Help needed - Midaddle

Unknown
edited January 2005 in Spyware & Virus Removal
This program sucks sooooooo bad!!!

I ran AdAware and SpyBot. Spybot told me it has to run on reboot because some things couldnt be removed, but I have not yet rebooted. I wanted to grab a HJT log first. Here it is:

Logfile of HijackThis v1.99.0
Scan saved at 9:13:57 PM, on 12/30/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\HpMmKbd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRAM FILES\WINAMP\Winampa.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\win32src.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\HJT\HijackThis.exe

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HpMmKbd] HpMmKbd.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\Winampa.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Win32 Src Service] win32src.exe
O4 - HKLM\..\RunServices: [Win32 Src Service] win32src.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Mania Win Restore.lnk = C:\21STCENT\WINMANIA\RESWIN.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.hta
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://66.255.127.85/AxisCamControl.ocx
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O23 - Service: .NET Framework Service - Unknown - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: pcANYWHERE Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    Looks like you may have the VX2 infection.

    Download and run VX2Finder(.exe).
    http://www.downloads.subratam.org/VX2Finder.exe

    Open the program and click the 'Click to Find VX2.aBetterInternet' button. This will attempt to find all VX2 related files and registry keys and when present display them in its logfile. To create a logfile, click the button named: 'Make Log'. This will open logfile using Notepad. Please post (copy/paste) the results and post them in this topic.

    Download these two tools:

    http://www.downloads.subratam.org/DllCompare.exe
    &
    http://www.downloads.subratam.org/KillBox.exe

    Run Dllcompare, by clicking the "Run Locate.com" then click Compare button... when done post that log here..do not reboot because all the filenames will change otherwise.

    Go here and download FindIt.zip to your Desktop, unzip it and open the FindIt folder and doubleclick on find.bat. Let it run (please be patient, it will take a few minutes) and when it has finished gathering info, it will generate a file called Output.txt. Please copy it and paste it back in this thread.
  • firefighter75
    edited December 2004
    Here is the vx2 log:

    Log for VX2.BetterInternet File Finder (ALL)

    Files Found---

    Additional Files---

    Keys Under Notify---
    App Management
    crypt32chain
    cryptnet
    cscdll
    NavLogon
    ScCertProp
    Schedule
    sclgntfy
    SensLogn
    termsrv
    wlballoon


    Guardian Key--- is called:

    Guardian Key--- :

    User Agent String---
    {C470F35A-11DD-4668-A0E6-47F145306DED}
  • firefighter75
    edited December 2004
    The Run DllCompare Log:

    * DLLCompare Log version()
    Files Found that Windows does not See or cannot Access
    *Not everything listed here means you are infected!
    ________________________________________________

    C:\WINDOWS\SYSTEM32\igetpp.dll Fri Dec 31 2004 10:16:28a ..S.R 223,232 218.00 K
    C:\WINDOWS\SYSTEM32\r8r6li~1.dll Fri Dec 31 2004 10:16:28a ..S.R 224,930 219.66 K
    ________________________________________________

    1,579 items found: 1,579 files (2 H/S), 0 directories.
    Total of file sizes: 315,513,255 bytes 300.89 M

    Administrator Account = True
    End log
  • firefighter75
    edited December 2004
    The Find It log:

    Warning! This utility will find legitimate files in addition to malware.
    Do not remove anything unless you are sure you know what you're doing.

    Find.bat is running from: C:\Find It\Find It NT-2K-XP
    System Files in System32 Directory
    Volume in drive C has no label.
    Volume Serial Number is 0359-1AEE

    Directory of C:\WINDOWS\System32

    12/31/2004 10:16 AM 223,232 igetpp.dll
    12/31/2004 10:16 AM 224,930 r8r6li9s18.dll
    08/04/2004 03:56 AM 204,288 win32src.exe
    07/06/2004 05:58 PM 508 VchsZQoq.fxe
    04/10/2002 11:48 AM <DIR> Microsoft
    04/10/2002 11:13 AM <DIR> dllcache
    4 File(s) 652,958 bytes
    2 Dir(s) 8,399,405,056 bytes free
    Hidden Files in System32 Directory

