Bestfriends virus and other problems. Help!!!
Below is the list from my Hijack This program. Also, when I delete some of the things on this list they end up coming back the next time I run the program (like Kazaalite, which I deleted a while ago). Is there any way to fix this?
Now, onto my IE problems
When I am browsing, a random page will open saying:
[url]http://sponsored by: cdw.com/[/url] and often times i am redirected to www.seekseek.com or something like that. Is there something I can delete to fix this?
Whenever I try to go into my email, I get a runtime C++ error from the internet explorer folder saying IE has an error and the program has an abnormal program termination.
Also, when I run control + Alt + Delete the window pops up but once I move my mouse over it it goes away.
Norton Anti-Virus doesn't pick any of this up, and when I
download the updates it still has the same definitions.
StartupList report, 10/29/2004, 2:20:32 AM
StartupList version: 1.52.2
Started from : C:\Program Files\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Showing rarely important sections
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Roxio\Easy CD Creator
5\DirectCD\DirectCD.exe
C:\Program Files\QUICKENW\QAGENT.EXE
C:\Program Files\Common
Files\Real\Update_OB\realsched.exe
C:\Program Files\DIGStream\digstream.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\WINDOWS\System32\kpdqje.exe
C:\WINDOWS\pgtaff.exe
C:\WINDOWS\system32\mrtMngr.EXE
C:\WINDOWS\Dvdngf.exe
C:\WINDOWS\system32\xlrpex.exe
C:\WINDOWS\system32\KAZAALITE.EXE
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\symiosrv.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\runservice.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINDOWS\SYSTEM32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start
Menu\Programs\Startup]
Office Startup.lnk = C:\Program Files\Microsoft
Office\Office\OSA.EXE
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
IgfxTray = C:\WINDOWS\System32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
BCMSMMSG = BCMSMMSG.exe
NAV Agent = C:\PROGRA~1\NORTON~1\navapw32.exe
AdaptecDirectCD = "C:\Program Files\Roxio\Easy CD Creator
5\DirectCD\DirectCD.exe"
QAGENT = C:\Program Files\QUICKENW\QAGENT.EXE
TkBellExe = C:\Program Files\Common
Files\Real\Update_OB\realsched.exe -osboot
DIGStream = C:\Program Files\DIGStream\digstream.exe
P2P Networking = C:\WINDOWS\System32\P2P Networking\P2P
Networking.exe /AUTOSTART
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe"
-atboottime
kkespo = C:\WINDOWS\System32\kpdqje.exe
Win Server Updt = C:\WINDOWS\wupdt.exe
stcloader = C:\WINDOWS\system32\stcloader.exe
Rxagik = C:\WINDOWS\Meruoq.exe
pgtaff = C:\WINDOWS\pgtaff.exe
zwtooc = C:\WINDOWS\system32\zwtooc.exe
Djwvqe = C:\WINDOWS\Dvdngf.exe
Symantec NetDriver Monitor =
C:\PROGRA~1\SYMNET~1\SNDMon.exe
sFsS3Ei = xlrpex.exe
TV Media = C:\Program Files\TV Media\Tvm.exe
Kazaa Lite = KAZAALITE.EXE
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
media_manager = C:\Program Files\ebkrdr\mediaman.exe
PopUpStopperFreeEdition =
"C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
pgtaff = C:\WINDOWS\pgtaff.exe
do32ROG5j = symiosrv.exe
TV Media = C:\Program Files\TV Media\Tvm.exe
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Kazaa Lite = KAZAALITE.EXE
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)
[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP
[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe
OCInstallUserConfigIE
[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe
OCInstallUserConfigOE
[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n
/i:/UserInstall %SystemRoot%\system32\themeui.dll
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe"
/APP:OE /CALLER:WINNT /user /install
[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe"
/APP:WAB /CALLER:WINNT /user /install
[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll
[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\System32\ie4uinit.exe
[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = %SystemRoot%\System32\updcrl.exe -e -u
%SystemRoot%\System32\verisignpub1.crl
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\2004-0~1.SCR
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
Checking for EXPLORER.EXE instances:
C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
Enumerating Browser Helper Objects:
