Toolbar888 {Solved}

Comments

• jmoney3457 Maine

  September 2006 edited September 2006

  hi winged, lets take care of the new.net first-->Please download LSP-Fix from the following link and save it to a location you can find later if necessary.
  
  LSP-Fix Download Link
  
  To remove New.net. please go to Add/Remove Programs via Control Panel, look for and remove New.Net. If you can't find it, then please go here and follow the removal instructions in Procedure 4 at the bottom of the page.
  
  If you can not connect to the Internet after removing New.net, please run the LSP-Fix program I had you download earlier, and click on the finish button. Reboot and you should be able to get back on & please post new hjt log after doing the above:)

  0
• onewinged

  September 2006 edited September 2006

  Logfile of HijackThis v1.99.1
  Scan saved at 9:57:32 PM, on 9/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5700.0006)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  c:\Toshiba\IVP\swupdate\swupdtmr.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
  C:\Program Files\Toshiba\Tvs\TvsTray.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  C:\toshiba\ivp\ism\pinger.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\WMPNSCFG.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\WINDOWS\system32\igfxsrvc.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Aqua Dock] C:\Program Files\Aqua Dock\Aqua Dock.exe
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
  O4 - Startup: Folding@Home 5.03.lnk = ?
  O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
  O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
  O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

  0
• onewinged

  September 2006 edited September 2006

  everything seems to be clear now. does my logfile look clean?

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  the new.net is removed but im afraid your not in the clear yet winged but dont worry we'll get you there;) please do the following-->First download ewido anti-spyware from HERE and save that file to your desktop.

  1. Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
  2. Once the setup is complete you will need to run ewido and update the definition files.
  3. On the main screen select the "Update" icon then click "Start Update". The update will start and a progress bar will show the updates being installed.
  4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  6. Under "Reports"
     • Select "Automatically generate report after every scan"
     • Un-Select "Only if threats were found"

  Close ewido anti-spyware and reboot your computer into Safe Mode.

  1. Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
     IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess.
  2. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan"
  3. Ewido will now begin the scanning process, be patient this may take a little time.
  4. Ewido will list any infections found on the left hand side. When the scan has finished, it should automatically set the recommended action to Quarantine--if not click on Recommended Action and set it there. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side.
  5. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
  6. Close ewido & post that report in your next reply

  0
• onewinged

  September 2006 edited September 2006

  it found a few things and cleaned them out here is the file. and again thanks for helping me. I hope everything is cleaned.
  
  
  
  C:\WINDOWS\NDNuninstall5_64.exe -> Adware.NewDotNet : Cleaned.
  C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned.
  HKU\S-1-5-21-4153700036-940924962-875890649-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned.
  :mozilla.13:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.14:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.15:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
  C:\Documents and Settings\Cody Galbraith\Cookies\cody_galbraith@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
  :mozilla.10:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
  :mozilla.11:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
  :mozilla.12:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
  :mozilla.7:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
  C:\Documents and Settings\Cody Galbraith\Cookies\cody_galbraith@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
  :mozilla.22:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
  :mozilla.16:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Com : Cleaned.
  :mozilla.8:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
  :mozilla.31:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
  :mozilla.32:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
  :mozilla.33:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
  :mozilla.39:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
  :mozilla.23:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.24:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.25:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.26:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  :mozilla.27:C:\Documents and Settings\Cody Galbraith\Application Data\Netscape\NSB\Profiles\04oh627e.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
  
  
  ::Report end

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  good job with that lets continue please follow these steps (in order):
  Make sure that you can see hidden files.

  1. Click Start.
  2. Click My Computer.
  3. Select the Tools menu and click Folder Options.
  4. Select the View Tab.
  5. Under the Hidden files and folders heading select Show hidden files and folders.
  6. Uncheck the Hide protected operating system files (recommended) option.
  7. Click Yes to confirm.
  8. Uncheck the Hide file extensions for known file types.
  9. Click OK.

  
  then,Please go HERE to run Panda's ActiveScan

  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

  0
• onewinged

  September 2006 edited September 2006

  here it is
  
  Incident Status Location
  
  Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\cbxutsp.dll

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  Please download VundoFix.exe to your desktop.