    Volume in drive C has no label.
    Volume Serial Number is 0359-1AEE

    Directory of C:\WINDOWS\System32

    08/04/2004 03:56 AM 204,288 win32src.exe
    07/06/2004 05:58 PM 508 VchsZQoq.fxe
    09/17/2002 02:09 AM <DIR> GroupPolicy
    04/10/2002 11:27 AM 488 WindowsLogon.manifest
    04/10/2002 11:27 AM 488 logonui.exe.manifest
    04/10/2002 11:27 AM 749 sapi.cpl.manifest
    04/10/2002 11:27 AM 749 wuaucpl.cpl.manifest
    04/10/2002 11:27 AM 749 cdplayer.exe.manifest
    04/10/2002 11:27 AM 749 nwc.cpl.manifest
    04/10/2002 11:27 AM 749 ncpa.cpl.manifest
    04/10/2002 11:13 AM <DIR> dllcache
    9 File(s) 209,517 bytes
    2 Dir(s) 8,399,388,672 bytes free
    Files Named "Guard"

    Volume in drive C has no label.
    Volume Serial Number is 0359-1AEE

    Directory of C:\WINDOWS\System32

    Temp Files in System32 Directory

    Volume in drive C has no label.
    Volume Serial Number is 0359-1AEE

    Directory of C:\WINDOWS\System32

    08/23/2001 05:00 AM 2,577 CONFIG.TMP
    1 File(s) 2,577 bytes
    0 Dir(s) 8,399,355,904 bytes free
    User Agent

    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{C470F35A-11DD-4668-A0E6-47F145306DED}"=""

    Keys Under Notify

    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Management]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\efsvc.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    "StartShell"="NavStartShellEvent"
    "DllName"="C:\\WINDOWS\\System32\\NavLogon.dll"
    "Logoff"="NavLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "PostShell"="SensPostShellEvent"
    "Disconnect"="SensDisconnectEvent"
    "Reconnect"="SensReconnectEvent"
    "Unlock"="SensUnlockEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
    "Impersonate"=dword:00000000
    "Logoff"="TSEventLogoff"
    "Logon"="TSEventLogon"
    "PostShell"="TSEventPostShell"
    "Shutdown"="TSEventShutdown"
    "StartShell"="TSEventStartShell"
    "Startup"="TSEventStartup"
    "MaxWait"=dword:00000258
    "Reconnect"="TSEventReconnect"
    "Disconnect"="TSEventDisconnect"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName"="wlnotify.dll"
    "Logon"="RegisterTicketExpiredNotificationEvent"
    "Logoff"="UnregisterTicketExpiredNotificationEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    Locate.com Results

    C:\WINDOWS\SYSTEM32\
    igetpp.dll Fri Dec 31 2004 10:16:28a ..S.R 223,232 218.00 K
    r8r6li~1.dll Fri Dec 31 2004 10:16:28a ..S.R 224,930 219.66 K

    2 items found: 2 files, 0 directories.
    Total of file sizes: 448,162 bytes 437.66 K
    Strings.exe Qoologic Results

    Strings.exe Aspack Results

    C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack
    HKLM Run Key

    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HpMmKbd"="HpMmKbd.exe"
    "POINTER"="point32.exe"
    "WinampAgent"="\"C:\\PROGRAM FILES\\WINAMP\\Winampa.exe\""
    "Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
    "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
    "nwiz"="nwiz.exe /install"
    "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe"
    "LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe"
    "LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
    "LogitechGalleryRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "NoChange"="1"
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "Installed"="1"


  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    Stay offline when doing the following fix.

    Open killbox and paste in C:\WINDOWS\SYSTEM32\igetpp.dll

    With the full path to the file name in the topmost textbox, click the option *replace on reboot* and *Use Dummy* which will create a numbered dummy file instantly for you.

    Click the Red X ...and for the confirmation message that will appear, you will need to click Yes
    A second message will ask to Reboot now? you will need to click No (since you are not finished adding all related files in yet)

    Repeat the above for each of these;

    C:\WINDOWS\SYSTEM32\r8r6li~1.dll
    C:\Windows\System32\Guard.tmp

    On that last file, close all programs and Reboot your computer.

    Post another log from dllcompare please. Remember; Do not reboot unless asked!!
  • firefighter75
    edited January 2005
    New Run DllCompare log:

    * DLLCompare Log version(1.0.0.127)
    Files Found that Windows does not See or cannot Access
    *Not everything listed here means you are infected!
    ________________________________________________

    O^E says: "There were no files found :)"
    ________________________________________________

    1,579 items found: 1,579 files, 0 directories.
    Total of file sizes: 315,065,205 bytes 300.47 M

    Administrator Account = True
    End log
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Open Killbox and Copy & Paste the path to the Desktop.ini for recycle bin. (only if you are having problems with your recycle bin)
    ie:

    C:\RECYCLER\Desktop.ini

    Click Red X to delete it.

