help romove trojan

Comments

• Trogan London, UK

  December 2008 edited December 2008

  Hi,
  
  Before we begin, I need you to disable Spybots TeaTimer and Windows Defender temporarily as they will prevent the fixes below from working. See HERE on how to do this.
  
  Once disabled, do the following...
  
  1. Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
  This program is for XP and Windows 2000 only!

  • Double-click ATF Cleaner.exe to open it.
  • Under Main select the following:
    • Windows Temp
    • Current User Temp
    • All Users Temp
    • Temporary Internet Files
    • Java Cache

  *The other boxes are optional*
  Then click the Empty Selected button.
  
  Click Exit on the Main menu to close the program.
  
  2. Open HijackThis
  - Click the Do a system scan only button
  - Check the following entries (below)
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
  
  O2 - BHO: (no name) - {18D37648-863A-4D6D-8828-549D57A287F2} - (no file)
  O2 - BHO: (no name) - {357A131E-5209-4456-BFDB-FEDA9E801B24} - (no file)
  O2 - BHO: (no name) - {3A860DAF-B0A1-4EE8-981A-B4F772FDDFF1} - C:\WINDOWS\system32\khfFUKdB.dll (file missing)
  
  O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
  O2 - BHO: (no name) - {90A5165E-3A0E-4146-9457-E19AD484B71C} - (no file)
  
  O2 - BHO: (no name) - {E2E49F45-1FB0-4C5F-B489-0F3BA42447E2} - (no file)
  
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  
  - Close ALL open windows (especially Internet Explorer!)
  - Click Fix Checked
  Close HiajckThis
  
  3. Please download Malwarebytes' Anti-Malware to your desktop.
  

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt

  
  4. I need to see another log from HijackThis.

  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.

  
  5. Please post the following...
  
  Uninstall list
  Malwarebytes log
  New HijackThis log

  0
• heyhi

  December 2008 edited December 2008

  thanks alot for helping i aprciate it when disabling tea timer ithere was no teatimer at the startup section and for win def in control panel there was only windows security so i couldent figure that step
  on hijackthis i fixed everything except O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
  cause it wasent there u did every thing else
  
  Malwarebytes' Anti-Malware 1.31
  Database version: 1543
  Windows 5.1.2600 Service Pack 2
  12/25/2008 10:52:35 AM
  mbam-log-2008-12-25 (10-52-35).txt
  Scan type: Full Scan (C:\|D:\|)
  Objects scanned: 153389
  Time elapsed: 1 hour(s), 59 minute(s), 11 second(s)
  Memory Processes Infected: 0
  Memory Modules Infected: 0
  Registry Keys Infected: 11
  Registry Values Infected: 0
  Registry Data Items Infected: 1
  Folders Infected: 1
  Files Infected: 1
  Memory Processes Infected:
  (No malicious items detected)
  Memory Modules Infected:
  (No malicious items detected)
  Registry Keys Infected:
  HKEY_CLASSES_ROOT\main.bho (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\main.bho.1 (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\Interface\{986a8ac1-ab4d-4f41-9068-4b01c0197867} (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\Typelib\{8e3c68cd-f500-4a2a-8cb9-132bb38c3573} (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\AppID\{a0e1054b-01ee-4d57-a059-4d99f339709f} (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
  Registry Values Infected:
  (No malicious items detected)
  Registry Data Items Infected:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.Agent) -> Data: digeste.dll -> Quarantined and deleted successfully.
  Folders Infected:
  C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.
  Files Infected:
  C:\WINDOWS\system32\digeste.dll (Trojan.Agent) -> Quarantined and deleted successfully.
  
