Options

CTFMON.exe

Unknown
edited September 2006 in Spyware & Virus Removal
Hi Guys

My buddy has a compaq computer. He has a problem with a high cpu usage. Normally about 100% all the time process being ctfmon.exe I have come to find out that it is a legit file. After doing some research i have come to find out that ctfmon.exe can be related to coolwebsearch. I did find a Hiddendll.exe on cws shredder. Fix and removed it and it hasn,t come back. I have ran Ewido, spybot search and deystroy, adware se, trendmicro, and atf cleaner. I did a system restore and rebooted and it seemed to fine. I left and he called the next day saying that the cpu was back up to 100% He does use internet explorer,and i posted a thread a while back asking about this . I didn't receive a reply, i know that you guys a very busy helping everyone and it prolly didn't help that i was out of town for a couple months. But I'm just plain stuck and no one seems to know what is the problem. I don't know if it is a virus related problem or its a system related problem. The only thing i found was the Hiddendll in cws shredder and some tracking cookies on ewido. If anyone has any ideas or happens to know about this problem if you could shout my way that would be great. I can't give any logs because i have to use my computer to even get on here. I know they would help but the computer just locks up and you can't do nothing on it at all now. It was good yesterday and really bad today. So if anyone could help that would be great cause to tell you the truth i'm tired of messing with it. THANX!!!!:banghead:

Comments

  • TroganTrogan London, UK
    edited August 2006
    I havn't come across an issue with ctfmon.exe using 100% CPU. Is the computer folding?

    You could transfer the logs from the other computer to your computer.


    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases

        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer

        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save as Text button:
        [*]Save the file to your desktop.
      • kcm5539
        edited August 2006
        Thanx for the reply. I will try to get the logs and post them for you. It could be a couple of days though. I will try to post them ASAP.
      • TroganTrogan London, UK
        edited August 2006
        I'l be here when you can. :)
      • kcm5539
        edited September 2006
        Here all the logs. Sorry it took so long to get. No the computer is not folding



        KASPERSKY ONLINE SCANNER REPORT
        Sunday, September 03, 2006 11:59:53 AM
        Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
        Kaspersky Online Scanner version: 5.0.83.0
        Kaspersky Anti-Virus database last update: 3/09/2006
        Kaspersky Anti-Virus database records: 220438


        Scan Settings
        Scan using the following antivirus database extended
        Scan Archives true
        Scan Mail Bases true

        Scan Target My Computer
        C:\
        D:\
        E:\
        G:\
        H:\
        I:\
        J:\

        Scan Statistics
        Total number of scanned objects 63038
        Number of viruses found 3
        Number of infected objects 16 / 0
        Number of suspicious objects 0
        Duration of the scan process 00:57:10

        Infected Object Name Virus Name Last Action
        C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

        C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Cookies\index.dat Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\me_blIOjVSxxKIZAWi Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\me_DxkPVGxQGDA17ic Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\me_ibAVMI5nXm9n0ls Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\me_N2hLSVOWvdErTko Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\me_OIXyxdfg4KKy5uS Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF3992.tmp Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF5473.tmp Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF8AA3.tmp Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\NTUSER.DAT Object is locked skipped

        C:\Documents and Settings\Compaq_Owner\ntuser.dat.LOG Object is locked skipped

        C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

        C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

        C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

        C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

        C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

        C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

        C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

        C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped

        C:\Program Files\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.me Object is locked skipped

        C:\Program Files\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.mm Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\BWKDLogs\BWTargetInf.log Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.idx Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.idx Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\D0000000.FCS Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\inuse.txt Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\L0000002.FCS Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\main.log Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.idx Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.idx Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.idx Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.idx Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.idx Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.dat Object is locked skipped

        C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.idx Object is locked skipped

        C:\Program Files\Trend Micro\Internet Security 2006\Quarantine\C0.tmp Infected: Exploit.JS.CVE-2006-1359.t skipped

        C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

        C:\System Volume Information\_restore{DDE3EB95-4B24-44D8-AD38-1F974B96C2F0}\RP121\change.log Object is locked skipped

        C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

        C:\WINDOWS\Internet Logs\COMPAQ.ldb Object is locked skipped

        C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped

        C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped

        C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped

        C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped

        C:\WINDOWS\SchedLgU.Txt Object is locked skipped

        C:\WINDOWS\SoftwareDistribution\EventCache\{42C55116-CF3F-4F81-A46B-49A5B9ABF374}.bin Object is locked skipped

