Options

So I seem to have the Dr. Watson Post Mortem Debugger / Acebot Trojan...

Unknown
edited August 2006 in Spyware & Virus Removal
I'm experiencing all of the symptoms from this previous topic:
http://www.short-media.com/forum/showthread.php?t=28248

However, my HighJackThis log does not contain the same items as that user, and therefore I could really use some help in getting this problem fixed!

From what I've read, this trojan has apparently been extinct since it popped up in early 05. However, this computer is experiencing all of the symptoms of it. Namely, any time we try to load anything that requires the windows explorer shell (control panel, my computer, windows explorer, etc), the computer locks up and Dr. Watson pops up reporting that it has generated errors and needs to close. The windows taskbar freezes, and we need to ctrl-alt-delete and end task on two instances of drwatson32.exe. Doing this reloads explorer.exe, and the computer returns to normal until someone tries to open the explorer shell again.

I've looked at a few HighjackThis logs from people that experienced these symptoms a while ago, and it doesn't appear that my log has any of the tell-tale signs of this trojan (i.e. lots of processes running that look like xxxx32.exe). But I admittedly don't have much experience reading HighjackThis logs, so hopefully someone can shed some light on the issue. I'm running Windows XP Pro SP2.

Here's my log:

quote:
Logfile of HijackThis v1.99.1
Scan saved at 8:21:36 PM, on 8/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Program Files\dvd43\dvd43_tray.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\Picasa2\PicasaMediaDetector.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\WINDOWS\system32\gearsec.exe
D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
D:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\System32\svchost.exe
D:\Documents and Settings\Brad\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYWAR~1\SPYBOT~1\SDHelper.dll
O2 - BHO: abfIEToolsBlockPopup - {626636D0-04B8-4241-84B5-8A6BC3F03501} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ABF Internet Explorer Tools - {B2CE7F1F-9039-462A-B3B7-3935C3CCCCAC} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [dvd43] D:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-33@1033,ABF Internet Explorer Tools Options - {16055878-E84A-4A32-8908-5059A6BB9309} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra 'Tools' menuitem: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-31@1033,ABF Internet Explorer Tools Options... - {16055878-E84A-4A32-8908-5059A6BB9309} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - D:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - D:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-200@1033,Save all images - {7C86B98B-1620-4EC2-82F5-D8AE779C82FD} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-43@1033,About ABF Internet Explorer Tools - {8C9CFF05-CC30-43E9-81B4-93BBBDBF039F} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra 'Tools' menuitem: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-41@1033,About ABF Internet Explorer Tools... - {8C9CFF05-CC30-43E9-81B4-93BBBDBF039F} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-20@1033,Magnifier - {8D961EB5-E3D7-4C84-A3B1-439AF54069D0} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-300@1033,Refresh (ignore cache) - {9A8EC2F6-1611-4A2B-A068-619FDD001175} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-10@1033,Page browser - {AA0F32DF-4E2E-48B9-8206-2E69D39C0D52} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-400@1033,Block pop-ups - {E96BDB23-44B3-468F-8CFE-7D40CC33FB90} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-100@1033,Refresh images - {EB997363-F60D-4B11-9576-6E3C97580613} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://www-secure.symantec.com/tec...trl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://www-secure.symantec.com/tec...trl/tgctlsr.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/tec...rl/LSSupCtl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...b?1105402005344
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - D:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPBBCSvc - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - D:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe


Let me know if you need any more information, or would like me to post additional/different log files.

Comments

  • mcdizzle
    edited August 2006
    Can anyone help me with this? :Rocker:
  • mtunickmtunick
    edited August 2006
    O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

    Fix these in hijackthis.

    Download ewido here http://www.grisoft.cz/softw/70/filedir/inst/ewido-setup_4.0.0.172c.exe

    Update it run a complete system scan, apply all actions, save a logfile post that. Run Hijackthis save the log file and post it.
  • mcdizzle
    edited August 2006
    Thanks for the reply Mtunick.
    I've run full scans with Avast, Norton 2006, Ad-Aware, Spybot, and now Ewido in both safe mode and regular mode. Over the course of attempting to fix this problem, I've deleted Avast as it conflicts with Norton. I've also created a new admin user in Windows XP and copied all of my files to that account (this was a suggested quick fix, but it did not fix my problem). However, now when I boot up I get this popup text file:

    [.ShellClassInfo]
    LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

    I'm not sure if that has anything to do with my problem.