  
  Adobe Flash Player ActiveX
  Adobe Reader 7.0.9
  AIM 6
  AIM Toolbar 5.0
  albelli photo book creator express
  albelli photo books
  AML Free Registry Cleaner 4.13
  AnyDVD
  AOL You've Got Pictures Screensaver
  Apple Mobile Device Support
  Apple Software Update
  ATI Display Driver
  AVG Free 8.0
  CloneDVD2
  Google Earth
  Google Toolbar for Internet Explorer
  Google Updater
  High Definition Audio Driver Package - KB888111
  HijackThis 2.0.2
  Hotfix for Windows Media Format 11 SDK (KB929399)
  Hotfix for Windows Media Player 11 (KB939683)
  Hotfix for Windows XP (KB896256)
  Hotfix for Windows XP (KB906569)
  Hotfix for Windows XP (KB909394)
  Hotfix for Windows XP (KB910728)
  Hotfix for Windows XP (KB914906)
  Hotfix for Windows XP (KB926239)
  Hotfix for Windows XP (KB935448)
  Hotfix for Windows XP (KB952287)
  HP Image Zone 4.0
  HP Software Update
  iTunes
  J2SE Runtime Environment 5.0 Update 2
  LimeWire 4.16.6
  Malwarebytes' Anti-Malware
  McAfee SiteAdvisor
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft .NET Framework 2.0 Service Pack 1
  Microsoft ActiveSync
  Microsoft Compression Client Pack 1.0 for Windows XP
  Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
  Microsoft Office Standard Edition 2003
  Microsoft User-Mode Driver Framework Feature Pack 1.0
  Microsoft Visual C++ 2005 Redistributable
  MIKSOFT Mobile AMR converter
  MSXML 4.0 SP2 (KB936181)
  MSXML 4.0 SP2 (KB954430)
  Napster Burn Engine
  Photosmart 320,370,7400,8100,8400 Series
  QuickTime
  RealPlayer Basic
  REALTEK GbE & FE Ethernet PCI NIC Driver
  Realtek High Definition Audio Driver
  Security Update for Windows Internet Explorer 8 (KB960714)
  Security Update for Windows Media Player (KB911564)
  Security Update for Windows Media Player (KB952069)
  Security Update for Windows Media Player 10 (KB911565)
  Security Update for Windows Media Player 10 (KB917734)
  Security Update for Windows Media Player 10 (KB936782)
  Security Update for Windows Media Player 11 (KB936782)
  Security Update for Windows Media Player 11 (KB954154)
  Security Update for Windows Media Player 6.4 (KB925398)
  Security Update for Windows XP (KB896358)
  Security Update for Windows XP (KB896423)
  Security Update for Windows XP (KB896424)
  Security Update for Windows XP (KB896688)
  Security Update for Windows XP (KB899589)
  Security Update for Windows XP (KB900725)
  Security Update for Windows XP (KB901017)
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB902400)
  Security Update for Windows XP (KB904706)
  Security Update for Windows XP (KB905414)
  Security Update for Windows XP (KB905749)
  Security Update for Windows XP (KB905915)
  Security Update for Windows XP (KB908519)
  Security Update for Windows XP (KB908531)
  Security Update for Windows XP (KB911280)
  Security Update for Windows XP (KB911562)
  Security Update for Windows XP (KB911567)
  Security Update for Windows XP (KB911927)
  Security Update for Windows XP (KB912812)
  Security Update for Windows XP (KB912919)
  Security Update for Windows XP (KB913433)
  Security Update for Windows XP (KB913446)
  Security Update for Windows XP (KB913580)
  Security Update for Windows XP (KB914388)
  Security Update for Windows XP (KB914389)
  Security Update for Windows XP (KB916281)
  Security Update for Windows XP (KB917159)
  Security Update for Windows XP (KB917344)
  Security Update for Windows XP (KB917537)
  Security Update for Windows XP (KB917953)
  Security Update for Windows XP (KB918118)
  Security Update for Windows XP (KB918439)
  Security Update for Windows XP (KB919007)
  Security Update for Windows XP (KB920213)
  Security Update for Windows XP (KB920670)
  Security Update for Windows XP (KB920683)
  Security Update for Windows XP (KB920685)
  Security Update for Windows XP (KB922819)
  Security Update for Windows XP (KB923191)
  Security Update for Windows XP (KB923414)
  Security Update for Windows XP (KB923689)
  Security Update for Windows XP (KB923980)
  Security Update for Windows XP (KB924270)
  Security Update for Windows XP (KB924496)
  Security Update for Windows XP (KB924667)
  Security Update for Windows XP (KB925902)
  Security Update for Windows XP (KB926255)
  Security Update for Windows XP (KB926436)
  Security Update for Windows XP (KB927779)