  • Double-click VundoFix.exe to run it.
  • Put a check next to Run VundoFix as a task.
  • You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
  • When VundoFix re-opens, click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will shutdown your computer, click OK.
  • Turn your computer back on.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.

  0
• onewinged

  September 2006 edited September 2006

  could not get vundo fix to produce a log.
  here is my hjt log
  
  Logfile of HijackThis v1.99.1
  Scan saved at 7:53:25 PM, on 9/12/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5700.0006)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  c:\Toshiba\IVP\swupdate\swupdtmr.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\Program Files\Windows Media Player\WMPNetwk.exe
  C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\Toshiba\Tvs\TvsTray.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  C:\toshiba\ivp\ism\pinger.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Aqua Dock\Aqua Dock.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\WMPNSCFG.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Aqua Dock] C:\Program Files\Aqua Dock\Aqua Dock.exe
  O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
  O4 - Startup: Folding@Home 5.03.lnk = ?
  O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
  O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
  O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  which part of vundo stopped? did it not come back up after running it as a task?

  0
• onewinged

  September 2006 edited September 2006

  when it fist scanned it was ok, then it had to reboot so i did that. then it wanted me to do a scan on reboot so i clicked ok and it had been 30 minutes and it was taking way longer than before so i stoped it. should i try to do it again?

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  lets try this, please follow my above steps from the vundo fix instructions except for running it as a task start with "scan for vundo" and lemme know how that goes

  0
• onewinged

  September 2006 edited September 2006

  it still did the same thing. when my computer reboots, the scan lags horribly and it goes fro a looonnnng time and doesnt stop. thanks for being patiant with me

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  lets try this and no problem winged:
  
  
  Download Avenger from here:
  http://swandog46.geekstogo.com/
  
  Open the program. Check the 'Input script manually' option.
  Click the Magnifying Glass icon.
  In the box that opens, paste this: (only copy/paste whats in the CODE box and don't copy the word "code" thats above the code box ONLY whats in the actual box)
  

  [b]Files to delete:[/b]
  [color=#CC0000]C:\WINDOWS\system32\cbxutsp.dll[/color]
  

  and click 'Done'
  
  Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC.
  
  Post the Avenger output.txt, which you can find at C:\Avenger\.txt

  0
• onewinged

  September 2006 edited September 2006

  It does not look like the scan went well. Here is the file you asked for:
  
  Logfile of The Avenger version 1, by Swandog46
  Running from registry key:
  \Registry\Machine\System\CurrentControlSet\Services\dgbuuxoa
  
  *******************
  
  Script file located at: \??\C:\Program Files\lkthqjfh.txt
  Script file opened successfully.
  
  Script file read successfully
  
  Backups directory opened successfully at C:\Avenger
  
  *******************
  
  Beginning to process script file:
  
  
  
  File C:\WINDOWS\system32\cbxutsp.dll not found!
  Deletion of file C:\WINDOWS\system32\cbxutsp.dll failed!
  
  Could not process line:
  C:\WINDOWS\system32\cbxutsp.dll
  Status: 0xc0000034
  
  
  Completed script processing.
  
  *******************
  
  Finished! Terminate.
  
  
  
  
  
  
  
  
  If it is not found doesnt that mean it has been deleted?
  Thanks again for being patiant

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  weird, could you please rename "hijackthis!" to something else like hijackthis199.exe or of that sort because the latest variant of vundo tries to "Hide" its files from detection if it knows HJT is on the victims computer then after doing that post new hjt log

  0
• onewinged

  September 2006 edited September 2006

  hmm ok here it is:
  
