adan and trojan problems [Solved]

Unknown
edited July 2006 in Spyware & Virus Removal
Hi there,
I've been having problems with adan 32-094 and -078 and a trojan. Tried to delete with Avast and Adaware with no luck. Found your site on Google and ran fixwareout and sent results to virustotal, again no luck! Can you help, here's my report.

Thanks for your time, Don





report.txt

Comments

  • chiazchiaz
    edited July 2006
    Greetings peanuts99ca. :)

    Can you please copy and paste the report results in your next reply? It would facilitate my analysing of the log.
  • peanuts99ca
    edited July 2006
    Sorry, I'm new to all this, just a Dad trying to fix the family computer.
    I rescaned and these are results.

    Thanks for being patient, Don

    Fixwareout ver 1.003
    Last edited 07/1/2006
    Post this report in the forums please

    Reg Entries that were deleted
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EF88E1962B28-0A79-2134-5B61-63C04EE3{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7298B9932D48-25B8-4A04-7FAF-18B47786{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}74868CE8EF3A-A5FA-2F04-777D-DCBF6944{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E1318784116C-728A-4724-4C5E-66FF3EE1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1B357828128E-165A-0CE4-69E0-ADED5B66{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}93E786C88BFE-3628-91D4-7393-3D1A361C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\reamd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}52232D8035DE-4A19-9EB4-0E31-6956BA45{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}45CDB34B5398-BB49-7174-0B1F-FC98E149{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6972D1D76DB3-A48B-EF04-63CB-675D3B06{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E6BFC0E9594B-B2EA-9824-F6A8-D4AA70D4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
    ...

    Microsoft (R) Windows Script Host Version 5.6
    Random Runs removed from HKLM
    "dmaer.exe"=-
    ...

    PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
    Example ipsec6.exe is legitimate

    »»»»» Search by size and names...
    * csr.exe C:\WINDOWS\System32\CSIHL.EXE

    »»»»» Misc files

    »»»»» Checking for older varients covered by the Rem3 tool

    »»»»»
    Search five digit cs, dm and jb files
    This WILL/CAN also list Legit Files, Submit them at Virustotal
    C:\WINDOWS\SYSTEM32\CSIHL.EXE 51,291 2006-07-22
    C:\WINDOWS\SYSTEM32\DMAER.EXE 62,045 2002-08-28
    Other suspects
    Directory of C:\WINDOWS\system32
    {C163A1D3-3937-4D19-8263-EFB88C687E39}.exe
    {66B5DEDA-0E96-4EC0-A561-E821828753B1}.exe
    {68774B81-FAF7-40A4-8B52-84D2399B8927}.exe
    {D899D2CC-E811-40E4-8DBC-872852A73272}.exe
    {9620493C-A3C7-4B7E-AD33-C7D59842AD99}.exe
    {F38942C4-77B0-4152-B1FB-662912539DB0}.exe
    {4DB24493-B89F-4D17-B34D-4251ECCD4BC6}.exe
    {06C27615-E089-4219-BD2D-056F00BF5584}.exe
    {CB12AF08-906C-4A77-8823-B9220D1BC738}.exe
    {41F0E570-512E-4C19-92C0-636DB34BCFC6}.exe
    {922B0234-C980-45CF-99C5-2DF7A99246FD}.exe
    {38350206-183E-4BD8-80F6-8FF89CE878B3}.exe
    {2388BD03-B459-4E48-A693-0EEFACCA7AB5}.exe