  Security Update for Windows XP (KB927802)
  Security Update for Windows XP (KB928255)
  Security Update for Windows XP (KB928843)
  Security Update for Windows XP (KB929123)
  Security Update for Windows XP (KB930178)
  Security Update for Windows XP (KB931261)
  Security Update for Windows XP (KB931784)
  Security Update for Windows XP (KB932168)
  Security Update for Windows XP (KB933729)
  Security Update for Windows XP (KB935839)
  Security Update for Windows XP (KB935840)
  Security Update for Windows XP (KB936021)
  Security Update for Windows XP (KB938127)
  Security Update for Windows XP (KB938464)
  Security Update for Windows XP (KB938829)
  Security Update for Windows XP (KB941202)
  Security Update for Windows XP (KB941568)
  Security Update for Windows XP (KB941569)
  Security Update for Windows XP (KB941644)
  Security Update for Windows XP (KB941693)
  Security Update for Windows XP (KB943055)
  Security Update for Windows XP (KB943460)
  Security Update for Windows XP (KB943485)
  Security Update for Windows XP (KB944338)
  Security Update for Windows XP (KB944533)
  Security Update for Windows XP (KB944653)
  Security Update for Windows XP (KB945553)
  Security Update for Windows XP (KB946026)
  Security Update for Windows XP (KB946648)
  Security Update for Windows XP (KB947864)
  Security Update for Windows XP (KB948590)
  Security Update for Windows XP (KB948881)
  Security Update for Windows XP (KB950749)
  Security Update for Windows XP (KB950759)
  Security Update for Windows XP (KB950760)
  Security Update for Windows XP (KB950762)
  Security Update for Windows XP (KB950974)
  Security Update for Windows XP (KB951066)
  Security Update for Windows XP (KB951376)
  Security Update for Windows XP (KB951376-v2)
  Security Update for Windows XP (KB951698)
  Security Update for Windows XP (KB951748)
  Security Update for Windows XP (KB952954)
  Security Update for Windows XP (KB953838)
  Security Update for Windows XP (KB953839)
  Security Update for Windows XP (KB954211)
  Security Update for Windows XP (KB954600)
  Security Update for Windows XP (KB955069)
  Security Update for Windows XP (KB956391)
  Security Update for Windows XP (KB956802)
  Security Update for Windows XP (KB956803)
  Security Update for Windows XP (KB956841)
  Security Update for Windows XP (KB957095)
  Security Update for Windows XP (KB957097)
  Security Update for Windows XP (KB958644)
  Soft Data Fax Modem with SmartCP
  UltimateBet
  UltimateBuddy
  Update for Windows XP (KB898461)
  Update for Windows XP (KB900485)
  Update for Windows XP (KB910437)
  Update for Windows XP (KB912945)
  Update for Windows XP (KB916595)
  Update for Windows XP (KB920872)
  Update for Windows XP (KB922582)
  Update for Windows XP (KB927891)
  Update for Windows XP (KB930916)
  Update for Windows XP (KB936357)
  Update for Windows XP (KB938828)
  Update for Windows XP (KB942763)
  Update for Windows XP (KB942840)
  Update for Windows XP (KB951072-v2)
  Update for Windows XP (KB955839)
  Windows Backup Utility
  Windows Defender
  Windows Internet Explorer 8 Beta 2
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 10 Hotfix - KB894476
  Windows Media Player 11
  Windows Media Player 11
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Yahoo! Toolbar
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 10:56:22 AM, on 12/25/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\PROGRA~1\AVG\AVG8\avgtray.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
  C:\PROGRA~1\MICROS~3\rapimgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.igoogle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
  O4 - HKLM\..\Run: [VirusScan Online] \mcvsshld.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
  O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
  O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
  O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
  O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
  O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
  O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
  O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
  O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  O20 - AppInit_DLLs: avgrsstx.dll
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  --
  End of file - 9632 bytes

