
  
  (no name) - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
  (no name) - (no file) - {3EFB4B77-1E7E-478F-8018-90BBC444F23F}
  (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
  (no name) - (no file) - {6BD3C5E5-8049-46A5-93A8-B65D3422CE46}
  (no name) - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}
  

  ---

  
  Enumerating Task Scheduler jobs:
  
  MP Scheduled Scan.job
  Norton SystemWorks One Button Checkup.job
  Symantec Drmc.job
  Symantec NetDetect.job
  

  ---

  
  Enumerating Download Program Files:
  
  [Shockwave ActiveX Control]
  InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
  CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
  
  [Symantec AntiVirus scanner]
  InProcServer32 = C:\WINDOWS\Downloaded Program Files\avsniff.dll
  CODEBASE = http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  
  [WUWebControl Class]
  InProcServer32 = C:\WINDOWS\system32\wuweb.dll
  CODEBASE = http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148953347191
  
  [Symantec RuFSI Utility Class]
  InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
  CODEBASE = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  
  [Java Plug-in 1.4.1_04]
  InProcServer32 = C:\Program Files\Java\j2re1.4.1_04\bin\npjpi141_04.dll
  CODEBASE = http://java.sun.com/products/plugin/1.4/jinstall-14_04-windows-i586.cab
  
  [Java Plug-in 1.4.1_04]
  InProcServer32 = C:\Program Files\Java\j2re1.4.1_04\bin\npjpi141_04.dll
  CODEBASE = http://java.sun.com/products/plugin/1.4/jinstall-14_04-windows-i586.cab
  
  [Java Plug-in 1.5.0_05]
  InProcServer32 = C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
  

  ---

  
  Enumerating Winsock LSP files:
  
  NameSpace #1: C:\WINDOWS\System32\mswsock.dll
  NameSpace #2: C:\WINDOWS\System32\winrnr.dll
  NameSpace #3: C:\WINDOWS\System32\mswsock.dll
  NameSpace #4: C:\Program Files\Bonjour\mdnsNSP.dll
  Protocol #1: connwsp.dll (file MISSING)
  Protocol #2: connwsp.dll (file MISSING)
  Protocol #3: connwsp.dll (file MISSING)
  Protocol #4: connwsp.dll (file MISSING)
  Protocol #5: C:\WINDOWS\system32\mswsock.dll
  Protocol #6: C:\WINDOWS\system32\mswsock.dll
  Protocol #7: C:\WINDOWS\system32\mswsock.dll
  Protocol #8: C:\WINDOWS\system32\rsvpsp.dll
  Protocol #9: C:\WINDOWS\system32\rsvpsp.dll
  Protocol #10: C:\WINDOWS\system32\mswsock.dll
  Protocol #11: C:\WINDOWS\system32\mswsock.dll
  Protocol #12: C:\WINDOWS\system32\mswsock.dll
  Protocol #13: C:\WINDOWS\system32\mswsock.dll
  Protocol #14: C:\WINDOWS\system32\mswsock.dll
  Protocol #15: C:\WINDOWS\system32\mswsock.dll
  Protocol #16: C:\WINDOWS\system32\mswsock.dll
  Protocol #17: C:\WINDOWS\system32\mswsock.dll
  Protocol #18: C:\WINDOWS\system32\mswsock.dll
  Protocol #19: C:\WINDOWS\system32\mswsock.dll
  Protocol #20: connwsp.dll (file MISSING)
  