    Logfile of HijackThis v1.99.1
    Scan saved at 12:17:31 PM, on 22/07/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Alias\Maya6.5\docs\wrapper.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Alias\Maya6.5\docs\jre\bin\java.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\WINDOWS\System32\MSTMON_Q.EXE
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\DvzCommon\DvzMsgr.exe
    C:\Program Files\Palm\HOTSYNC.EXE
    C:\WINDOWS\explorer.exe
    D:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R3 - URLSearchHook: (no name) - {B18C3374-C681-6563-977C-10EC9CEC197D} - dialer423.dll (file missing)
    F2 - REG:system.ini: UserInit=userinit.exe
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - blank (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\System32\MSTMON_Q.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [killall] browsebar.exe
    O4 - HKLM\..\Run: [EXE32EXE] msag.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [kpzqm.exe] C:\WINDOWS\System32\kpzqm.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [SysEntry] sysconf16.exe
    O4 - HKCU\..\Run: [SAPSTR] porka_.exe
    O4 - HKCU\..\Run: [xsetup] avpmondll.exe
    O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
    O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
    O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
    O16 - DPF: {10000000-1000-0000-0000-000000000000} - file://C:\\Recycler\\Q678341.exe
    O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.hotbar.com/installs/hbtools/programs/hbtools.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0114BF48-6DB8-42B0-8BFB-5DA9BF44E360}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CCS\Services\Tcpip\..\{898525F5-B6D6-4BA9-A45E-AAB8D298FC1F}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FBBD0358-4204-479C-9F03-3A2B5D49A739}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.34 85.255.112.9
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0114BF48-6DB8-42B0-8BFB-5DA9BF44E360}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.34 85.255.112.9
    O17 - HKLM\System\CS2\Services\Tcpip\..\{0114BF48-6DB8-42B0-8BFB-5DA9BF44E360}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.34 85.255.112.9
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Maya 6.5 Documentation Server (maya65docserver) - Unknown owner - C:\Program Files\Alias\Maya6.5\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya6.5\docs\Wrapper.conf (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  • chiazchiaz
    edited July 2006
    Please launch HijackThis and place a checkmark by the following entries:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R3 - URLSearchHook: (no name) - {B18C3374-C681-6563-977C-10EC9CEC197D} - dialer423.dll (file missing)

    O4 - HKLM\..\Run: [killall] browsebar.exe
    O4 - HKLM\..\Run: [EXE32EXE] msag.exe
    O4 - HKLM\..\Run: [kpzqm.exe] C:\WINDOWS\System32\kpzqm.exe
    O4 - HKCU\..\Run: [SysEntry] sysconf16.exe
    O4 - HKCU\..\Run: [SAPSTR] porka_.exe
    O4 - HKCU\..\Run: [xsetup] avpmondll.exe
    O16 - DPF: {10000000-1000-0000-0000-000000000000} - file://C:\\Recycler\\Q678341.exe
    O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.hotbar.com/installs/...ms/hbtools.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{0114BF48-6DB8-42B0-8BFB-5DA9BF44E360}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CCS\Services\Tcpip\..\{898525F5-B6D6-4BA9-A45E-AAB8D298FC1F}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FBBD0358-4204-479C-9F03-3A2B5D49A739}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.34 85.255.112.9
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0114BF48-6DB8-42B0-8BFB-5DA9BF44E360}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.34 85.255.112.9
    O17 - HKLM\System\CS2\Services\Tcpip\..\{0114BF48-6DB8-42B0-8BFB-5DA9BF44E360}: NameServer = 85.255.114.34,85.255.112.9
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.34 85.255.112.9
    ...(Verify that these ip addresses are for your isp's DNS Servers, if so, don't 'fix' these.)


    Close all open windows except for HiJackThis, then click the Fix Checked button. Close HiJackThis. Then restart your computer.


    Please download, install, and update Ewido anti-spyware
    1. Load Ewido and then click the Update tab at the top. Under Manual Update click Start update.
    2. After the update finishes (the status bar at the bottom will display "Update successful")
    3. Close ewido. Do not run it yet.

    Please reboot your computer into Safe Mode. To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads. Select Safe Mode on the screen that appears.
    • In Safe Mode, load Ewido and click on the Scanner tab at the top and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
    • Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side.
    • Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
    • Restart back into Normal Mode.