  0
• Trogan London, UK

  December 2008 edited December 2008

  Hi,
  

  when disabling tea timer ithere was no teatimer at the startup section and for win def in control panel there was only windows security so i couldent figure that step

  Uninstall Windows Defender for the time being. We can install it again later.
  

  ---

  
  Please do the following...
  
  1. Click Start > Run > type in appwiz.cpl and hit enter. From the list uninstall the following, if present:
  
  Adobe Reader 7.0.9
  J2SE Runtime Environment 5.0 Update 2
  UltimateBet <-- if you don't use this or did not install it, remove it.
  UltimateBuddy
  
  2. Download and install Java SE Runtime Environment (JRE) 6 Update 11.
  
  3. Download the latest version of Adobe Reader.
  
  4. Open HijackThis
  - Click the Do a system scan only button
  - Check the following entries (below)
  
  O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47...amesLoader.cab
  O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
  
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  
  - Close ALL open windows (especially Internet Explorer!)
  - Click Fix Checked
  Close HiajckThis
  
  5. Please do an online scan with Kaspersky WebScanner
  
  Click on Kaspersky Online Scanner
  
  You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  
  Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
    
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    • Extended (if available otherwise Standard)
    • Scan Options:
    • Scan Archives
      Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
    • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save Report As button:
    • Change Save as type: to Text file
    • Save this as Kaspersky scan to your Desktop
  • Post the Kaspersky report in your next reply, along with a new HijackThis log.

  0
• heyhi

  December 2008 edited December 2008

  thanks again for helping ,i had to download java in order for the scan to work
  
  
  Saturday, December 27, 2008
  Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
  Kaspersky Online Scanner 7 version: 7.0.25.0
  Program database last update: Saturday, December 27, 2008 02:53:32
  Records in database: 1519459
  
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 8:22:10 AM, on 12/27/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\PROGRA~1\MICROS~3\rapimgr.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Java\jre6\bin\jqs.exe
  C:\WINDOWS\Imgtask.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
  C:\Program Files\Java\jre6\bin\java.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.igoogle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: (no name) - {18D37648-863A-4D6D-8828-549D57A287F2} - (no file)
  O2 - BHO: (no name) - {357A131E-5209-4456-BFDB-FEDA9E801B24} - (no file)
  O2 - BHO: (no name) - {3A860DAF-B0A1-4EE8-981A-B4F772FDDFF1} - (no file)
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: (no name) - {90A5165E-3A0E-4146-9457-E19AD484B71C} - (no file)
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: (no name) - {E2E49F45-1FB0-4C5F-B489-0F3BA42447E2} - (no file)
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
  O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
  O4 - HKLM\..\Run: [VirusScan Online] \mcvsshld.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
  O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
  O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
  O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
  O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
  O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  O20 - AppInit_DLLs: avgrsstx.dll
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  --
  End of file - 10321 bytes
  
  Scan settingsScan using the following databaseextendedScan archivesyesScan mail databasesyesScan areaMy ComputerC:\
  D:\
  E:\
  F:\
  G:\ Scan statisticsFiles scanned114340Threat name2Infected objects2Suspicious objects0Duration of the scan04:56:42
  File nameThreat nameThreats countC:\My Backup -- 08-02-26 0405PM\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\49Y30HUB\f[1].jsInfected: Trojan-Downloader.JS.Small.ld1D:\i386\Apps\App17981\comps\toolbar\toolbr.exeInfected: not-a-virus:AdWare.Win32.SearchIt.t1The selected area was scanned.

  0
• Trogan London, UK

  December 2008 edited December 2008

  Hi,
  
  Please disable Spybots TeaTimer before continuing.
  
  Please do the following...
  
  1. D:\i386\Apps\App17981\comps\toolbar\toolbr.exe <-- do you know what this is? If not, delet it.
  
  2. Open HijackThis
  - Click the Do a system scan only button
  - Check the following entries (below)
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
  
  O2 - BHO: (no name) - {18D37648-863A-4D6D-8828-549D57A287F2} - (no file)
  O2 - BHO: (no name) - {357A131E-5209-4456-BFDB-FEDA9E801B24} - (no file)
  O2 - BHO: (no name) - {3A860DAF-B0A1-4EE8-981A-B4F772FDDFF1} - (no file)
  O2 - BHO: (no name) - {90A5165E-3A0E-4146-9457-E19AD484B71C} - (no file)
  O2 - BHO: (no name) - {E2E49F45-1FB0-4C5F-B489-0F3BA42447E2} - (no file)
  
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  
  - Close ALL open windows (especially Internet Explorer!)
  - Click Fix Checked
  Close HiajckThis
  
  3. Post a new HijackThis log, and let me know how the computer is running.

  0
• heyhi

  December 2008 edited December 2008

  i couldnt figure out how to delete from the D file as that is a recovery drive the message i got was
  Recovery Partition
  Warning!
  