  ---

  
  Enumerating Windows NT/2000/XP services
  
  Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
  Adobe LM Service: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)
  Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
  AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
  Intel AGP Bus Filter: System32\DRIVERS\agp440.sys (system)
  Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
  Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
  AOL Connectivity Service: "C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" (autostart)
  AOL TopSpeed Monitor: C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe (autostart)
  Alps Touch Pad Filter Driver for Windows 2000/XP: System32\DRIVERS\Apfiltr.sys (manual start)
  Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
  1394 ARP Client Protocol: System32\DRIVERS\arp1394.sys (manual start)
  ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
  RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
  Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
  ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
  Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
  Broadcom 440x 10/100 Integrated Controller XP Driver: System32\DRIVERS\bcm4sbxp.sys (manual start)
  BCM V.92 56K Modem: System32\DRIVERS\BCMSM.sys (manual start)
  Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (disabled)
  Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
  Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
  ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
  Microsoft ACPI Control Method Battery Driver: System32\DRIVERS\CmBatt.sys (manual start)
  Microsoft Composite Battery Driver: System32\DRIVERS\compbatt.sys (system)
  COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
  CO_Mon: \??\C:\WINDOWS\system32\Drivers\CO_Mon.sys (manual start)
  Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
  DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Disk Driver: System32\DRIVERS\disk.sys (system)
  Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
  dmboot: System32\drivers\dmboot.sys (disabled)
  dmio: System32\drivers\dmio.sys (disabled)
  dmload: System32\drivers\dmload.sys (disabled)
  Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
  DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
  Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
  Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Event Log: %SystemRoot%\system32\services.exe (autostart)
  COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
  ewido security suite control: C:\Program Files\ewido\security suite\ewidoctrl.exe (autostart)
  Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  FltMgr: system32\drivers\fltmgr.sys (system)
  Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
  GBPoll: C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe (autostart)
  GEARAspiWDM: System32\Drivers\GEARAspiWDM.sys (manual start)
  Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
  Intel GV3 Processor Driver: System32\DRIVERS\gv3.sys (manual start)
  Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start)
  IEEE-1284.4 Driver HPZid412: system32\DRIVERS\HPZid412.sys (manual start)
  Print Class Driver for IEEE-1284.4 HPZipr12: system32\DRIVERS\HPZipr12.sys (manual start)
  USB to IEEE-1284.4 Translation Driver HPZius12: system32\DRIVERS\HPZius12.sys (manual start)
  HTTP: System32\Drivers\HTTP.sys (manual start)
  HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
  i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
  InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
  CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (system)
  IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (manual start)
  IntelIde: System32\DRIVERS\intelide.sys (system)
  Intel Processor Driver: System32\DRIVERS\intelppm.sys (system)
  IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
  IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
  IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
  IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
  iPodService: C:\Program Files\iPod\bin\iPodService.exe (manual start)
  IPSEC driver: System32\DRIVERS\ipsec.sys (system)
  IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
  PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
  Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
  Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)
  Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
  Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
  AEGIS Protocol (IEEE 802.1x) v2.2.1.0: System32\DRIVERS\mdc8021x.sys (autostart)
  Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)
  Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
  NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
  Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
  Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
  WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
  MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
  Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
  Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
  Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
  Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
  Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
  Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
  Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
  NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
  Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
  NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
  NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
  Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
  Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
  Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
  Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  1394 Net Driver: System32\DRIVERS\nic1394.sys (manual start)
  Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Norton Unerase Protection Driver: \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS (manual start)
  Norton Unerase Protection: C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE (autostart)
  NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
  Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
  nv: System32\DRIVERS\nv4_mini.sys (manual start)
  NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)
  IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
  IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
  Texas Instruments OHCI Compliant IEEE 1394 Host Controller: System32\DRIVERS\ohci1394.sys (system)
  OMCI WDM Device Driver: System32\DRIVERS\omci.sys (system)
  Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)
  Trend Micro Central Control Component: C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe (autostart)
  PCI Bus Driver: System32\DRIVERS\pci.sys (system)
  PCIIde: System32\DRIVERS\pciide.sys (system)
  Pcmcia: System32\DRIVERS\pcmcia.sys (system)
  Plug and Play: %SystemRoot%\system32\services.exe (autostart)
  IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
  WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
  Processor Driver: System32\DRIVERS\processr.sys (system)
  Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
  QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
  Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
  PxHelp20: system32\DRIVERS\PxHelp20.sys (system)
  Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
  Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
  Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
  Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
  Rdbss: System32\DRIVERS\rdbss.sys (system)
  RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
  Terminal Server Device Redirector Driver: System32\DRIVERS\rdpdr.sys (manual start)
  Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
  Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
  RegSrvc: C:\WINDOWS\System32\RegSrvc.exe (autostart)
  Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
  Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
  Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
  Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
  QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
  Spectrum24 Event Monitor: C:\WINDOWS\System32\S24EvMon.exe (autostart)
  WLAN Transport: System32\DRIVERS\s24trans.sys (autostart)
  Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
  Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
  Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  SDdriver: \??\C:\WINDOWS\system32\Drivers\sddriver.sys (manual start)
  Secdrv: System32\DRIVERS\secdrv.sys (manual start)
  Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Speed Disk service: C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE (autostart)
  Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
  Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
  System Restore Filter Driver: \SystemRoot\System32\DRIVERS\sr.sys (disabled)
  System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Srv: System32\DRIVERS\srv.sys (manual start)
  SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
  Audio Driver (WDM) - SigmaTel CODEC: system32\drivers\stac97.sys (manual start)
  Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
  Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
  Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
  MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{9300246F-1722-48B2-8834-46D0958520B7} (manual start)
  Symantec Core LC: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (autostart)
  SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (manual start)
  symlcbrd: \??\C:\WINDOWS\system32\drivers\symlcbrd.sys (autostart)
  Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
  Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
  Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
  Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
  Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
  Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Telnet: C:\WINDOWS\System32\tlntsvr.exe (disabled)
  Tmfilter: system32\drivers\TmXPFlt.sys (autostart)
  Trend Micro Real-time Service: C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe (autostart)
  Trend Micro Personal Firewall: C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe (autostart)
  Tmpreflt: system32\drivers\Tmpreflt.sys (autostart)
  Trend Micro Proxy Service: C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe (autostart)
  Trend Micro TDI Driver: \SystemRoot\System32\Drivers\tmtdi.sys (system)
  Common Firewall Driver: \SystemRoot\System32\Drivers\tm_cfw.sys (autostart)
  Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
  Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (autostart)
  Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
  Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
  Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
  Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
  Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
  USB2 Enabled Hub: System32\DRIVERS\usbhub.sys (manual start)
  Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
  USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
  USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
  Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
  VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
  Vsapint: system32\drivers\VsapiNT.sys (autostart)
  Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
  Intel(R) PRO/Wireless 2200 Adapter Driver: System32\DRIVERS\w22n51.sys (manual start)
  Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
  WAN Miniport (ATW): system32\DRIVERS\wanatw4.sys (manual start)
  Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
  WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
  Windows Defender Service: "C:\Program Files\Windows Defender\MsMpEng.exe" (autostart)
  Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
  Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
  Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
  Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
  Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
  