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 3:51:07 PM, on 9/14/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5700.0006)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  c:\Toshiba\IVP\swupdate\swupdtmr.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
  C:\Program Files\Toshiba\Tvs\TvsTray.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  C:\toshiba\ivp\ism\pinger.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Aqua Dock\Aqua Dock.exe
  C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\WMPNSCFG.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
  C:\Program Files\Microsoft Works\WkDStore.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
  C:\Program Files\Microsoft Works\wkswp.exe
  C:\Program Files\Microsoft Works\wkgdcach.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\HijackThis\HJTV1.1.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
  O4 - HKLM\..\Run: [Aqua Dock] C:\Program Files\Aqua Dock\Aqua Dock.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
  O4 - Startup: Folding@Home 5.03.lnk = ?
  O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
  O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
  O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
  O11 - Options group: [INTERNATIONAL] International*
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  Please do an online scan with Kaspersky WebScanner
  
  Click on Kaspersky Online Scanner
  
  You will be promted to install an ActiveX component from Kaspersky, Click Yes.

  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
    
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)

  • Scan Options:

  Scan Archives
  Scan Mail Bases
  
  [*]Click OK
  [*]Now under select a target to scan:

  Select

  My Computer
  
  [*]This will program will start and scan your system.
  [*]The scan will take a while so be patient and let it run.
  [*]Once the scan is complete it will display if your system has been infected.

  • Now click on the Save as Text button:

  [*]Save the file to your desktop.
  [*]Copy and paste that information in your next post.
  

  0
• onewinged

  September 2006 edited September 2006

  Thursday, September 14, 2006 8:55:03 PM
  Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
  Kaspersky Online Scanner version: 5.0.83.0
  Kaspersky Anti-Virus database last update: 15/09/2006
  Kaspersky Anti-Virus database records: 223444
  Scan Settings
  Scan using the following antivirus database extended
  Scan Archives true
  Scan Mail Bases true
  Scan Target My Computer
  C:\
  D:\
  Scan Statistics
  Total number of scanned objects 75261
  Number of viruses found 2
  Number of infected objects 2 / 0
  Number of suspicious objects 0
  Duration of the scan process 00:42:10
  
  Infected Object Name Virus Name Last Action
  C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Cookies\index.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Local Settings\History\History.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\Cody Galbraith\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
  C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
  C:\System Volume Information\_restore{B992AC1F-1409-469D-9617-074D63E04B5E}\RP37\A0024498.dll Object is locked skipped
  C:\System Volume Information\_restore{B992AC1F-1409-469D-9617-074D63E04B5E}\RP37\A0024517.exe Object is locked skipped
  C:\System Volume Information\_restore{B992AC1F-1409-469D-9617-074D63E04B5E}\RP77\A0039779.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
  C:\System Volume Information\_restore{B992AC1F-1409-469D-9617-074D63E04B5E}\RP77\A0039780.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped
  C:\System Volume Information\_restore{B992AC1F-1409-469D-9617-074D63E04B5E}\RP92\change.log Object is locked skipped
  C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
  C:\WINDOWS\SchedLgU.Txt Object is locked skipped
  C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
  C:\WINDOWS\Sti_Trace.log Object is locked skipped
  C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
  C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
  C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\default Object is locked skipped
  C:\WINDOWS\system32\config\default.LOG Object is locked skipped
  C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
  C:\WINDOWS\system32\config\SAM Object is locked skipped
  C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
  C:\WINDOWS\system32\config\software Object is locked skipped
  C:\WINDOWS\system32\config\software.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\system Object is locked skipped
  C:\WINDOWS\system32\config\system.LOG Object is locked skipped
  C:\WINDOWS\system32\h323log.txt Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
  C:\WINDOWS\wiadebug.log Object is locked skipped
  C:\WINDOWS\wiaservc.log Object is locked skipped
  C:\WINDOWS\WindowsUpdate.log Object is locked skipped
  Scan process completed.

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  Please run the BitDefender online scan from here; http://www.bitdefender.com/scan8/ie.html
  You will need to allow an active x install for the scan to run.
  Leave the scanning options at default and press "click here to scan"
  When finished scanning, click on "click here to export the scan report"
  Save it to your desktop, at "file name" type in "bdscan" then click save.
  Please attach the bdscan.html file to your next post along with a new hijackthis log.