    Please perform another scan with Hijack This, and then post back with a copy of the Ewido log and the new HijackThis log.
  • peanuts99ca
    edited July 2006
    Took a while but here are the two reports, and I'm still getting Avast warnings for Adan-094 & -078 and Win32 Trojano-1269.


    Logfile of HijackThis v1.99.1
    Scan saved at 1:02:06 AM, on 23/07/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\STOPzilla!\SZServer.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\MSTMON_Q.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\STOPzilla!\STOPzilla.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\WINDOWS\DvzCommon\DvzMsgr.exe
    C:\Program Files\Palm\HOTSYNC.EXE
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Alias\Maya6.5\docs\wrapper.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Alias\Maya6.5\docs\jre\bin\java.exe
    C:\Program Files\Alwil Software\Avast4\setup\avast.setup
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    D:\Program Files\Hijackthis\HijackThis.exe

    F2 - REG:system.ini: UserInit=userinit.exe
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - blank (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\System32\MSTMON_Q.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\STOPzilla.exe /autostart
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\Run: [rthqy.exe] C:\WINDOWS\System32\rthqy.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
    O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
    O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Maya 6.5 Documentation Server (maya65docserver) - Unknown owner - C:\Program Files\Alias\Maya6.5\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya6.5\docs\Wrapper.conf (file missing)
    O23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\SZServer.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


    ewido anti-spyware - Scan Report

    + Created at: 12:53:42 AM 7/23/2006

    + Scan result:



    C:\Program Files\Alwil Software\Avast4\DATA\moved\{AF2ABB01-DB42-4D75-8BB9-21209912A49F}.exe.vir -> Adware.FindSpy : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005350.exe -> Adware.FindSpy : Cleaned with backup (quarantined).
    C:\WINDOWS\Downloaded Program Files\HbInstIE.dll -> Adware.HotBar : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\ShudderLTD -> Adware.PSGuard : Error during cleaning.
    HKLM\SOFTWARE\ShudderLTD\PSGuard -> Adware.PSGuard : Error during cleaning.
    HKLM\SOFTWARE\ShudderLTD\PSGuard\PSGuard -> Adware.PSGuard : Error during cleaning.
    HKLM\SOFTWARE\ShudderLTD\PSGuard\PSGuard\License -> Adware.PSGuard : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005304.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005320.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005322.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005326.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP8\A0005569.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005601.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005620.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005640.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005644.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005659.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\csihl.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    [196] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning.
    [220] VM_00C10000 -> Downloader.Agent.uj : Error during cleaning.
    [736] VM_007B0000 -> Downloader.Agent.uj : Error during cleaning.
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005321.exe -> Downloader.Small.den : Cleaned with backup (quarantined).
    C:\Documents and Settings\Lesley-Ann\Cookies\lesley-ann@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Linda & Don\Cookies\linda & [email]don@atdmt[1].txt[/email] -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Lesley-Ann\Cookies\lesley-ann@cj[1].txt -> TrackingCookie.Cj : Cleaned.
    C:\Documents and Settings\Linda & Don\Cookies\linda & [email]don@clickbank[2].txt[/email] -> TrackingCookie.Clickbank : Cleaned.
    C:\Documents and Settings\Linda & Don\Cookies\linda & [email]don@tribalfusion[2].txt[/email] -> TrackingCookie.Tribalfusion : Cleaned.
    C:\WINDOWS\system32\{06C27615-E089-4219-BD2D-056F00BF5584}.exe -> Trojan.Puper.bx : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{66B5DEDA-0E96-4EC0-A561-E821828753B1}.exe -> Trojan.Puper.bx : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{922B0234-C980-45CF-99C5-2DF7A99246FD}.exe -> Trojan.Puper.bx : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{9620493C-A3C7-4B7E-AD33-C7D59842AD99}.exe -> Trojan.Puper.bx : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005262.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005323.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005334.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005351.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005352.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005353.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005354.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005355.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP7\A0005356.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP8\A0005570.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005604.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005629.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{B9541631-D42F-4336-9D1B-8F99C3C292F5}\RP9\A0005648.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\dmaer.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{38350206-183E-4BD8-80F6-8FF89CE878B3}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{68774B81-FAF7-40A4-8B52-84D2399B8927}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{CB12AF08-906C-4A77-8823-B9220D1BC738}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\{F38942C4-77B0-4152-B1FB-662912539DB0}.exe -> Trojan.Small.gq : Cleaned with backup (quarantined).