    Also paste in C:\Windows\System32\Guard.tmp again and click the red X to delete that.

    Run VX2Finder and click the *Click to find etc* button. Then hit the *restore policy* button and follow the prompts. Click the *UserAgent$* button and follow the prompts. Exit the program.

    Open regedit and go to *HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify* and delete the *App Management* sub-key.
    NOTE. Please back up the *notify* key by exporting it to a safe location. Call it notify.reg.

    Please post an hijackthis log when done.
  • firefighter75
    edited January 2005
    justlooking wrote:
    Open Killbox and Copy & Paste the path to the Desktop.ini for recycle bin. (only if you are having problems with your recycle bin)
    ie:

    C:\RECYCLER\Desktop.ini

    Click Red X to delete it.

    Also paste in C:\Windows\System32\Guard.tmp again and click the red X to delete that.

    I get a message that says the file cannot be deleted. I then chose the option to replace on reboot and rename with the dummy option.
    Run VX2Finder and click the *Click to find etc* button. Then hit the *restore policy* button and follow the prompts. Click the *UserAgent$* button and follow the prompts. Exit the program.

    The restore policy buttonwill not complete unless I reboot the machine. You said before not to reboot unless told to. Am I supposed to here, then complete the user agent option?
    Open regedit and go to *HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify* and delete the *App Management* sub-key.

    That key is not present
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Allow the reboot for VX2. I should have said that may occur.

    Open the registry editor and go to:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify and export that key to your desktop. Call it notify.reg
    Right click on it and then edit. Copy and paste the results here.

    Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.
  • firefighter75
    edited January 2005
    The results for notify.reg:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    "StartShell"="NavStartShellEvent"
    "DllName"="C:\\WINDOWS\\System32\\NavLogon.dll"
    "Logoff"="NavLogoffEvent"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\r8r6li9s18.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"
  • firefighter75
    edited January 2005
    Silent Runners.vbs log:

    "Silent Runners.vbs", revision 28, launched at: 19:43
    Output limited to non-default values, except where indicated by "{++}"
    Operating System: Windows XP SP2


    Startup items buried in registry:

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "msnmsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]
    "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "HpMmKbd" = "HpMmKbd.exe" ["Hewlett-Packard Corp."]
    "POINTER" = "point32.exe" [MS]
    "WinampAgent" = ""C:\PROGRAM FILES\WINAMP\Winampa.exe"" [null data]
    "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
    "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
    "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
    "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
    "vptray" = "C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" ["Symantec Corporation"]
    "LogitechVideoRepair" = "C:\Program Files\Logitech\Video\ISStart.exe" ["Logitech Inc."]
    "LogitechVideoTray" = "C:\Program Files\Logitech\Video\LogiTray.exe" ["Logitech Inc."]
    "LogitechGalleryRepair" = "C:\Program Files\Logitech\Video\ISStart.exe" ["Logitech Inc."]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
    -> CLSID InProcServer32 resolves to: "deskpan.dll" [file not found]
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universal Plug and Play Devices"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\upnpui.dll" [MS]
    "{5b4dae26-b807-11d0-9815-00c04fd91972}" = "Menu Band"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{8278F931-2A3E-11d2-838F-00C04FD918D0}" = "Tracking Shell Menu"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}" = "Menu Site"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}" = "Menu Desk Bar"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}" = "IShellFolderBand"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{0E5CBF21-D15F-11d0-8301-00AA005B4383}" = "&Links"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{7487cd30-f71a-11d0-9ea7-00805f714772}" = "Thumbnail Image"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{450D8FBA-AD25-11D0-98A8-0800361B1103}" = "MyDocs Folder"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{FEF10FA2-355E-4e06-9381-9B24D7F7CC88}" = ""
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{53C74826-AB99-4d33-ACA4-3117F51D3788}" = ""
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{0D302F2C-8EA6-11CE-B035-444553540000}" = "pcANYWHERECallerShellExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A0-9f0D-11CE-B035-444553540000}" = "pcANYWHERECallerPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC1-972F-11CE-B035-444553540000}" = "pcANYWHERERemoteCtrlShellExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92a681a1-9f0d-11CE-B035-444553540000}" = "pcANYWHERERemoteCtrlPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC2-972F-11CE-B035-444553540000}" = "pcANYWHEREBeHostExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A2-9f0D-11CE-B035-444553540000}" = "pcANYWHEREBeHostPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC3-972F-11CE-B035-444553540000}" = "pcANYWHEREOnlineSvcExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A3-9f0D-11CE-B035-444553540000}" = "pcANYWHEREOnlineSvcPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC4-972F-11CE-B035-444553540000}" = "pcANYWHEREGatewayExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A4-9f0D-11CE-B035-444553540000}" = "pcANYWHEREGatewayPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
    "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
    "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
    "{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
    "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Logitech Pictures"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Logitech\Video\Namespc2.dll" ["Logitech Inc."]
    "{692E4F76-EBB5-45D7-A1B1-B460ADF31B11}" = ""
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\guard.tmp" [file not found]