(no name) - C:\WINDOWS\multimpp.dll -
{002EB272-2590-4693-B166-FBD5D9B6FEA6}
(no name) - C:\Program Files\Adobe\Acrobat
5.0\Reader\ActiveX\AcroIEHelper.ocx -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\system32\lmf32.dll -
{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}
(no name) - C:\WINDOWS\system32\zwtoo.dll -
{7F075FBE-FE8F-4461-9591-7488C404FC96}
NAV Helper - C:\Program Files\Norton
AntiVirus\NavShExt.dll -
{BDF3E430-B101-42AD-A544-FADC6B084872}
Enumerating Task Scheduler jobs:
Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job
Enumerating Download Program Files:
[LiveUpdate Crescendo]
InProcServer32 = C:\WINDOWS\System32\cres.ocx
CODEBASE =
http://activex.liveupdate.com/controls/cres.cab
[Shockwave ActiveX Control]
InProcServer32 =
C:\WINDOWS\SYSTEM32\Macromed\Director\SwDir.dll
CODEBASE =
http://download.macromedia.com/pub/shockwave/cabs/directo
r/sw.cab
[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE =
http://download.microsoft.com/download/F/6/E/F6E491A6-77E
1-4E20-9F5F-94901338C922/wmv9VCM.CAB
[Update Class]
InProcServer32 = C:\WINDOWS\system32\iuctl.dll
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuc
tl.CAB?37592.6883796296
[{A4639D2F-774E-11D3-A490-00C04F6843FB}]
CODEBASE =
http://download.microsoft.com/download/PowerPoint2002/Ins
tall/10.0.2609/WIN98MeXP/EN-US/msorun.cab
[Shockwave Flash Object]
InProcServer32 =
C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE =
http://fpdownload.macromedia.com/pub/shockwave/cabs/flash
/swflash.cab
Enumerating Windows NT/2000/XP services
.NET Framework Service: C:\WINDOWS\svchost.exe
(autostart)
Windows Audio: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Computer Browser: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe
-k netsvcs (autostart)
DCOM Server Process Launcher:
%SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
DNS Client: %SystemRoot%\System32\svchost.exe -k
NetworkService (autostart)
Error Reporting Service:
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
LicCtrl Service: C:\WINDOWS\runservice.exe (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe
-k LocalService (autostart)
Norton AntiVirus Auto Protect Service: C:\Program
Files\Norton AntiVirus\navapsvc.exe (autostart)
Plug and Play: %SystemRoot%\system32\services.exe
(autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe
(autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe
(autostart)
Remote Procedure Call (RPC):
%SystemRoot%\system32\svchost -k rpcss (autostart)
Security Accounts Manager:
%SystemRoot%\system32\lsass.exe (autostart)
ScriptBlocking Service:
C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
(autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
System Event Notification:
%SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS):
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection:
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe
(autostart)
System Restore Service: %SystemRoot%\System32\svchost.exe
-k netsvcs (autostart)
SYMTDI: \??\C:\WINDOWS\System32\Drivers\SYMTDI.SYS
(autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
Distributed Link Tracking Client:
%SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework:
C:\WINDOWS\system32\wdfmgr.exe (autostart)
Windows Time: %SystemRoot%\system32\svchost.exe -k
netsvcs (autostart)
WAN Miniport (ATW) Service: "C:\WINDOWS\wanmpsvc.exe"
(autostart)
WebClient: %SystemRoot%\System32\svchost.exe -k
LocalService (autostart)
Windows Management Instrumentation:
%systemroot%\system32\svchost.exe -k netsvcs (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Automatic Updates: %SystemRoot%\system32\svchost.exe -k
netsvcs (autostart)
Wireless Zero Configuration:
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
End of report, 12,275 bytes
Report generated in 0.109 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious
data
/full - to include several rarely-important
sections
/force9x - to include Win9x-only startups even if
running on WinNT
/forcent - to include WinNT-only startups even if
running on Win9x
/forceall - to include all Win9x and WinNT startups,
regardless of platform
/history - to list version history only
Now, onto my IE problems
When I am browsing, a random page will open saying:
[url]http://sponsored by: cdw.com/[/url] and often times i am redirected to www.seekseek.com or something like that. Is there something I can delete to fix this?