        C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

        C:\WINDOWS\Sti_Trace.log Object is locked skipped

        C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

        C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

        C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

        C:\WINDOWS\system32\config\default Object is locked skipped

        C:\WINDOWS\system32\config\default.LOG Object is locked skipped

        C:\WINDOWS\system32\config\SAM Object is locked skipped

        C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

        C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

        C:\WINDOWS\system32\config\SECURITY Object is locked skipped

        C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

        C:\WINDOWS\system32\config\software Object is locked skipped

        C:\WINDOWS\system32\config\software.LOG Object is locked skipped

        C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

        C:\WINDOWS\system32\config\system Object is locked skipped

        C:\WINDOWS\system32\config\system.LOG Object is locked skipped

        C:\WINDOWS\system32\h323log.txt Object is locked skipped

        C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

        C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

        C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

        C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

        C:\WINDOWS\Temp\ZLT03fc4.TMP Object is locked skipped

        C:\WINDOWS\Temp\ZLT07b60.TMP Object is locked skipped

        C:\WINDOWS\wiadebug.log Object is locked skipped

        C:\WINDOWS\wiaservc.log Object is locked skipped

        C:\WINDOWS\WindowsUpdate.log Object is locked skipped

        D:\I386\APPS\APP26929\src\da\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\de\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\en\JS\LUREGWMI.EXE Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\es\JS\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\fi\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\fr\JS\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\it\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\ko\JS\LUREGWMI.EXE Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\nl\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\no\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\pt\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\sv\js\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\zh\cn\JS\LUREGWMI.EXE Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        D:\I386\APPS\APP26929\src\zh\tw\JS\LURegWMI.exe Infected: not-a-virus:AdWare.Win32.Dm.n skipped

        Scan process completed.


        Logfile of HijackThis v1.99.1
        Scan saved at 12:30:08 PM, on 9/3/2006
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\ZoneLabs\vsmon.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\spoolsv.exe
        C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
        C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
        C:\Program Files\ewido anti-spyware 4.0\guard.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
        C:\WINDOWS\system32\HPZipm12.exe
        C:\WINDOWS\system32\svchost.exe
        C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
        C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
        C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
        C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
        C:\windows\system\hpsysdrv.exe
        C:\WINDOWS\system32\hkcmd.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\WINDOWS\ALCXMNTR.EXE
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\Program Files\ewido anti-spyware 4.0\ewido.exe
        C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
        C:\Program Files\SpywareGuard\sgmain.exe
        C:\Program Files\SpywareGuard\sgbhp.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Documents and Settings\Compaq_Owner\Desktop\HijackThis.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop
        R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
        O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
        O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
        O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
        O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
        O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
        O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
        O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
        O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
        O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
        O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
        O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
        O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
        O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
        O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
        O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
        O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
        O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
        O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
        O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

        Thanks again
      • TroganTrogan London, UK
        edited September 2006
        There's nothing showing in the Kaspersky log.

        I would like to see another log from HijackThis.
        • Run Hijackthis.
        • Click on Open the Misc Tools section.
        • Next click on Open uninstall manager.
        • Press the Save list button. It will open a Notepad file.
        • Copy & Paste the entire contents of that file in your in your next post.
      • kcm5539
        edited September 2006
        Alrighty, it could be a couple of days. Sorry for waiting on me its just hard to get to. Its not always on top of my list to do's. I do thank you for being patient though. I'll get it as sone as possible.
      • TroganTrogan London, UK
        edited September 2006
        :thumbsup:
      • kcm5539
        edited September 2006
        I have resovled the issue thanks for your time and patience.
      • TroganTrogan London, UK
        edited September 2006
        Your welcome! Can I ask how you resolved it?
      • kcm5539
        edited September 2006
        Well I got just tired of messing with it so I formated the hard drive and reloaded windows. Thats the only way I could fix it. But it worked. I talked to numerous people and nobody had a clue. Thanks again
      • TroganTrogan London, UK
        edited September 2006
        Glad formatting sorted it! :thumbsup:
      Sign In or Register to comment.