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
    INFECTION WARNING! "GinaDLL" = "C:\WINDOWS\System32\awgina.dll" ["Symantec Corporation"]

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
    INFECTION WARNING! "NavLogon\DLLName" = "C:\WINDOWS\System32\NavLogon.dll" [null data]
    INFECTION WARNING! "RunOnceEx\DLLName" = "C:\WINDOWS\system32\r8r6li9s18.dll" [null data]
    INFECTION WARNING! "SystemFileProtection\DLLName" = "C:\WINDOWS\system32\guard.tmp" [file not found]


    Startup items in "Sean" & "All Users" startup folders:

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    "Mania Win Restore" -> shortcut to: "C:\21STCENT\WINMANIA\RESWIN.EXE C:\21STCENT\WINMANIA\PMPCWIN.TMP" [file not found]
    "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
    "Logitech Desktop Messenger" -> shortcut to: "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start" ["Logitech"]


    Enabled Scheduled Tasks:

    "Symantec NetDetect" -> launches: "C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\NDETECT.EXE" ["Symantec Corporation"]


    Running Services (Display Name, Service Name, Path {Service DLL}):

    DefWatch, DefWatch, "C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe" ["Symantec Corporation"]
    Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
    NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"]
    Security Center, wscsvc, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\wscsvc.dll" [MS]}
    Symantec AntiVirus Client, Norton AntiVirus Server, "C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe" ["Symantec Corporation"]
    WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\System32\MsPMSPSv.exe" [MS]

    This report excludes default entries except where indicated.
    To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    I have uploaded a regfile to fix a couple of entries that this infection has left behind. Unzip the file, double click to merge with your registry. When asked if you wish to merge, select yes.

    Once done, Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

    O1 - Hosts: 69.20.16.183 ieautosearch
    O1 - Hosts: 69.20.16.183 auto.search.msn.com
    O1 - Hosts: 69.20.16.183 search.netscape.com

    Reboot and post another hijackthis log and silent runners log please. We are just about done :).
  • firefighter75
    edited January 2005
    Silent Runners Log:

    "Silent Runners.vbs", revision 28, launched at: 05:50
    Output limited to non-default values, except where indicated by "{++}"
    Operating System: Windows XP SP2


    Startup items buried in registry:

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "msnmsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]
    "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "HpMmKbd" = "HpMmKbd.exe" ["Hewlett-Packard Corp."]
    "POINTER" = "point32.exe" [MS]
    "WinampAgent" = ""C:\PROGRAM FILES\WINAMP\Winampa.exe"" [null data]
    "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
    "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
    "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
    "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
    "vptray" = "C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" ["Symantec Corporation"]
    "LogitechVideoRepair" = "C:\Program Files\Logitech\Video\ISStart.exe" ["Logitech Inc."]
    "LogitechVideoTray" = "C:\Program Files\Logitech\Video\LogiTray.exe" ["Logitech Inc."]
    "LogitechGalleryRepair" = "C:\Program Files\Logitech\Video\ISStart.exe" ["Logitech Inc."]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
    -> CLSID InProcServer32 resolves to: "deskpan.dll" [file not found]
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universal Plug and Play Devices"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\upnpui.dll" [MS]
    "{5b4dae26-b807-11d0-9815-00c04fd91972}" = "Menu Band"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{8278F931-2A3E-11d2-838F-00C04FD918D0}" = "Tracking Shell Menu"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}" = "Menu Site"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}" = "Menu Desk Bar"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}" = "IShellFolderBand"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{0E5CBF21-D15F-11d0-8301-00AA005B4383}" = "&Links"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{7487cd30-f71a-11d0-9ea7-00805f714772}" = "Thumbnail Image"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{450D8FBA-AD25-11D0-98A8-0800361B1103}" = "MyDocs Folder"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{FEF10FA2-355E-4e06-9381-9B24D7F7CC88}" = ""
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{53C74826-AB99-4d33-ACA4-3117F51D3788}" = ""
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\system32\SHELL32.dll" [MS]
    "{0D302F2C-8EA6-11CE-B035-444553540000}" = "pcANYWHERECallerShellExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A0-9f0D-11CE-B035-444553540000}" = "pcANYWHERECallerPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC1-972F-11CE-B035-444553540000}" = "pcANYWHERERemoteCtrlShellExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92a681a1-9f0d-11CE-B035-444553540000}" = "pcANYWHERERemoteCtrlPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC2-972F-11CE-B035-444553540000}" = "pcANYWHEREBeHostExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A2-9f0D-11CE-B035-444553540000}" = "pcANYWHEREBeHostPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC3-972F-11CE-B035-444553540000}" = "pcANYWHEREOnlineSvcExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A3-9f0D-11CE-B035-444553540000}" = "pcANYWHEREOnlineSvcPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{DF44ACC4-972F-11CE-B035-444553540000}" = "pcANYWHEREGatewayExt"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshell.DLL" ["Symantec Corporation"]
    "{92A681A4-9f0D-11CE-B035-444553540000}" = "pcANYWHEREGatewayPage"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Symantec\pcAnywhere\awshllpg.DLL" ["Symantec Corporation"]
    "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
    "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
    "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
    -> CLSID InProcServer32 resolves to: "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
    "{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
    "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Logitech Pictures"
    -> CLSID InProcServer32 resolves to: "C:\Program Files\Logitech\Video\Namespc2.dll" ["Logitech Inc."]

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
    INFECTION WARNING! "GinaDLL" = "C:\WINDOWS\System32\awgina.dll" ["Symantec Corporation"]

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
    INFECTION WARNING! "NavLogon\DLLName" = "C:\WINDOWS\System32\NavLogon.dll" [null data]
    INFECTION WARNING! "RunOnceEx\DLLName" = "C:\WINDOWS\system32\r8r6li9s18.dll" [null data]
    INFECTION WARNING! "SystemFileProtection\DLLName" = "C:\WINDOWS\system32\guard.tmp" [file not found]


    Startup items in "Sean" & "All Users" startup folders:

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    "Mania Win Restore" -> shortcut to: "C:\21STCENT\WINMANIA\RESWIN.EXE C:\21STCENT\WINMANIA\PMPCWIN.TMP" [file not found]
    "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
    "Logitech Desktop Messenger" -> shortcut to: "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start" ["Logitech"]


    Enabled Scheduled Tasks:

    "Symantec NetDetect" -> launches: "C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\NDETECT.EXE" ["Symantec Corporation"]


    Running Services (Display Name, Service Name, Path {Service DLL}):

    DefWatch, DefWatch, "C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe" ["Symantec Corporation"]
    Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
    NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"]
    Security Center, wscsvc, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\wscsvc.dll" [MS]}
    Symantec AntiVirus Client, Norton AntiVirus Server, "C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe" ["Symantec Corporation"]
    WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\System32\MsPMSPSv.exe" [MS]

    This report excludes default entries except where indicated.
    To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
  • firefighter75
    edited January 2005
    HJT log:

    Logfile of HijackThis v1.99.0
    Scan saved at 5:52:38 AM, on 1/2/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\HpMmKbd.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\PROGRAM FILES\WINAMP\Winampa.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\System32\LVComS.exe
    C:\Program Files\Logitech\Video\LowLight.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJT\HijackThis.exe

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [HpMmKbd] HpMmKbd.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\Winampa.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Mania Win Restore.lnk = C:\21STCENT\WINMANIA\RESWIN.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://home.comcast.net
    O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocx
    O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://66.255.127.85/AxisCamControl.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
    O23 - Service: .NET Framework Service - Unknown - C:\WINDOWS\svchost.exe (file missing)
    O23 - Service: pcANYWHERE Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  • firefighter75
    edited January 2005
    On a side note, Norton Corporate also found the following:

    A0071733.hta
    A0071751.hta
    win32src.exe
    Microsoft Office.hta

    All are in quarantine. I already removed the MSOffice folders before I posted here.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

    O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocx
    Topconverting Adware

    Did you run the regfile I uploaded? I still see the entries that were meant to go in the silent runners log.