  This area of your hard disk
  (or partition) contains files used
  for your system recovery.
  
  Do not delete or alter these files.
  
  Any change to this partition could
  prevent any recovery later.
  
  So i skipped that step and did the scan only and deleted the items, than ran the scan with log which i have posted on the bottom.
  
  
  
  
  
  
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 4:29:01 PM, on 12/27/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Java\jre6\bin\jqs.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\PROGRA~1\AVG\AVG8\avgtray.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\WINDOWS\Imgtask.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  C:\PROGRA~1\MICROS~3\rapimgr.exe
  C:\WINDOWS\system32\svchost.exe
  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\msiexec.exe
  C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.igoogle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
  O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
  O4 - HKLM\..\Run: [VirusScan Online] \mcvsshld.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
  O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
  O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
  O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
  O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
  O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  O20 - AppInit_DLLs: avgrsstx.dll
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  --
  End of file - 9944 bytes

  0
• heyhi

  December 2008 edited December 2008

  again ty very much comp is running alot better rgw 1 ro files came back in hi jack this is that ok?
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
  
  
  
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 11:37:14 PM, on 12/28/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Java\jre6\bin\jqs.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\WINDOWS\Imgtask.exe
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  C:\WINDOWS\system32\svchost.exe
  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\Program Files\AVG\AVG8\avgtray.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.igoogle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = <<<<<<<
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = <<<<<<<
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
  O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
  O4 - HKLM\..\Run: [VirusScan Online] \mcvsshld.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
  O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
  O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
  O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
  O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
  O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
  O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  O20 - AppInit_DLLs: avgrsstx.dll
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  --
  End of file - 9376 bytes

  0
• heyhi

  December 2008 edited December 2008

  AND I DELETED THE D FILE

  0
• Trogan London, UK

  January 2009 edited January 2009

  Apologies for the delay. I'm away for a few days and will respond when I get back.

  0
• Trogan London, UK

  January 2009 edited January 2009

  Hi,
  
  Those entries are blank and nothing to worry about.
  
  The HijackThis log is clean. Let me know how the computer is running?

  0
• heyhi

  January 2009 edited January 2009

  hi, thanks for getting back at me i ran another online scan last night and i believe i already deleted these files....
  
  when i delete them am i getting rid of the virus and ad ware my comp is not running as it should
  
  
  KASPERSKY ONLINE SCANNER 7 REPORT Monday, January 5, 2009
  Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
  Kaspersky Online Scanner 7 version: 7.0.25.0
  Program database last update: Monday, January 05, 2009 02:42:44
  Records in database: 1560895
  Scan settingsScan using the following databaseextendedScan archivesyesScan mail databasesyesScan areaMy ComputerC:\
  D:\
  E:\
  F:\
  G:\ Scan statisticsFiles scanned139837Threat name2Infected objects2Suspicious objects0Duration of the scan06:03:44
  File nameThreat nameThreats countC:\My Backup -- 08-02-26 0405PM\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\49Y30HUB\f[1].jsInfected: Trojan-Downloader.JS.Small.ld1D:\System Volume Information\_restore{39C571A2-5C6A-433B-8AC6-DBD815F09639}\RP348\A0027256.exeInfected: not-a-virus:AdWare.Win32.SearchIt.t1The selected area was scanned.
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 11:10:49 PM, on 1/5/2009
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Java\jre6\bin\jqs.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\AIM6\aolsoftware.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.igoogle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: (no name) - {18D37648-863A-4D6D-8828-549D57A287F2} - (no file)
  O2 - BHO: (no name) - {357A131E-5209-4456-BFDB-FEDA9E801B24} - (no file)
  O2 - BHO: (no name) - {3A860DAF-B0A1-4EE8-981A-B4F772FDDFF1} - (no file)
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: (no name) - {90A5165E-3A0E-4146-9457-E19AD484B71C} - (no file)
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: (no name) - {E2E49F45-1FB0-4C5F-B489-0F3BA42447E2} - (no file)
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
  O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
  O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
  O4 - HKLM\..\Run: [VirusScan Online] \mcvsshld.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
  O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
  O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
  O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
  O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
  O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
  O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
  O18 - Filter hijack: text/html - {b4cad00c-7c9f-451c-a201-391a57b21a57} - (no file)
  O20 - AppInit_DLLs: avgrsstx.dll
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
  --
  End of file - 10393 bytes