  0
• onewinged

  September 2006 edited September 2006

  BitDefender Online Scanner
  
  
  
  Scan report generated at: Fri, Sep 15, 2006 - 16:35:10
  
  
  
  
  
  Scan path: C:\;D:\;
  
  
  
  
  
  
  
  Statistics
  
  Time
  00:51:44
  
  Files
  375610
  
  Folders
  4736
  
  Boot Sectors
  3
  
  Archives
  7411
  
  Packed Files
  35211
  
  
  
  
  Results
  
  Identified Viruses
  0
  
  Infected Files
  0
  
  Suspect Files
  0
  
  Warnings
  0
  
  Disinfected
  0
  
  Deleted Files
  0
  
  
  
  
  Engines Info
  
  Virus Definitions
  454443
  
  Engine build
  AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
  
  Scan plugins
  13
  
  Archive plugins
  38
  
  Unpack plugins
  6
  
  E-mail plugins
  6
  
  System plugins
  1
  
  
  
  
  Scan Settings
  
  First Action
  Disinfect
  
  Second Action
  Delete
  
  Heuristics
  Yes
  
  Enable Warnings
  Yes
  
  Scanned Extensions
  *;
  
  Exclude Extensions
  
  
  Scan Emails
  Yes
  
  Scan Archives
  Yes
  
  Scan Packed
  Yes
  
  Scan Files
  Yes
  
  Scan Boot
  Yes
  
  
  
  
  Scanned File
  Status
  
  No virus found.

  0
• onewinged

  September 2006 edited September 2006

  Logfile of HijackThis v1.99.1
  Scan saved at 6:55:45 PM, on 9/15/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5700.0006)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  c:\Toshiba\IVP\swupdate\swupdtmr.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
  C:\Program Files\Toshiba\Tvs\TvsTray.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  C:\toshiba\ivp\ism\pinger.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Aqua Dock\Aqua Dock.exe
  C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\WMPNSCFG.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\HijackThis\HJTV1.1.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
  O4 - HKLM\..\Run: [Aqua Dock] C:\Program Files\Aqua Dock\Aqua Dock.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
  O4 - Startup: Folding@Home 5.03.lnk = ?
  O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
  O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
  O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O11 - Options group: [INTERNATIONAL] International*
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  nothing there looking good please do this: Open HijackThis, click Config, click Misc Tools
  Click "Open Uninstall Manager"
  Click "Save List" (generates uninstall_list.txt)
  Click Save, copy and paste the results in your next post.