  

  ---

  
  Enumerating Windows NT logon/logoff scripts:
  *No scripts set to run*
  
  Windows NT checkdisk command:
  BootExecute = autocheck autochk *
  
  Windows NT 'Wininit.ini':
  PendingFileRenameOperations: *Registry value not found*
  

  ---

  
  Enumerating ShellServiceObjectDelayLoad items:
  
  PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
  CDBurn: C:\WINDOWS\system32\SHELL32.dll
  WebCheck: C:\WINDOWS\System32\webcheck.dll
  SysTray: C:\WINDOWS\System32\stobject.dll
  

  ---

  Autorun entries from Registry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
  
  *Registry key not found*
  

  ---

  
  Autorun entries from Registry:
  HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
  
  *Registry key not found*
  

  ---

  
  End of report, 34,224 bytes
  Report generated in 0.230 seconds
  
  Command line options:
  /verbose - to add additional info on each section
  /complete - to include empty sections and unsuspicious data
  /full - to include several rarely-important sections
  /force9x - to include Win9x-only startups even if running on WinNT
  /forcent - to include WinNT-only startups even if running on Win9x
  /forceall - to include all Win9x and WinNT startups, regardless of platform
  /history - to list version history only

  0
• Shaba

  May 2006 edited May 2006

  Please upload this file -> c:\windows\system32\drivers\co_mon.sys
  to here -> http://virusscan.jotti.org/
  or here -> http://www.virustotal.com/en/indexf.html
  and send results here

  0
• djblacksmith

  May 2006 edited May 2006

  Ok ... did that. Ran the file through both services. Both found nothing. Screen shot for both result screens below ... (thank you so much for all your time in this headache).
  
  
  
  

  0
• Shaba

  June 2006 edited June 2006

  Ok. Then next this:
  
  * Download Dr.Web CureIt to the desktop:
  ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

  • Boot to safe mode
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.