  0
• Trogan London, UK

  January 2009 edited January 2009

  Hi,
  
  Not much to worry about...
  
  1. Make sure you can view hidden files and folders:
  

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Click OK.

  
  2. Find and delete the following file in RED...
  
  C:\My Backup -- 08-02-26 0405PM\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\49Y30HUB\f[1].js <-- this file
  
  3. Run ATF Cleaner again as mentioned in my first post.
  
  4. Run a new Kaspersky scan and post the report back here.
  
  This above will remove the first infected file and we will deal with the second later.

  0
• heyhi

  January 2009 edited January 2009

  again ty very much for ur help my comp is runnig fine and no threats for a week or so but my explorer takes a min or so to load when opened.
  
  here are my procces runnign and theres a gew that are more then one is this a threat?
  
  
  
  
  
  
  File name
  Product name
  Status
  Security
  Performance
  Network
  Source
  Recommendation
  Loading data...1alcmtr.exeRealtek AC97 Audio - Event MonitorNot RunningAutostartScan For Errors2alg.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors3applemobiledevicese...Apple Mobile Device ServiceRunningLow Memory UsageLANServiceScan For Errors4ati2evxx.exeATI External Event Utility for Wi...RunningLow Memory UsageServiceScan For Errors5ati2evxx.exeATI External Event Utility for Wi...RunningLow Memory UsageServiceScan For Errors6csrss.exeMicrosoft® Windows® Operating Sys...RunningUnknownLow Memory UsageProcessScan For Threats7ctfmon.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageAutostartScan For Errors8dumprep.exeMicrosoft® Windows® Operating Sys...Not RunningAutostartScan For Errors9explorer.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageProcessScan For Errors10googletoolbarnotifi...GoogleToolbarNotifierNot RunningAutostartScan For Errors11googleupdaterservic...Google UpdaterRunningLow Memory UsageServiceScan For Errors12iexplore.exeWindows® Internet ExplorerRunningHigh Memory UsageNetworkProcessPerformance Scan13iexplore.exeWindows® Internet ExplorerRunningLow Memory UsageProcessScan For Errors14jqs.exeJava(TM) Platform SE 6 U11RunningUnknownLow Memory UsageLANServiceScan For Threats15jusched.exeJava(TM) Platform SE 6 U11RunningLow Memory UsageNetworkAutostartScan For Errors16lsass.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageNetworkServiceScan For Errors17mcsacore.exeRunningLow Memory UsageServiceScan For Errors18msascui.exeWindows DefenderRunningUnknownLow Memory UsageAutostartScan For Threats19msiexec.exeWindows Installer - UnicodeRunningLow Memory UsageServiceScan For Errors20msmpeng.exeWindows DefenderRunningMedium Memory UsageServiceScan For Errors21processscanner.exeProcessScannerRunningLow Memory UsageProcessScan For Errors22qttask.exeQuickTimeNot RunningAutostartScan For Errors23recguard.exeRecguard ApplicationNot RunningAutostartScan For Errors24remind_xp.exeApplication Remind_XPNot RunningAutostartScan For Errors25rthdcpl.exeRealtek HD Audio Sound Effect Man...RunningLow Memory UsageAutostartScan For Errors
  
  
  
  
  
  
  
  
  