    ::Report end
  • chiazchiaz
    edited July 2006
    You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

    Please download FixWareout again.
    Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
    The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

    Once the desktop loads please post the text that will open (report.txt) and a new Hijackthis log.
  • peanuts99ca
    edited July 2006
    Here they are

    Fixwareout ver 1.003
    Last edited 07/1/2006
    Post this report in the forums please

    Reg Entries that were deleted
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}16D0BF1388F5-8158-3034-39EE-0C7CFE3B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A0AB8D32DCF2-9E3B-1514-B19C-20406BD5{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ED1463B501BA-35C8-1424-93FC-350666A7{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}132B677128E5-2CB8-D174-44FB-62610298{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7445C46D624D-A049-B474-5EE2-FFFC01A2{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8B5AE46D39E2-9348-11A4-C017-318443F6{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C3A18496D69C-C7AB-8B14-1F94-A494B187{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DA667D28C33A-0219-1CD4-1E22-C8B94BA8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}46805898D126-AA1A-09C4-D7F1-512A5E6F{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E6F222A1A0D6-4129-E444-9859-3A97A8FE{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6A9623378801-E97B-5934-4FF8-5F9A0206{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C89EAC49EBF6-155A-BAC4-4006-22371FA0{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}660F98142427-3259-B964-62FC-E31F75DC{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}21CCAC8C90F9-4669-C194-BB45-840D4296{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}59D1A7C1F598-4D58-F414-7677-2C9439A0{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B125A32BE369-281A-4604-6B3C-4A0C94F4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4C09D01B0AE9-DB29-3CE4-7EEE-6CE2B142{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D50C178091F0-CA18-B7A4-3172-48B32C5D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6D2AD064CA77-5808-8734-EF94-63D9836E{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4E8206019F15-346B-5184-B08A-2631EB38{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}678C14E60696-2EE9-CE94-3D4A-A1AEF4F8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5C538783E551-FB09-5A34-4D83-F71DCB3A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EDC693CE72F3-10DB-07F4-2143-FD2E8B22{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7337BB46782A-8EC8-01C4-421C-4B0EB9E8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}682628902E82-135A-C5D4-872A-65BBBB9A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2337C0F694BE-3508-D2C4-744F-82447399{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ECADD9DD5C5F-D8E9-9DB4-A82B-D54E91B7{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0FFEF0963F31-4C1B-7014-070C-BA378F23{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0B6A5729C9D9-2369-2944-CB7B-777319AA{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}28BDA8EABB53-8F0A-A084-BC14-D26F67B9{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A74E9FD709C2-0AA9-2564-2DBE-8B741FF9{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0D889A3F4DBA-C76B-6204-7F12-804BD86F{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EB9A0661027A-EBD9-7524-80E0-ACDF17D2{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}45F4186C2140-584B-8734-C770-F07BE198{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CDF141019EC0-542A-1FC4-04DE-14B399D9{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C76548E19F44-B88A-D7B4-6CA2-5BB59FA4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2C9A6E19993E-0EB8-5E24-CA0D-ED35684B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8B203FC9334A-07DB-00E4-FC36-C9149EBC{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7FD27F1B12B4-8CEB-6834-7934-C0E03DB2{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2AB6D56FFBE3-9E0A-CE44-DE87-B13334F5{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E84B262A6C02-1229-7CF4-FE56-4047C6A3{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}38AE7FEB9224-FFEA-6924-FFE4-2E072112{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6BA6BAA9A147-4578-D774-7D00-6F6842E1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AE6C0E411D2F