    Here are the logs you requested:
    ewido anti-spyware - Scan Report

    + Created at: 4:17:41 PM 8/13/2006

    + Scan result:



    D:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned.
    C:\WINDOWS\Cookies\m@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Brad\Cookies\brad@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Dad\Cookies\dad@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001467.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001468.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001469.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001470.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001485.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001486.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001487.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001488.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001489.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001490.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001493.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001494.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001495.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001496.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001498.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001499.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001502.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001503.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001504.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001505.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001506.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001507.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001509.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001510.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001511.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001512.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001514.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001515.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001516.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001517.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001518.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001519.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001520.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001521.TXT -> TrackingCookie.2o7 : Cleaned.
    D:\RECYCLER\NPROTECT\00001540.TXT -> TrackingCookie.Atdmt : Cleaned.
    D:\Documents and Settings\Brad\Cookies\brad@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
    D:\Documents and Settings\Brad\Cookies\brad@com[1].txt -> TrackingCookie.Com : Cleaned.
    D:\RECYCLER\NPROTECT\00001382.TXT -> TrackingCookie.Doubleclick : Cleaned.
    D:\RECYCLER\NPROTECT\00001383.TXT -> TrackingCookie.Doubleclick : Cleaned.
    D:\RECYCLER\NPROTECT\00001458.TXT -> TrackingCookie.Doubleclick : Cleaned.
    D:\RECYCLER\NPROTECT\00001459.TXT -> TrackingCookie.Doubleclick : Cleaned.
    D:\RECYCLER\NPROTECT\00001450.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001451.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001452.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001460.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001461.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001462.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001463.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001464.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001465.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001472.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001473.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001474.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001475.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001476.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001477.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001478.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001479.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001480.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001481.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001482.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001483.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001522.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001523.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001524.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001525.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001526.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\RECYCLER\NPROTECT\00001527.TXT -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Brad\Cookies\brad@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
    D:\RECYCLER\NPROTECT\00001377.TXT -> TrackingCookie.Pointroll : Cleaned.
    D:\RECYCLER\NPROTECT\00001378.TXT -> TrackingCookie.Pointroll : Cleaned.
    D:\RECYCLER\NPROTECT\00001379.TXT -> TrackingCookie.Pointroll : Cleaned.
    D:\RECYCLER\NPROTECT\00001453.TXT -> TrackingCookie.Questionmarket : Cleaned.
    D:\RECYCLER\NPROTECT\00001454.TXT -> TrackingCookie.Questionmarket : Cleaned.
    D:\RECYCLER\NPROTECT\00001380.TXT -> TrackingCookie.Tribalfusion : Cleaned.
    D:\RECYCLER\NPROTECT\00001381.TXT -> TrackingCookie.Tribalfusion : Cleaned.