  27services.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors28sfctlcom.exeTrend Micro Internet SecurityRunningUnknownLow Memory UsageNetworkServiceScan For Threats29smss.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageProcessScan For Errors30spoolsv.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors31svchost.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors32svchost.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors33svchost.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageLANServiceScan For Errors34svchost.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors35svchost.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors36svchost.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageServiceScan For Errors37tmas_oemon.exeTrend Micro Anti-SpamRunningLow Memory UsageAutostartScan For Errors38tmbmsrv.exeAEGISRunningUnknownLow Memory UsageServiceScan For Threats39tmpfw.exeTrend Micro Network Security Comp...RunningLow Memory UsageLANServiceScan For Errors40tmproxy.exeTrend Micro Network Security Comp...RunningLow Memory UsageNetworkServiceScan For Errors41ufseagnt.exeTrend Micro Internet SecurityRunningUnknownLow Memory UsageAutostartScan For Threats42winlogon.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageProcessScan For Errors43wmiprvse.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageProcessScan For Errors44wmiprvse.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageProcessScan For Errors
  
  <H1 id=filename></H1><H2 id=processname>26rundll32.exeMicrosoft® Windows® Operating Sys...RunningLow Memory UsageProcessScan For Errors
  
  
  a few of them say they are suppose to be there and the same one would say its a threat theres some that have more then one such as
  
  
  Home Processes Scanner Quicklink Forum
  

  • English

  English Francais Deutsch Espanol Italiano Japanese
  Find a process or dll (e.g.: Explorer.exe)
  
  Returned 10 results for "svchost.exe"
  
  svchost.exe
  The file svchost.exe is the Generic Host Process for Win32 Services used for administerin... Learn more »
  
  Microsoft Service Host Process
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to... Learn more »
  
  Trojan.W32.Mular
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process registered as a backdoor vulnerability which may be installed fo... Learn more »
  
  Backdoor.Bifrose.D
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process belonging to 007 Spy Software. This is a stealth monitoring soft... Learn more »
  
  007 Spy Software
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to... Learn more »
  
  Trojan.W32.Rontokbr
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to... Learn more »
  
  Trojan.W32.Renama
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to... Learn more »
  
  Trojan.W32.Randsom
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to... Learn more »
  
  Trojan.W32.Oxtic
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to... Learn more »
  
  Trojan.W32.Dasher
  Run a FREE scan for svchost.exe related errors
  
  svchost.exe
  N/A... Learn more »
  
  Trojan.W32.Sufiage
  
  
  
  
  
  
  
  </H2>

  0
• heyhi

  January 2009 edited January 2009

  i did a svchost.exe search on my comp and i got
  1 svchost.exe c/windows/prefetch 9kb pf file date modified 1/11/09
  2 svchost.exe c/windows/system32 14kb application 8/4/2004
  3 svchost.exe3530f672pf c/mybackup/8-02-26 0405... 35 kb pf file 2/26/08
  4 svchost.exe c/mybackup/8-02-26 0405 14 kb application 8/4/2004
  5 svchost.exe c/windows/softwaredistrubt.... 14 kb apllication 4/13/2008
  
  are these diff dates normal?

  0
• Trogan London, UK

  January 2009 edited January 2009

  Hi,
  
  It is normal to have more than one svchost.exe entry, but those above look a little odd.
  

  • Go to VirusTotal
  • Copy and paste the file paths you mentioned above into the Search Box in the middle of the page:
  • Now click on the Send File button
    NOTE:
  • If you come to the "File has already been analysed:" page, select "Reanalyse file now" to get a fresh scan.

  [*]Save a copy of the Anti-Virus results only. Post the results in your next reply.
  

  0
• heyhi

  January 2009 edited January 2009

  hi im trying to search a file and it wont work on that site. c/windows/prefetch is one of the files and i cant upload it and the search is a hash search and it comes with no results

  0
• Trogan London, UK

  January 2009 edited January 2009

  Copy and paste this location in VirusTotal:
  
  C:\WINDOWS\Prefetch\svchost.exe
  
  Let me know the results.

  0
• heyhi

  January 2009 edited January 2009

  Trogan wrote:

  Copy and paste this location in VirusTotal:
  
  C:\WINDOWS\Prefetch\svchost.exe
  
  Let me know the results.

  
  
  
  i cant copy and paste in the analysis one but i can in the hash search and it comes up no results

  0
• Trogan London, UK

  January 2009 edited January 2009

  Go to the C:\WINDOWS\Prefetch\ folder and locate svchost.exe.
  Right-click on it, and select Properties
  Let me know what it says there.

  0