-E1CB-07A4-9AF7-05EE0760{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A1721D039315-2619-42D4-0535-2093D01A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FE5832F5A46E-E608-95D4-4BEB-7B68BE47{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AC0FC17F05F2-6C69-4754-BB0E-3C25B7CF{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}27470DB861DF-534B-34A4-C780-2A741FC8{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C863921188D5-495B-18D4-3FB5-3A470DD1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}071881C74624-5C48-BEB4-CDA3-809E23EA{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2EE93CBBB642-7189-FD94-EC7D-31EE6FB4{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}66452D12D095-2ECA-5BE4-CD17-C417A79A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2F55CD754899-B43A-04D4-D53D-C1CB773A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9B7CBB6568C8-AC89-8B74-E377-F8E571C9{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BC080EC0FD64-F6EB-D8E4-6E7C-D2B7D3AC{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3095AE620842-BE88-5B54-E8A7-4E3DBB1F{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FD53A226AD47-2F3A-FD74-E4E7-4A1C22F9{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2123A05D69A4-7BBB-3A14-68C1-FACFDC1C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B49B34D7A2E3-C538-0684-E03A-76730F3C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}349EFA021D7A-68F9-BE14-C90C-51219B3A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F2B39112A322-409B-6624-A5EA-8B2BA42F{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4C96DCCFA619-73C9-80D4-2165-3B282025{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}980F60BD8160-75AA-B924-21A8-E28CEB42{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B2BACD03FC0A-D93B-2D54-F8F7-53011B5A{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3E048E61A50B-FB3B-3E14-2D29-5E832F76{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4331E870471E-5559-6064-1E96-CD7910A0{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}93DF2D76993B-4C6A-18C4-950A-52F97C95{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8A90C1ABF235-D0CB-DA54-F972-1A90A06D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3930D65BB2FF-5378-62D4-77D2-19045F25{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}490CEC1F7027-D9F9-7D84-8307-82EE8810{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BC559BF6D145-9C49-DD74-E625-A71EE9C3{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7F38330F088F-216A-A114-AF8B-62D0CB53{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1651C7C6B03C-EDAA-5164-6EA0-3565F941{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}80273C21B19B-E5B9-0B74-2324-4579B763{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8CA2492D3C02-99C8-1864-B105-22C5DB3C{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}40302121A4F9-1B79-2264-DCE7-AEBF24DE{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}96DE2FD330FB-DF79-A404-2BB3-9CF92E2D{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}25B19B81CCEC-D479-6EF4-B5BE-E82785CB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}987C9AB06E3A-43AB-4F04-D8A9-77F32622{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EF13FD5FCEFF-0AF9-C484-ECDC-A77624A1{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2533C0172489-1398-6F84-AD12-33001C1B{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}14832D8483C4-3148-C834-BC7D-F05B4D02{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EA1C9AF589DE-2649-7C04-900B-D95BA632{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\widmd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BF5AB239F816-5D2A-A774-EE4B-258DEB78{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}531E05374495-CFBA-BA04-9293-025936EB{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E4A5D25A630C-0959-A3C4-DB60-2BD20871{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C4128A3409CD-99EA-E634-4406-7D52F452{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CCA2B2F4E699-6889-88F4-53F1-9A5C1AE6{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6450A9B56287-E7DA-4004-7B42-66BF9D59{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C91C623B4252-95CA-3B54-C979-5178C783{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BBC27F7B7B06-853B-5A44-6A8C-038BE4E0{
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
    ...

    Microsoft (R) Windows Script Host Version 5.6
    Random Runs removed from HKLM
    "dmdiw.exe"=-
    ...

    PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
    Example ipsec6.exe is legitimate

    »»»»» Search by size and names...
    * csr.exe C:\WINDOWS\System32\CSVCM.EXE

    »»»»» Misc files

    »»»»» Checking for older varients covered by the Rem3 tool

    »»»»»
    Search five digit cs, dm and jb files
    This WILL/CAN also list Legit Files, Submit them at Virustotal
    C:\WINDOWS\SYSTEM32\CSVCM.EXE 51,291 2006-07-22
    C:\WINDOWS\SYSTEM32\DMDIW.EXE 62,045 2002-08-28
    Other suspects
    Directory of C:\WINDOWS\system32
    {0E4EB830-C8A6-44A5-B358-60B7B7F72CBB}.exe
    {387C8715-979C-45B3-AC59-2524B326C19C}.exe
    {95D9FB66-24B7-4004-AD7E-78265B9A0546}.exe
    {6EA1C5A9-1F35-4F88-9886-996E4F2B2ACC}.exe
    {236AB59D-B009-40C7-9462-ED985FA9C1AE}.exe
    {20D4B50F-D7CB-438C-8413-4C3848D23841}.exe
    {6F344813-710C-4A11-8439-2E93D64EA5B8}.exe
    {2A10CFFF-2EE5-474B-940A-D426D64C5447}.exe
    {5DB60402-C91B-4151-B3E9-2FCD23D8BA0A}.exe
    {C163A1D3-3937-4D19-8263-EFB88C687E39}.exe
    {D899D2CC-E811-40E4-8DBC-872852A73272}.exe
    {4DB24493-B89F-4D17-B34D-4251ECCD4BC6}.exe
    {41F0E570-512E-4C19-92C0-636DB34BCFC6}.exe
    {2388BD03-B459-4E48-A693-0EEFACCA7AB5}.exe


    Logfile of HijackThis v1.99.1
    Scan saved at 10:45:45 AM, on 23/07/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\STOPzilla!\SZServer.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Alias\Maya6.5\docs\wrapper.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Alias\Maya6.5\docs\jre\bin\java.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\WINDOWS\System32\MSTMON_Q.EXE
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\STOPzilla!\STOPzilla.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\WINDOWS\DvzCommon\DvzMsgr.exe
    C:\Program Files\Palm\HOTSYNC.EXE
    D:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.ca/
    F2 - REG:system.ini: UserInit=userinit.exe
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - blank (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\System32\MSTMON_Q.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\STOPzilla.exe /autostart
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\Run: [rthqy.exe] C:\WINDOWS\System32\rthqy.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
    O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
    O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Maya 6.5 Documentation Server (maya65docserver) - Unknown owner - C:\Program Files\Alias\Maya6.5\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya6.5\docs\Wrapper.conf (file missing)
    O23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\SZServer.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  • peanuts99ca
    edited July 2006
    Hi Chiawaikian,

    Everything seems to be very stable so far, I got a scare after running Adaware SE after my last post. During the scan I got the Adan messages again but after the scan finished, nothing. I enjoy reading other posts, I'm learning alot and finding a wealth of info. Anyways, you've got a great site here, thanks again and keep up the great work!
    Don
  • joydeepd
    edited July 2006
    Hi,

    Can you please tell me where to download Fixwareout from? If not, can someone please mail it to me or upload it somewhere for me to access?

    Thanks so much,
    Joy
  • peanuts99ca
    edited July 2006
    Hi Joy,


    http://downloads.subratam.org/Fixwareout.exe

    I'm not that great with computers and the best advise I could give you is post a new thread and a Mod on this great site will contact you with any info you need and help you through it.

    Good luck, Don
  • joydeepd
    edited July 2006
    Hello Don:

    Thanks much. I have been able to successfully download Fixwareout and run it on my computer. I followed the discussion thread you initiated and today my computers is finally free of some very mean spywares.

    Yes, this is indeed a very helpful forum.

    Thanks all,
    Joy
This discussion has been closed.