    ::Report end

    Logfile of HijackThis v1.99.1
    Scan saved at 4:19:46 PM, on 8/13/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\System32\Ati2evxx.exe
    D:\WINDOWS\system32\svchost.exe
    D:\Program Files\Windows Defender\MsMpEng.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    D:\WINDOWS\system32\Ati2evxx.exe
    D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    D:\WINDOWS\system32\gearsec.exe
    D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    D:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
    D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    D:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
    D:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    D:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
    D:\Program Files\Common Files\Symantec Shared\ccApp.exe
    D:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\Windows Defender\MSASCui.exe
    D:\Program Files\iPod\bin\iPodService.exe
    D:\WINDOWS\System32\NOTEPAD.EXE
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    D:\WINDOWS\system32\wuauclt.exe
    D:\Program Files\Internet Explorer\iexplore.exe
    D:\spyware tools\ewido anti-spyware 4.0\guard.exe
    D:\spyware tools\ewido anti-spyware 4.0\ewido.exe
    D:\Documents and Settings\Brad\Desktop\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYWAR~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: abfIEToolsBlockPopup - {626636D0-04B8-4241-84B5-8A6BC3F03501} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: ABF Internet Explorer Tools - {B2CE7F1F-9039-462A-B3B7-3935C3CCCCAC} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
    O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [dvd43] D:\Program Files\dvd43\dvd43_tray.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [GhostSurf Reminder] "D:\Program Files\GhostSurf 2006 Platinum\Privacy Control Center.exe" reminder
    O4 - HKLM\..\Run: [!ewido] "D:\spyware tools\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-33@1033,ABF Internet Explorer Tools Options - {16055878-E84A-4A32-8908-5059A6BB9309} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra 'Tools' menuitem: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-31@1033,ABF Internet Explorer Tools Options... - {16055878-E84A-4A32-8908-5059A6BB9309} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - D:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
    O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - D:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-200@1033,Save all images - {7C86B98B-1620-4EC2-82F5-D8AE779C82FD} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-43@1033,About ABF Internet Explorer Tools - {8C9CFF05-CC30-43E9-81B4-93BBBDBF039F} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra 'Tools' menuitem: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-41@1033,About ABF Internet Explorer Tools... - {8C9CFF05-CC30-43E9-81B4-93BBBDBF039F} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-20@1033,Magnifier - {8D961EB5-E3D7-4C84-A3B1-439AF54069D0} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-300@1033,Refresh (ignore cache) - {9A8EC2F6-1611-4A2B-A068-619FDD001175} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-10@1033,Page browser - {AA0F32DF-4E2E-48B9-8206-2E69D39C0D52} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-400@1033,Block pop-ups - {E96BDB23-44B3-468F-8CFE-7D40CC33FB90} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O9 - Extra button: @D:\Program Files\ABF software\ABF Internet Explorer Tools\abfIEToolsRes.dll,-100@1033,Refresh images - {EB997363-F60D-4B11-9576-6E3C97580613} - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105402005344
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\spyware tools\ewido anti-spyware 4.0\guard.exe
    O23 - Service: GEARSecurity - GEAR Software - D:\WINDOWS\system32\gearsec.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - D:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - D:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
  • mtunickmtunick
    edited August 2006
    Open up hijackthis go to misc tools, Select generate starup log. POst that here.
  • mcdizzle
    edited August 2006
    mtunick wrote:
    Open up hijackthis go to misc tools, Select generate starup log. POst that here.

    Here is my full startup log, including both minor and empty sections:

    StartupList report, 8/13/2006, 7:25:38 PM
    StartupList version: 1.52.2
    Started from : D:\Documents and Settings\Brad\Desktop\HijackThis.EXE
    Detected: Windows XP SP2 (WinNT 5.01.2600)
    Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    * Using default options
    * Including empty and uninteresting sections
    * Showing rarely important sections
    ==================================================

    Running processes:

    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\System32\Ati2evxx.exe
    D:\WINDOWS\system32\svchost.exe
    D:\Program Files\Windows Defender\MsMpEng.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    D:\spyware tools\ewido anti-spyware 4.0\guard.exe
    D:\WINDOWS\system32\gearsec.exe
    D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    D:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
    D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    D:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
    D:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\WINDOWS\system32\Ati2evxx.exe
    D:\WINDOWS\Explorer.EXE
    D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    D:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
    D:\Program Files\Winamp\winampa.exe
    D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    D:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
    D:\Program Files\dvd43\dvd43_tray.exe
    D:\Program Files\DAEMON Tools\daemon.exe
    D:\Program Files\Common Files\Symantec Shared\ccApp.exe
    D:\Program Files\Picasa2\PicasaMediaDetector.exe
    D:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\QuickTime\qttask.exe
    D:\Program Files\Windows Defender\MSASCui.exe
    D:\spyware tools\ewido anti-spyware 4.0\ewido.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\iPod\bin\iPodService.exe
    D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    D:\WINDOWS\system32\wuauclt.exe
    D:\Documents and Settings\Brad\Desktop\HijackThis.exe

    Listing of startup folders:

    Shell folders Startup:
    [D:\Documents and Settings\Brad\Start Menu\Programs\Startup]
    *No files*

    Shell folders AltStartup:
    *Folder not found*

    User shell folders Startup:
    *Folder not found*

    User shell folders AltStartup:
    *Folder not found*

    Shell folders Common Startup:
    [D:\Documents and Settings\All Users\Start Menu\Programs\Startup]
    Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    Shell folders Common AltStartup:
    *Folder not found*