    Open the registry editor and go to:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify and export that key to your desktop. Call it notify.reg
    Right click on it and then edit. Copy and paste the results here.
  • firefighter75
    edited January 2005
    I did run that reg key file you sent. Here's the latest log for that reg key:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    "StartShell"="NavStartShellEvent"
    "DllName"="C:\\WINDOWS\\System32\\NavLogon.dll"
    "Logoff"="NavLogoffEvent"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\r8r6li9s18.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "PostShell"="SensPostShellEvent"
    "Disconnect"="SensDisconnectEvent"
    "Reconnect"="SensReconnectEvent"
    "Unlock"="SensUnlockEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SystemFileProtection]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\guard.tmp"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "Logoff"="TSEventLogoff"
    "Logon"="TSEventLogon"
    "PostShell"="TSEventPostShell"
    "Shutdown"="TSEventShutdown"
    "StartShell"="TSEventStartShell"
    "Startup"="TSEventStartup"
    "MaxWait"=dword:00000258
    "Reconnect"="TSEventReconnect"
    "Disconnect"="TSEventDisconnect"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName"="wlnotify.dll"
    "Logon"="RegisterTicketExpiredNotificationEvent"
    "Logoff"="UnregisterTicketExpiredNotificationEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Open Killbox and Copy & Paste the path to the

    C:\Windows\System32\Guard.tmp again and click the red X to delete it.

    Open regedit and go to *HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify* and delete the *RunOnceEx* sub-key and the *SystemFileProtection* sub-key.
    NOTE. Please back up the *notify* key by exporting it to a safe location. Call it notify.reg.

    One last hijackthis log please.
  • firefighter75
    edited January 2005
    justlooking wrote:
    Open Killbox and Copy & Paste the path to the

    C:\Windows\System32\Guard.tmp again and click the red X to delete it.

    Killbox says that file doesnt exist. Last time I tried to kill it, I was denied access to it, so I used the replace on reboot and dummy named it.

    HJT log:

    Logfile of HijackThis v1.99.0
    Scan saved at 8:43:27 PM, on 1/2/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\HpMmKbd.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\PROGRAM FILES\WINAMP\Winampa.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\System32\LVComS.exe
    C:\Program Files\Logitech\Video\LowLight.exe
    C:\Program Files\Adobe\Acrobat 4.0\Reader\AcroRd32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJT\HijackThis.exe

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [HpMmKbd] HpMmKbd.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\Winampa.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Mania Win Restore.lnk = C:\21STCENT\WINMANIA\RESWIN.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://home.comcast.net
    O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://66.255.127.85/AxisCamControl.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
    O23 - Service: .NET Framework Service - Unknown - C:\WINDOWS\svchost.exe (file missing)
    O23 - Service: pcANYWHERE Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Just this one and your good to go.

    O23 - Service: .NET Framework Service - Unknown - C:\WINDOWS\svchost.exe (file missing)
  • firefighter75
    edited January 2005
    Done.

    Should I reboot now and post a new log or am I actually done now?
  • SpywareShooterSpywareShooter 127.0.0.1
    edited January 2005
    Your log is clean now. Are you still having any problems?
  • firefighter75
    edited January 2005
    I havent tried to reboot since removing that entry this morning, but I'll try it and let you know what happens.
  • firefighter75
    edited January 2005
    Here's the HJT log after rebooting. I just want to make sure nothing came back.

    Logfile of HijackThis v1.99.0
    Scan saved at 9:01:15 AM, on 1/4/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\HpMmKbd.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\PROGRAM FILES\WINAMP\Winampa.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\System32\LVComS.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Logitech\Video\LowLight.exe
    C:\HJT\HijackThis.exe

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [HpMmKbd] HpMmKbd.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\Winampa.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Mania Win Restore.lnk = C:\21STCENT\WINMANIA\RESWIN.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://home.comcast.net
    O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://66.255.127.85/AxisCamControl.ocx
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
    O23 - Service: pcANYWHERE Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Looks good. Someone cleaned that up nicely for you :D.
  • firefighter75
    edited January 2005
    Thank you SO much for all your help. You guys are incredible!
This discussion has been closed.