Whenever I try to go into my email, I get a runtime C++ error from the internet explorer folder saying IE has an error and the program has an abnormal program termination.
Also, when I run control + Alt + Delete the window pops up but once I move my mouse over it it goes away.
Norton Anti-Virus doesn't pick any of this up, and when I
download the updates it still has the same definitions.
StartupList report, 10/29/2004, 2:20:32 AM
StartupList version: 1.52.2
Started from : C:\Program Files\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Showing rarely important sections
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Roxio\Easy CD Creator
5\DirectCD\DirectCD.exe
C:\Program Files\QUICKENW\QAGENT.EXE
C:\Program Files\Common
Files\Real\Update_OB\realsched.exe
C:\Program Files\DIGStream\digstream.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\WINDOWS\System32\kpdqje.exe
C:\WINDOWS\pgtaff.exe
C:\WINDOWS\system32\mrtMngr.EXE
C:\WINDOWS\Dvdngf.exe
C:\WINDOWS\system32\xlrpex.exe
C:\WINDOWS\system32\KAZAALITE.EXE
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\symiosrv.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINDOWS\runservice.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINDOWS\SYSTEM32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start
Menu\Programs\Startup]
Office Startup.lnk = C:\Program Files\Microsoft
Office\Office\OSA.EXE
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
IgfxTray = C:\WINDOWS\System32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
BCMSMMSG = BCMSMMSG.exe
NAV Agent = C:\PROGRA~1\NORTON~1\navapw32.exe
AdaptecDirectCD = "C:\Program Files\Roxio\Easy CD Creator
5\DirectCD\DirectCD.exe"
QAGENT = C:\Program Files\QUICKENW\QAGENT.EXE
TkBellExe = C:\Program Files\Common
Files\Real\Update_OB\realsched.exe -osboot
DIGStream = C:\Program Files\DIGStream\digstream.exe
P2P Networking = C:\WINDOWS\System32\P2P Networking\P2P
Networking.exe /AUTOSTART
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe"
-atboottime
kkespo = C:\WINDOWS\System32\kpdqje.exe
Win Server Updt = C:\WINDOWS\wupdt.exe
stcloader = C:\WINDOWS\system32\stcloader.exe
Rxagik = C:\WINDOWS\Meruoq.exe
pgtaff = C:\WINDOWS\pgtaff.exe
zwtooc = C:\WINDOWS\system32\zwtooc.exe
Djwvqe = C:\WINDOWS\Dvdngf.exe
Symantec NetDriver Monitor =
C:\PROGRA~1\SYMNET~1\SNDMon.exe
sFsS3Ei = xlrpex.exe
TV Media = C:\Program Files\TV Media\Tvm.exe
Kazaa Lite = KAZAALITE.EXE
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
media_manager = C:\Program Files\ebkrdr\mediaman.exe
PopUpStopperFreeEdition =
"C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
pgtaff = C:\WINDOWS\pgtaff.exe
do32ROG5j = symiosrv.exe
TV Media = C:\Program Files\TV Media\Tvm.exe
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Kazaa Lite = KAZAALITE.EXE
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)
[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP
[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe
OCInstallUserConfigIE
[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe
OCInstallUserConfigOE
[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n
/i:/UserInstall %SystemRoot%\system32\themeui.dll
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe"
/APP:OE /CALLER:WINNT /user /install
[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe"
/APP:WAB /CALLER:WINNT /user /install
[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll
[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\System32\ie4uinit.exe
[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = %SystemRoot%\System32\updcrl.exe -e -u
%SystemRoot%\System32\verisignpub1.crl
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\2004-0~1.SCR
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
Checking for EXPLORER.EXE instances:
C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
Enumerating Browser Helper Objects:
(no name) - C:\WINDOWS\multimpp.dll -
{002EB272-2590-4693-B166-FBD5D9B6FEA6}
(no name) - C:\Program Files\Adobe\Acrobat
5.0\Reader\ActiveX\AcroIEHelper.ocx -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\system32\lmf32.dll -