  0
• onewinged

  September 2006 edited September 2006

  AbsoluteShield File Shredder
  Ad-Aware SE Personal
  Adobe Acrobat 5.0
  Adobe Flash Player 9 ActiveX
  Adobe Shockwave Player
  America Online (Choose which version to remove)
  Aqua Dock
  ArcSoft Software Suite
  AT&T Connection Services Manager
  AVG Free Edition
  Bluetooth Stack for Windows by Toshiba
  CD/DVD Drive Acoustic Silencer
  CDBurnerXP Pro 3
  DivX
  DivX Converter
  DivX Player
  DivX Web Player
  Download Accelerator Plus (DAP)
  DVD-RAM Driver
  Folding@Home
  GameSpy Arcade
  Google Earth
  Google Toolbar for Internet Explorer
  Google Video Player
  HijackThis 1.99.1
  Hotfix for Windows Media Format SDK (KB902344)
  Hotfix for Windows XP (KB894871)
  Hotfix for Windows XP (KB895200)
  Hotfix for Windows XP (KB896344)
  Hotfix for Windows XP (KB914440)
  Hotfix for Windows XP (KB915865)
  HP Deskjet 3900 series
  HP Extended Capabilities 5.0
  HP Image Zone Express
  HP Imaging Device Functions 5.0
  HP Software Update
  HP Solution Center & Imaging Support Tools 5.0
  Intel(R) Graphics Media Accelerator Driver for Mobile
  Intel(R) PROSet/Wireless Software
  InterVideo WinDVD Creator 2
  InterVideo WinDVD for TOSHIBA
  J2SE Runtime Environment 5.0 Update 8
  Kaspersky Online Scanner
  Learn2 Player (Uninstall Only)
  LimeWire 4.12.6
  Logon Loader
  Macromedia Flash Player 8
  Magic DVD Ripper V4.0
  Marine Sharpshooter
  mCore
  mDrWiFi
  mHelp
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB886903)
  Microsoft .NET Framework 2.0
  Microsoft Base Smart Card Cryptographic Service Provider Package
  Microsoft Encarta Encyclopedia Standard 2006
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Office OneNote 2003
  Microsoft User-Mode Driver Framework Feature Pack 1.0 (Beta2)
  Microsoft Word 2002
  Microsoft Works
  mIWA
  mIWCA
  mLogView
  mMHouse
  Mozilla Firefox (1.5.0.6)
  Mozilla Thunderbird (1.5)
  mPfMgr
  mPfWiz
  mProSafe
  MSN
  Mu
  mWlsSafe
  mXML
  mZConfig
  NaturalMotion endorphin 2.6.1
  Netscape Browser (remove only)
  Nintendo DS - GBA Max Drive
  Opera 9.01
  Project64 1.6
  Pure Networks Port Magic
  Quicken 2005
  QuickTime
  RealPlayer
  Rhapsody Player Engine
  SafeCast Shared Components
  SD Secure Module
  Security Update for Microsoft .NET Framework 2.0 (KB917283)
  Security Update for Windows Media Player (KB911564)
  Security Update for Windows Media Player 10 (KB911565)
  Security Update for Windows Media Player 10 (KB917734)
  Security Update for Windows XP (KB883939)
  Security Update for Windows XP (KB890046)
  Security Update for Windows XP (KB893066)
  Security Update for Windows XP (KB893756)
  Security Update for Windows XP (KB896358)
  Security Update for Windows XP (KB896422)
  Security Update for Windows XP (KB896423)
  Security Update for Windows XP (KB896424)
  Security Update for Windows XP (KB896428)
  Security Update for Windows XP (KB899587)
  Security Update for Windows XP (KB899591)
  Security Update for Windows XP (KB900725)
  Security Update for Windows XP (KB901017)
  Security Update for Windows XP (KB901214)
  Security Update for Windows XP (KB902400)
  Security Update for Windows XP (KB904706)
  Security Update for Windows XP (KB905414)
  Security Update for Windows XP (KB905749)
  Security Update for Windows XP (KB908519)
  Security Update for Windows XP (KB911562)
  Security Update for Windows XP (KB911567)
  Security Update for Windows XP (KB911927)
  Security Update for Windows XP (KB912919)
  Security Update for Windows XP (KB913580)
  Security Update for Windows XP (KB914388)
  Security Update for Windows XP (KB914389)
  Security Update for Windows XP (KB917159)
  Security Update for Windows XP (KB917344)
  Security Update for Windows XP (KB917422)
  Security Update for Windows XP (KB917953)
  Security Update for Windows XP (KB918439)
  Security Update for Windows XP (KB918899)
  Security Update for Windows XP (KB919007)
  Security Update for Windows XP (KB920214)
  Security Update for Windows XP (KB920670)
  Security Update for Windows XP (KB920683)
  Security Update for Windows XP (KB920685)
  Security Update for Windows XP (KB921398)
  Security Update for Windows XP (KB921883)
  Security Update for Windows XP (KB922616)
  SMSC IrCC V5.1.3600.5 SP2
  Sonic DLA
  Sonic RecordNow!
  SoundMAX
  Spybot - Search & Destroy 1.4
  SpywareBlaster v3.5.1
  Synaptics Pointing Device Driver
  Texas Instruments PCIxx21/x515 drivers.
  TOSHIBA Assist
  TOSHIBA ConfigFree
  TOSHIBA Controls
  TOSHIBA Hotkey Utility
  TOSHIBA PC Diagnostic Tool
  TOSHIBA Power Saver
  TOSHIBA SD Memory Card Format
  TOSHIBA Software Modem
  TOSHIBA Software Upgrades
  TOSHIBA Speech System Applications
  TOSHIBA Speech System SR Engine(U.S.) Version1.0
  TOSHIBA Speech System TTS Engine(U.S.) Version1.0
  Toshiba Tbiosdrv Driver
  TOSHIBA TouchPad ON/Off Utility
  TOSHIBA Utilities
  TOSHIBA Virtual Sound
  TOSHIBA Zooming Utility
  Touch and Launch
  Trillian
  Update for Windows XP (KB894391)
  Update for Windows XP (KB898461)
  Update for Windows XP (KB900485)
  Update for Windows XP (KB904942)
  Update for Windows XP (KB908531)
  Update for Windows XP (KB910437)
  Update for Windows XP (KB911280)
  Update for Windows XP (KB916595)
  Update for Windows XP (KB920872)
  Update for Windows XP (KB922582)
  URGE
  Viewpoint Media Player
  WeatherBug
  Windows Defender Signatures
  Windows Installer 3.1 (KB893803)
  Windows Internet Explorer 7
  Windows Media Connect
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 11
  Windows Media Player 11
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB884018
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB885855
  Windows XP Hotfix - KB885884
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB889673
  Windows XP Hotfix - KB890047
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB893056
  Windows XP Hotfix - KB893086
  WinMPG VideoConvert 6.5.2
  Yahoo! Messenger