  
  Also, do this:
  
  Create new folder on C:\ -drive, name it blacklight
  
  Next,
  
  Download F-Secure Blacklight on your desktop and move blbeta.exe to new folder (c:\blacklight)
  Close Blacklight if running. Click Start -> Run and type cmd
  
  Press Enter. When command prompt opens, type: c:\blacklight\blbeta.exe /expert (Note that there's one blank space before c:\blacklight\blbeta.exe line as well as after before kuten myös blbeta.exe line before /expert)
  
  If this was successful, try this:
  
  Start -> programs -> accessories -> command prompt and do same steps as above.
  
  BlackLightin should open now in Expert mode. Run a scan. You'll see a list what have been found. A log will appear to your desktop, it is named fsbl.xxxxxxx.log (xxxxxxx will be random numbers).
  
  Post the contents of fsbl.xxxx.log to here (xxxx= random numbers,blacklight log from your desktop).

  0
• djblacksmith

  June 2006 edited June 2006

  Ok ... did everything as requested.
  First ran DrWeb in SfaeMode - The DrWeb.csv file is empty (I didn't post here).
  Second, Blacklight ... wouldn't run in SafeMode so rebooted in Normal mode, but then ran precisely as you said. Here is the log ...
  
  06/01/06 10:05:15 [Info]: BlackLight Engine 1.0.37 initialized
  06/01/06 10:05:15 [Info]: OS: 5.1 build 2600 (Service Pack 2)
  06/01/06 10:05:15 [Note]: 7019 4
  06/01/06 10:05:15 [Note]: 7005 0
  06/01/06 10:05:22 [Note]: 7006 0
  06/01/06 10:05:22 [Note]: 7022 0
  06/01/06 10:05:22 [Note]: 7011 1732
  06/01/06 10:05:23 [Note]: 7026 0
  06/01/06 10:05:23 [Note]: 7026 0
  06/01/06 10:05:23 [Note]: FSRAW library version 1.7.1015
  06/01/06 10:07:50 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000022.08B
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000023.08K
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000024.08R
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000025.08J
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000026.088
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000027.07K
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000028
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000029.08S
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000030
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000031
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000032
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000033
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000035
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000036
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000037
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000038
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000039
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000042
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000045
  06/01/06 10:07:51 [Note]: 10002 3
  06/01/06 10:07:51 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000046.08K
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000047
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000048
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000051
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000052
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000053
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000054
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000055
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000057
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000059
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000060
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000061
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000062.edb
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000064.xml
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000065.xml
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000068.000
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000069.001
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000073.JOB
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\NPROTECT.LOG
  06/01/06 10:07:52 [Note]: 7002 0
  06/01/06 10:07:52 [Note]: 7003 1
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000021.087
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000043
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000000
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000001
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000002
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000003
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000004
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000005
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000006
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000007
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000008
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000009
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000010
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000011
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000014
  06/01/06 10:07:52 [Note]: 10002 3
  06/01/06 10:07:52 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000015.08O
  06/01/06 10:07:53 [Note]: 10002 3
  06/01/06 10:07:53 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000016.07I
  06/01/06 10:07:53 [Note]: 10002 3
  06/01/06 10:07:53 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000017.08P
  06/01/06 10:07:53 [Note]: 10002 3
  06/01/06 10:07:53 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000019.08H
  06/01/06 10:07:53 [Note]: 10002 3
  06/01/06 10:07:53 [Info]: Hidden file: c:\RECYCLER\NPROTECT\00000020
  06/01/06 10:07:53 [Note]: 10002 3
  06/01/06 10:07:53 [Note]: 10002 2
  06/01/06 10:07:53 [Note]: 10002 2
  06/01/06 10:09:09 [Note]: 7007 0
  
  Next?????

  0
• Shaba

  June 2006 edited June 2006

  Follow these instructions -> http://www.short-media.com/forum/showthread.php?t=42651
  
  After that, please send a fresh HjT log along with contents of
  C:\Look2Me-Destroyer.txt

  0
• djblacksmith

  June 2006 edited June 2006

  Slight glitch ... I did what you said and have followed directions to the letter. However, when I run Look2Me it does what it says (disappears) but has never "come back." I ran it first in SafeMode that way, and it never came back (over 10 min). Rebooted in Normal mode and the same occurred (now 15 min since it disappeared). Any hints?