    User shell folders Common Startup:
    *Folder not found*

    User shell folders Alternate Common Startup:
    *Folder not found*

    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = D:\WINDOWS\system32\userinit.exe,

    [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
    *Registry key not found*

    [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    *Registry value not found*

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
    *Registry key not found*

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    Zone Labs Client = D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    SunJavaUpdateSched = D:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
    WinampAgent = D:\Program Files\Winamp\winampa.exe
    Google Desktop Search = "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    NeroFilterCheck = D:\WINDOWS\system32\NeroCheck.exe
    dvd43 = D:\Program Files\dvd43\dvd43_tray.exe
    DAEMON Tools = "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    ccApp = "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    WMC_AutoUpdate =
    Picasa Media Detector = D:\Program Files\Picasa2\PicasaMediaDetector.exe
    TkBellExe = "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    iTunesHelper = "D:\Program Files\iTunes\iTunesHelper.exe"
    QuickTime Task = "D:\Program Files\QuickTime\qttask.exe" -atboottime
    Windows Defender = "D:\Program Files\Windows Defender\MSASCui.exe" -hide
    GhostSurf Reminder = "D:\Program Files\GhostSurf 2006 Platinum\Privacy Control Center.exe" reminder
    !ewido = "D:\spyware tools\ewido anti-spyware 4.0\ewido.exe" /minimized

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

    *No values found*

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

    *No values found*

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

    *Registry key not found*

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

    *Registry key not found*

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    *No values found*

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

    *Registry key not found*

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

    *Registry key not found*

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

    *No values found*

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

    *Registry key not found*

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

    *Registry key not found*

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

    *Registry key not found*

    Autorun entries in Registry subkeys of:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    [OptionalComponents]
    *No values found*

    Autorun entries in Registry subkeys of:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
    *No subkeys found*

    Autorun entries in Registry subkeys of:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
    *No subkeys found*

    Autorun entries in Registry subkeys of:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
    *Registry key not found*

    Autorun entries in Registry subkeys of:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
    *Registry key not found*

    Autorun entries in Registry subkeys of:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    *No subkeys found*

    Autorun entries in Registry subkeys of:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
    *Registry key not found*

    Autorun entries in Registry subkeys of:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
    *Registry key not found*

    Autorun entries in Registry subkeys of:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
    *No subkeys found*

    Autorun entries in Registry subkeys of:
    HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
    *Registry key not found*

    Autorun entries in Registry subkeys of:
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
    *Registry key not found*

    Autorun entries in Registry subkeys of:
    HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
    *Registry key not found*

    File association entry for .EXE:
    HKEY_CLASSES_ROOT\exefile\shell\open\command

    (Default) = "%1" %*

    File association entry for .COM:
    HKEY_CLASSES_ROOT\comfile\shell\open\command

    (Default) = "%1" %*

    File association entry for .BAT:
    HKEY_CLASSES_ROOT\batfile\shell\open\command

    (Default) = "%1" %*

    File association entry for .PIF:
    HKEY_CLASSES_ROOT\piffile\shell\open\command

    (Default) = "%1" %*

    File association entry for .SCR:
    HKEY_CLASSES_ROOT\scrfile\shell\open\command

    (Default) = "%1" /S

    File association entry for .HTA:
    HKEY_CLASSES_ROOT\htafile\shell\open\command

    (Default) = D:\WINDOWS\System32\mshta.exe "%1" %*

    File association entry for .TXT:
    HKEY_CLASSES_ROOT\txtfile\shell\open\command

    (Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

    Enumerating Active Setup stub paths:
    HKLM\Software\Microsoft\Active Setup\Installed Components
    (* = disabled by HKCU twin)

    [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    StubPath = D:\WINDOWS\inf\unregmp2.exe /ShowWMP

    [>{26923b43-4d38-484f-9b9e-de460746276c}] *
    StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

    [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
    StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

    [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
    StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

    [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
    StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

    [{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
    StubPath = rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

    [{4b218e3e-bc98-4770-93d3-2731b9329278}] *
    StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

    [{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
    StubPath = rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

    [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
    StubPath = rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\wmp.inf,PerUserStub

    [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

    [{89820200-ECBD-11cf-8B85-00AA005B4340}] *
    StubPath = regsvr32.exe /s /n /i:U shell32.dll

    [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
    StubPath = %SystemRoot%\system32\ie4uinit.exe