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  winged, I would HIGHLY recommend to uninstall the following in red-->

  1. Learn2 Player (Uninstall Only)
  2. LimeWire 4.12.6
  3. Viewpoint Media Player
  4. WeatherBug

  then reboot and post new hjt log along with how the pc is running and if you did decide to uninstall the listed above

  0
• onewinged

  September 2006 edited September 2006

  ok i went ahead and unistalled 2 of those. i did not uninstll limewire or weatherbug though. i use them too often.
  anyways, here is the logfile
  
  Logfile of HijackThis v1.99.1
  Scan saved at 11:53:00 PM, on 9/15/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5700.0006)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  c:\Toshiba\IVP\swupdate\swupdtmr.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
  C:\Program Files\Toshiba\Tvs\TvsTray.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  C:\toshiba\ivp\ism\pinger.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Aqua Dock\Aqua Dock.exe
  C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\WMPNSCFG.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\HijackThis\HJTV1.1.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
  O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
  O4 - HKLM\..\Run: [Aqua Dock] C:\Program Files\Aqua Dock\Aqua Dock.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
  O4 - Startup: Folding@Home 5.03.lnk = ?
  O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
  O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
  O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O11 - Options group: [INTERNATIONAL] International*
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

  0
• onewinged

  September 2006 edited September 2006

  my pc is problem free

  0
• jmoney3457 Maine

  September 2006 edited September 2006

  ok, but just remember winged limewire is a P2P program and as with any p2p it makes your system very vunerable to malware but as long as you have good protection (AV,anti spyware, firewall etc) you should be fine for the most part but just wanted to let you know that:
  Your log is clean! Great job!
  
  Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and enable system restore to make sure there are no infected files found in a restore point.
  
  You can find instructions on how to enable and enable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
  Next,
  
  This process will clean out your Temp files and your Temporary Internet Files. Please do both steps:
  
  Step 1: Delete Temp Files
  To clean out your temp files, click on Start and then run, and type %temp% and press the ok button.
  
  This should open up the temp directory that your machine uses. Please delete all files that are found there. If you get an error when deleting a file, skip that file and delete all the others. If you had trouble deleting a file, reboot into Safe Mode and follow this step again. You should now be able to delete all the files.
  
  Step 2: Delete Temporary Internet Files
  Now I want you to open up Internet Explorer, and click on the Tools menu and then Internet Options. At the General tab, which should be the first tab you are currently on, click on the Delete Files button and put a checkmark in Delete offline content. Then press the OK button. This may take quite a while, so do not be alarmed with how long it takes. When it is done, your Temporary Internet Files will now be deleted.
  
  Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:
  

  Simple and easy ways to keep your computer safe and secure on the Internet

  0