  0
• djblacksmith

  June 2006 edited June 2006

  Okay ... got that Look2Me-Destroyer from another source and it worked.
  
  Here are the Look2Me-Destoryer and HJT logs ...
  
  Look2Me-Destroyer V1.0.12
  
  Scanning for infected files.....
  Scan started at 6/1/2006 4:07:15 PM
  
  
  Attempting to delete infected files...
  
  Making registry repairs.
  
  
  Restoring Windows certificates.
  
  Replaced hosts file with default windows hosts file
  
  
  Restoring SeDebugPrivilege for Administrators - Succeeded
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 4:35:30 PM, on 6/1/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\S24EvMon.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  C:\WINDOWS\system32\nvsvc32.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  C:\WINDOWS\System32\RegSrvc.exe
  C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  C:\WINDOWS\System32\1XConfig.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Documents and Settings\KDB\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupdate.microsoft.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - Default URLSearchHook is missing
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {3EFB4B77-1E7E-478F-8018-90BBC444F23F} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {6BD3C5E5-8049-46A5-93A8-B65D3422CE46} - (no file)
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
  O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
  O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148953347191
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: Sebring - c:\WINDOWS\System32\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: GBPoll - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe

  0
• djblacksmith

  June 2006 edited June 2006

  Just a note ... I ran the laptop we're working on in SafeMode with Network (Internet) access for awhile. I was on the Internet for quite some time and NO pop-ups came up. I rebooted it after awhile back to Normal Mode and did not disconnect the Internet connection. As soon as I opened a Internet Explorer ... viola ... up came a plethora of popups! Don't know if that's helpful or not.
  
  Thanks so much for your time with this.
  
  ~David

  0
• Shaba

  June 2006 edited June 2006

  Ok, let's try this:
  
  You may want to print out these instructions for reference, since you will have to restart your computer during the fix.
  
  Please download AproposFix from here:
  http://swandog46.geekstogo.com/aproposfix.exe
  
  Save it to your desktop but do NOT run it yet.
  
  Then please reboot your computer in Safe Mode by doing the following:
  1) Restart your computer
  2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3) Instead of Windows loading as normal, a menu should appear
  4) Select the first option, to run Windows in Safe Mode.
  
  
  Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.
  
  When the tool is finished, please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder.

  0
• djblacksmith

  June 2006 edited June 2006

  Done ... AproposFix log and fresh HJT log follows ...
  
  Log of AproposFix v1.1
  
  ************
  
  Running from directory:
  C:\Documents and Settings\KDB\Desktop\aproposfix
  
  ************
  
  
  
  Registry entries found:
  
  
  ************
  
  No service found!
  
  Removing hidden folder:
  No folder found!
  
  Deleting files:
  
  
  Backing up files:
  Done!
  
  Removing registry entries:
  
  REGEDIT4
  
  
  Done!
  
  Finished!
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 7:19:43 AM, on 6/2/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\S24EvMon.exe
  C:\WINDOWS\system32\ZCfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  C:\WINDOWS\system32\nvsvc32.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  C:\WINDOWS\System32\RegSrvc.exe
  C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\System32\1XConfig.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Documents and Settings\KDB\Desktop\HijackThis.exe
  C:\PROGRA~1\TRENDM~1\INTERN~2\TSC.EXE
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupdate.microsoft.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - Default URLSearchHook is missing
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {3EFB4B77-1E7E-478F-8018-90BBC444F23F} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {6BD3C5E5-8049-46A5-93A8-B65D3422CE46} - (no file)
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
  O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
  O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148953347191
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: Sebring - c:\WINDOWS\System32\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
  O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: GBPoll - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
  O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
  O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe

  0
• Shaba

  June 2006 edited June 2006

  Sorry to say, but I must give up now I don't know what to do next.
  
  But don't worry, post your Hjt log to one of these forums:
  
  http://www.bleepingcomputer.com
  http://www.geekstogo.com
  http://www.spywareinfo.com
  
  You'll get help there, there are experts

  0