    [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
    StubPath = D:\WINDOWS\system32\Rundll32.exe D:\WINDOWS\system32\mscories.dll,Install

    Enumerating ICQ Agent Autostart apps:
    HKCU\Software\Mirabilis\ICQ\Agent\Apps

    *Registry key not found*

    Load/Run keys from D:\WINDOWS\WIN.INI:

    load=*INI section not found*
    run=*INI section not found*

    Load/Run keys from Registry:

    HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
    HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
    HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
    HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
    HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
    HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
    HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
    HKCU\..\Windows NT\CurrentVersion\Windows: load=
    HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

    Shell & screensaver key from D:\WINDOWS\SYSTEM.INI:

    Shell=*INI section not found*
    SCRNSAVE.EXE=*INI section not found*
    drivers=*INI section not found*

    Shell & screensaver key from Registry:

    Shell=Explorer.exe
    SCRNSAVE.EXE=D:\WINDOWS\System32\logon.scr
    drivers=*Registry value not found*

    Policies Shell key:

    HKCU\..\Policies: Shell=*Registry value not found*
    HKLM\..\Policies: Shell=*Registry value not found*

    Checking for EXPLORER.EXE instances:

    D:\WINDOWS\Explorer.exe: PRESENT!

    C:\Explorer.exe: not present
    D:\WINDOWS\Explorer\Explorer.exe: not present
    D:\WINDOWS\System\Explorer.exe: not present
    D:\WINDOWS\System32\Explorer.exe: not present
    D:\WINDOWS\Command\Explorer.exe: not present
    D:\WINDOWS\Fonts\Explorer.exe: not present

    Checking for superhidden extensions:

    .lnk: HIDDEN! (arrow overlay: yes)
    .pif: HIDDEN! (arrow overlay: yes)
    .exe: not hidden
    .com: not hidden
    .bat: not hidden
    .hta: not hidden
    .scr: not hidden
    .shs: HIDDEN!
    .shb: HIDDEN!
    .vbs: not hidden
    .vbe: not hidden
    .wsh: not hidden
    .scf: HIDDEN! (arrow overlay: NO!)
    .url: HIDDEN! (arrow overlay: yes)
    .js: not hidden
    .jse: not hidden

    Verifying REGEDIT.EXE integrity:

    - Regedit.exe found in D:\WINDOWS
    - .reg open command is normal (regedit.exe %1)
    - Company name OK: 'Microsoft Corporation'
    - Original filename OK: 'REGEDIT.EXE'
    - File description: 'Registry Editor'

    Registry check passed

    Enumerating Browser Helper Objects:

    (no name) - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    (no name) - D:\SPYWAR~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
    abfIEToolsBlockPopup - D:\PROGRA~1\ABFSOF~1\ABFINT~1\ABFIET~1.DLL - {626636D0-04B8-4241-84B5-8A6BC3F03501}
    NAV Helper - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}

    Enumerating Task Scheduler jobs:

    Anonymizer scan for spyware.job
    MP Scheduled Scan.job
    Norton AntiVirus - Run Full System Scan - Dad.job
    Norton AntiVirus - Run Norton QuickScan - Dad.job
    Symantec Drmc.job
    System Restore.job

    Enumerating Download Program Files:

    [DirectAnimation Java Classes]
    CODEBASE = file://D:\WINDOWS\Java\classes\dajava.cab
    OSD = D:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

    [Microsoft XML Parser for Java]
    CODEBASE = file://D:\WINDOWS\Java\classes\xmldso.cab
    OSD = D:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

    [SupportSoft SmartIssue]
    InProcServer32 = D:\WINDOWS\Downloaded Program Files\tgctlsi.dll
    CODEBASE = https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab

    [SupportSoft Script Runner Class]
    InProcServer32 = D:\WINDOWS\Downloaded Program Files\tgctlsr.dll
    CODEBASE = https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab

    [LSSupCtl Class]
    InProcServer32 = D:\WINDOWS\Downloaded Program Files\LSSupCtl.dll
    CODEBASE = https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab

    [WUWebControl Class]
    InProcServer32 = D:\WINDOWS\system32\wuweb.dll
    CODEBASE = http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105402005344

    [Java Plug-in 1.5.0_01]
    InProcServer32 = D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab

    [Java Plug-in 1.5.0_01]
    InProcServer32 = D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    CODEBASE = http://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab

    [Shockwave Flash Object]
    InProcServer32 = D:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
    CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    Enumerating Winsock LSP files:

    NameSpace #1: D:\WINDOWS\System32\mswsock.dll
    NameSpace #2: D:\WINDOWS\System32\winrnr.dll
    NameSpace #3: D:\WINDOWS\System32\mswsock.dll
    Protocol #1: D:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll
    Protocol #2: D:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll
    Protocol #3: D:\WINDOWS\system32\mswsock.dll
    Protocol #4: D:\WINDOWS\system32\mswsock.dll
    Protocol #5: D:\WINDOWS\system32\mswsock.dll
    Protocol #6: D:\WINDOWS\system32\rsvpsp.dll
    Protocol #7: D:\WINDOWS\system32\rsvpsp.dll
    Protocol #8: D:\WINDOWS\system32\mswsock.dll
    Protocol #9: D:\WINDOWS\system32\mswsock.dll
    Protocol #10: D:\WINDOWS\system32\mswsock.dll
    Protocol #11: D:\WINDOWS\system32\mswsock.dll
    Protocol #12: D:\WINDOWS\system32\mswsock.dll
    Protocol #13: D:\WINDOWS\system32\mswsock.dll
    Protocol #14: D:\WINDOWS\system32\mswsock.dll
    Protocol #15: D:\WINDOWS\system32\mswsock.dll
    Protocol #16: D:\WINDOWS\system32\mswsock.dll
    Protocol #17: D:\WINDOWS\system32\mswsock.dll
    Protocol #18: D:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll

    Enumerating Windows NT/2000/XP services

    Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
    aeaudio: system32\drivers\aeaudio.sys (manual start)
    Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
    AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
    Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
    Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
    AMD K7 Processor Driver: System32\DRIVERS\amdk7.sys (system)
    Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
    ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
    RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
    Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
    Ati HotKey Poller: %SystemRoot%\System32\Ati2evxx.exe (autostart)
    ATI Smart: D:\WINDOWS\system32\ati2sgag.exe (autostart)
    ati2mtag: System32\DRIVERS\ati2mtag.sys (manual start)
    ATI WDM Rage Theater Video: System32\DRIVERS\atinrvxx.sys (manual start)
    ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
    Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
    Automatic LiveUpdate Scheduler: "D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" (autostart)
    Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Closed Caption Decoder: System32\DRIVERS\CCDECODE.sys (manual start)
    Symantec Event Manager: "D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart)
    Symantec Settings Manager: "D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (autostart)
    CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
    Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
    ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
    COM+ System Application: D:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
    Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
    DC21x4 Based Network Adapter Driver: system32\DRIVERS\dc21x4.sys (manual start)
    DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
    DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Disk Driver: System32\DRIVERS\disk.sys (system)
    Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
    dmboot: System32\drivers\dmboot.sys (disabled)
    Logical Disk Manager Driver: System32\drivers\dmio.sys (system)
    dmload: System32\drivers\dmload.sys (system)
    Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
    DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
    Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
    dtscsi: \SystemRoot\System32\Drivers\dtscsi.sys (manual start)
    dvd43llh: System32\DRIVERS\dvd43llh.sys (manual start)
    Symantec Eraser Control driver: \??\D:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (system)
    Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Event Log: %SystemRoot%\system32\services.exe (autostart)
    COM+ Event System: D:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
    ewido anti-spyware 4.0 driver: \??\D:\spyware tools\ewido anti-spyware 4.0\guard.sys (system)
    ewido anti-spyware 4.0 guard: D:\spyware tools\ewido anti-spyware 4.0\guard.exe (autostart)
    Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
    VIA Rhine-Family Fast Ethernet Adapter Driver Service: system32\DRIVERS\fetnd5bv.sys (manual start)
    VIA Rhine Family Fast Ethernet Adapter Driver: system32\DRIVERS\fetnd5b.sys (manual start)
    Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
    FltMgr: system32\drivers\fltmgr.sys (system)
    Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
    Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)
    GEARAspiWDM: system32\drivers\GEARAspiWDM.sys (manual start)
    GEARSecurity: system32\gearsec.exe (autostart)
    Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
    Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
    HTTP: System32\Drivers\HTTP.sys (manual start)
    HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
    i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
    InstallDriver Table Manager: "D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
    CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (system)
    IMAPI CD-Burning COM Service: D:\WINDOWS\System32\imapi.exe (manual start)
    IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
    IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
    IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
    IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
    iPodService: D:\Program Files\iPod\bin\iPodService.exe (manual start)
    IPSEC driver: System32\DRIVERS\ipsec.sys (system)
    IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
    PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
    Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
    Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
    Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    LiveUpdate: "D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE" (manual start)
    TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
    Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
    NetMeeting Remote Desktop Sharing: D:\WINDOWS\System32\mnmsrvc.exe (manual start)
    Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
    Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
    WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
    MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
    Distributed Transaction Coordinator: D:\WINDOWS\System32\msdtc.exe (manual start)
    Windows Installer: D:\WINDOWS\system32\msiexec.exe /V (manual start)
    Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
    Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
    Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
    Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
    Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)
    ATI WDM Specialized MVD Codec: System32\DRIVERS\atinmdxx.sys (manual start)
    NABTS/FEC VBI Codec: System32\DRIVERS\NABTSFEC.sys (manual start)
    Norton AntiVirus Auto-Protect Service: "D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe" (autostart)
    NAVENG: \??\D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060813.005\NAVENG.Sys (manual start)
    NAVEX15: \??\D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060813.005\NavEx15.Sys (manual start)
    Microsoft TV/Video Connection: System32\DRIVERS\NdisIP.sys (manual start)
    Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
    NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
    Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
    NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
    NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
    Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
    Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
    Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
    Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    Norton UnErase Protection Driver: \??\D:\WINDOWS\system32\Drivers\NPDRIVER.SYS (manual start)
    Norton AntiVirus Firewall Monitor Service: "D:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe" (autostart)
    Norton UnErase Protection: D:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE (autostart)
    Norton Protection Center Service: "D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE" (manual start)
    NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
    Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
    NTSIM: \??\D:\WINDOWS\system32\ntsim.sys (manual start)
    IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
    IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
    Office Source Engine: D:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (manual start)
    Parallel port driver: System32\DRIVERS\parport.sys (manual start)
    PCI Bus Driver: System32\DRIVERS\pci.sys (system)
    Low level access layer for CD devices: System32\Drivers\Pcouffin.sys (manual start)
    Plug and Play: %SystemRoot%\system32\services.exe (autostart)
    IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
    WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
    Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
    QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
    Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
    PxHelp20: System32\Drivers\PxHelp20.sys (system)
    Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
    Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
    Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
    Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
    Rdbss: System32\DRIVERS\rdbss.sys (system)
    RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
    Terminal Server Device Redirector Driver: System32\DRIVERS\rdpdr.sys (manual start)
    Remote Desktop Help Session Manager: D:\WINDOWS\system32\sessmgr.exe (manual start)
    Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
    Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
    Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
    Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
    Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
    QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
    Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
    SAVRT: \??\D:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVRT.SYS (manual start)
    SAVRTPEL: \??\D:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVRTPEL.SYS (system)
    Symantec AVScan: "D:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe" (manual start)
    Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
    Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    SDdriver: \??\D:\WINDOWS\system32\Drivers\sddriver.sys (manual start)
    Secdrv: System32\DRIVERS\secdrv.sys (manual start)
    Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
    Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
    Serial port driver: System32\DRIVERS\serial.sys (system)
    Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    BDA Slip De-Framer: System32\DRIVERS\SLIP.sys (manual start)
    smwdm: system32\drivers\smwdm.sys (manual start)
    Symantec Network Drivers Service: "D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" (autostart)
    SoundMAX Agent Service: D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (autostart)
    SPBBCDrv: \??\D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (system)
    SPBBCSvc: "D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" (autostart)
    Speed Disk service: D:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE (autostart)
    Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
    Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
    sptd: System32\Drivers\sptd.sys (system)
    System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
    System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Srv: System32\DRIVERS\srv.sys (manual start)
    SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
    Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (manual start)
    BDA IPSink: System32\DRIVERS\StreamIP.sys (manual start)
    Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
    Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
    MS Software Shadow Copy Provider: D:\WINDOWS\System32\dllhost.exe /Processid:{84D3F30E-E531-49F1-886E-8C5498D701B7} (manual start)
    Symantec Core LC: "D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" (autostart)
    SYMDNS: \SystemRoot\System32\Drivers\SYMDNS.SYS (manual start)
    SymEvent: \??\D:\Program Files\Symantec\SYMEVENT.SYS (manual start)
    SYMFW: \SystemRoot\System32\Drivers\SYMFW.SYS (manual start)
    SYMIDS: \SystemRoot\System32\Drivers\SYMIDS.SYS (manual start)
    SYMIDSCO: \??\D:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20060807.097\symidsco.sys (manual start)
    symlcbrd: \??\D:\WINDOWS\system32\drivers\symlcbrd.sys (autostart)
    SYMNDIS: \SystemRoot\System32\Drivers\SYMNDIS.SYS (manual start)
    SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)
    SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)
    Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
    Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
    Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
    Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
    Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
    Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Telnet: D:\WINDOWS\System32\tlntsvr.exe (disabled)
    Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
    Windows User Mode Driver Framework: D:\WINDOWS\system32\wdfmgr.exe (autostart)
    Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
    Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
    Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
    Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
    USB2 Enabled Hub: System32\DRIVERS\usbhub.sys (manual start)
    Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
    USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (manual start)
    Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
    VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
    VIA AGP Filter: System32\DRIVERS\viaagp1.sys (system)
    ViaIde: System32\DRIVERS\viaide.sys (system)
    vsdatant: System32\vsdatant.sys (system)
    TrueVector Internet Monitor: D:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)
    Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
    Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
    Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
    WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
    Windows Defender Service: "D:\Program Files\Windows Defender\MsMpEng.exe" (autostart)
    Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
    Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
    WMI Performance Adapter: D:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
    Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
    Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    World Standard Teletext Codec: System32\DRIVERS\WSTCODEC.SYS (manual start)
    Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
    Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
    Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