{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}
(no name) - C:\WINDOWS\system32\zwtoo.dll -
{7F075FBE-FE8F-4461-9591-7488C404FC96}
NAV Helper - C:\Program Files\Norton
AntiVirus\NavShExt.dll -
{BDF3E430-B101-42AD-A544-FADC6B084872}
Enumerating Task Scheduler jobs:
Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job
Enumerating Download Program Files:
[LiveUpdate Crescendo]
InProcServer32 = C:\WINDOWS\System32\cres.ocx
CODEBASE =
http://activex.liveupdate.com/controls/cres.cab
[Shockwave ActiveX Control]
InProcServer32 =
C:\WINDOWS\SYSTEM32\Macromed\Director\SwDir.dll
CODEBASE =
http://download.macromedia.com/pub/shockwave/cabs/directo
r/sw.cab
[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE =
http://download.microsoft.com/download/F/6/E/F6E491A6-77E
1-4E20-9F5F-94901338C922/wmv9VCM.CAB
[Update Class]
InProcServer32 = C:\WINDOWS\system32\iuctl.dll
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuc
tl.CAB?37592.6883796296
[{A4639D2F-774E-11D3-A490-00C04F6843FB}]
CODEBASE =
http://download.microsoft.com/download/PowerPoint2002/Ins
tall/10.0.2609/WIN98MeXP/EN-US/msorun.cab
[Shockwave Flash Object]
InProcServer32 =
C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE =
http://fpdownload.macromedia.com/pub/shockwave/cabs/flash
/swflash.cab
Enumerating Windows NT/2000/XP services
.NET Framework Service: C:\WINDOWS\svchost.exe
(autostart)
Windows Audio: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Computer Browser: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe
-k netsvcs (autostart)
DCOM Server Process Launcher:
%SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
DNS Client: %SystemRoot%\System32\svchost.exe -k
NetworkService (autostart)
Error Reporting Service:
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
LicCtrl Service: C:\WINDOWS\runservice.exe (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe
-k LocalService (autostart)
Norton AntiVirus Auto Protect Service: C:\Program
Files\Norton AntiVirus\navapsvc.exe (autostart)
Plug and Play: %SystemRoot%\system32\services.exe
(autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe
(autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe
(autostart)
Remote Procedure Call (RPC):
%SystemRoot%\system32\svchost -k rpcss (autostart)
Security Accounts Manager:
%SystemRoot%\system32\lsass.exe (autostart)
ScriptBlocking Service:
C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
(autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
System Event Notification:
%SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS):
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection:
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe
(autostart)
System Restore Service: %SystemRoot%\System32\svchost.exe
-k netsvcs (autostart)
SYMTDI: \??\C:\WINDOWS\System32\Drivers\SYMTDI.SYS
(autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs
(autostart)
Distributed Link Tracking Client:
%SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework:
C:\WINDOWS\system32\wdfmgr.exe (autostart)
Windows Time: %SystemRoot%\system32\svchost.exe -k
netsvcs (autostart)
WAN Miniport (ATW) Service: "C:\WINDOWS\wanmpsvc.exe"
(autostart)
WebClient: %SystemRoot%\System32\svchost.exe -k
LocalService (autostart)
Windows Management Instrumentation:
%systemroot%\system32\svchost.exe -k netsvcs (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k
netsvcs (autostart)
Automatic Updates: %SystemRoot%\system32\svchost.exe -k
netsvcs (autostart)
Wireless Zero Configuration:
%SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
End of report, 12,275 bytes
Report generated in 0.109 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious
data
/full - to include several rarely-important
sections
/force9x - to include Win9x-only startups even if
running on WinNT
/forcent - to include WinNT-only startups even if
running on Win9x
/forceall - to include all Win9x and WinNT startups,
regardless of platform
/history - to list version history only
0
Comments