    Enumerating Windows NT logon/logoff scripts:
    *No scripts set to run*

    Windows NT checkdisk command:
    BootExecute = autocheck autochk *

    Windows NT 'Wininit.ini':
    PendingFileRenameOperations: *Registry value not found*

    Enumerating ShellServiceObjectDelayLoad items:

    PostBootReminder: D:\WINDOWS\system32\SHELL32.dll
    CDBurn: D:\WINDOWS\system32\SHELL32.dll
    WebCheck: D:\WINDOWS\System32\webcheck.dll
    SysTray: D:\WINDOWS\System32\stobject.dll
    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

    *Registry key not found*

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

    *No values found*

    End of report, 38,456 bytes
    Report generated in 0.187 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full - to include several rarely-important sections
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only


    Thanks again for looking!
  • mtunickmtunick
    edited August 2006
    Ok well I've been doing some extensive research on the Acebot virus and as far as I can tell, that is not what you have or at least not badly. I have discovered a fix although crude does have the possibility to work and not cause any real damage to your system or files.

    There is a specific way to remove the Acebot virus(although I don't think you have it), but to use it we have to be sure you have the specific files on your system.

    Go to Folder Options, View, Show hidden files and folders. Then search for ntip32.dll , mscf.exe , ipdo32.exe.

    If you do not find any of these the way that I was originally speaking of is this:

    Step one - Create a new user in windows xp that is different from your logon. You must have administrator rights.

    Step two - Copy and paste ALL of your directories, files, documents etc from your old user account into your new user account.

    Step three - test to make sure that you have transferred every over.

    Step four - delete your old user account.

    Step five - right click on a file that previously activated the virus.

    Step six - have a nice day because you will find that the virus is gone.

    Now as you can see no problems can occur from this and even if it doesn't work there are no issues because all your files should've been transferred over. Ultimately it's your choice.
  • mcdizzle
    edited August 2006
    I don't have any of those three files on my computer, and I tried the user trick before I posted this topic to no avail. It is strange that I don't have any of the log entries of others that had the Acebot Trojan, yet all of my symptoms point to this as being the problem. Any other suggestions?
  • mtunickmtunick
    edited August 2006
    Have you created any System Restore points before the symptoms started ocurring?
  • --9608-Mike--9608---9608-Mike--9608-
    edited August 2006
    Just an observation I have had with System Restore. It sucks. It isn't a good way to restore the computer. I don't even like to get into detail about it. I think it was a waste of Microsofts time. Your better off Formatting the computer because you will probably have to do it in the end.
Sign In or Register to comment.