HiJack This Log. EMERGENCY! Computer pretty much dieing. Please please help ASAP Thx

HomicideHomicide
edited September 2006 in Spyware & Virus Removal
Logfile of HijackThis v1.99.1
Scan saved at 4:07:44 PM, on 8/31/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\dfndrff_15.exe
C:\WINDOWS\sys031590963208.exe
C:\windows\system32\dwdsregt.exe
C:\WINDOWS\System32\mwinlpex.exe
C:\WINDOWS\ncxhnjyA.exe
C:\Program Files\Common Files\{7C128EB3-081A-1033-0604-040825030001}\Update.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\PSLister\PSLister.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Homicide\Desktop\Virus Protectors\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
R3 - URLSearchHook: (no name) - _{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\System32\hllyp.exe
F2 - REG:system.ini: UserInit=userinit.exe,rhrcbpt.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [defender] C:\\dfndrff_15.exe
O4 - HKLM\..\Run: [sys031590963208] C:\WINDOWS\sys031590963208.exe
O4 - HKLM\..\Run: [hgvd455a] RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c
O4 - HKLM\..\Run: [{28-8E-EB-B3-ZN}] C:\windows\system32\dwdsregt.exe GEN001
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\mwinlpex.exe GEN001
O4 - HKLM\..\Run: [loaddr] C:\topaff.exe
O4 - HKLM\..\Run: [ms059096320815] C:\WINDOWS\ms059096320815.exe
O4 - HKLM\..\Run: [ms045909632081] C:\WINDOWS\ms045909632081.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [ncxhnjyA] C:\WINDOWS\ncxhnjyA.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\mwinlpex.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted Zone: *.elitemediagroup.net
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: repairs303169590.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\fp0q03d5e.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SG9taWNpZGU\command.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\ncxhnjy.exe (file missing)


I dont know what is wrong with it. I went to bed last night and it was fine and I wake up this morning and I have all kinds of problems. Please, please help me.

Comments

  • TroganTrogan London, UK
    edited August 2006
    Hi Homicide, you have a lot of malware in your log. Please do the following...

    Download Qoofix by RubbeR DuckY from one of the following locations:

    http://www.malwarebytes.org/Qoofix.zip or
    http://www.besttechie.net/tools/Qoofix.zip
    1. Unzip all files to a convenient location such as C:\Qoofix.
    2. Go to the folder you unzipped all files and run Qoofix.exe.
    3. Click Begin Removal and wait for the scan to finish.
    4. If an infection has been found, select yes to restart your computer.
    A logfile will be created in the C:\Qoofix folder, please keep it safe.

    =====

    Download L2mfix from one of these two locations:

    http://www.atribune.org/downloads/l2mfix.exe
    http://www.downloads.subratam.org/l2mfix.exe

    Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

    IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

    =====

    I would like to see another log from HijackThis.
    • Run Hijackthis.
    • Click on Open the Misc Tools section.
    • Next click on Open uninstall manager.
    • Press the Save list button. It will open a Notepad file.
    • Copy & Paste the entire contents of that file in your in your next post.
    =====

    Please post the following:

    1) Logfile from C:\Qoofix folder
    2) Log from L2MFix
    3) Uninstall list
    4) New HijackThis log
  • HomicideHomicide
    edited August 2006
    Qoofix v1.03 by http://www.malwarebytes.org
    Scan started on [8/31/2006] at [4:32:06 PM]
    No malicious modules found!
    No Qoologic infected files found!
    Scan COMPLETED SUCCESSFULLY on [8/31/2006] at [4:33:21 PM]

    Note: Some registry keys may have been removed.


    _______________________________________________________

    L2MFIX find log 032106
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Applets]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\lv8609lse.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{53564612-9362-3CE7-5EBF-BB85D1168094}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
    "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
    "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
    "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
    "{DBCB1E8A-586C-4DD5-8C47-1C6A506A0903}"=""
    "{E6C46ECA-9853-457F-AD45-9842488B0046}"=""
    "{1E80CE21-51A1-4F28-9034-FB408299309A}"=""

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{DBCB1E8A-586C-4DD5-8C47-1C6A506A0903}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{DBCB1E8A-586C-4DD5-8C47-1C6A506A0903}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{DBCB1E8A-586C-4DD5-8C47-1C6A506A0903}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{DBCB1E8A-586C-4DD5-8C47-1C6A506A0903}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{E6C46ECA-9853-457F-AD45-9842488B0046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E6C46ECA-9853-457F-AD45-9842488B0046}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E6C46ECA-9853-457F-AD45-9842488B0046}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E6C46ECA-9853-457F-AD45-9842488B0046}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{1E80CE21-51A1-4F28-9034-FB408299309A}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1E80CE21-51A1-4F28-9034-FB408299309A}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1E80CE21-51A1-4F28-9034-FB408299309A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1E80CE21-51A1-4F28-9034-FB408299309A}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mcvcrt40.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    aaa00000.dll Thu Aug 31 2006 12:30:06p A.... 61,952 60.50 K
    cmdlin~1.dll Wed Jun 28 2006 9:17:58p A.... 43,520 42.50 K
    en2ul1~1.dll Thu Aug 31 2006 1:49:30p ..S.R 234,775 229.27 K
    hgvd455a.dll Thu Aug 31 2006 12:29:38p A.... 61,952 60.50 K
    lv8609~1.dll Thu Aug 31 2006 1:46:30p ..S.R 235,464 229.95 K
    mcvcrt40.dll Thu Aug 31 2006 4:36:36p ..S.R 235,464 229.95 K
    nsd6b.dll Mon Aug 14 2006 8:52:34p A.... 78,848 77.00 K
    pncrt.dll Fri Jul 7 2006 8:57:12p A.... 278,528 272.00 K
    pndx5016.dll Fri Jul 7 2006 8:57:16p A.... 6,656 6.50 K
    pndx5032.dll Fri Jul 7 2006 8:57:16p A.... 5,632 5.50 K
    px.dll Mon Aug 14 2006 12:43:22p ..... 452,264 441.66 K
    pxdrv.dll Mon Aug 14 2006 12:43:22p ..... 472,744 461.66 K
    pxmas.dll Mon Aug 14 2006 12:43:24p ..... 181,928 177.66 K
    pxwave.dll Mon Aug 14 2006 12:43:24p ..... 345,768 337.66 K
    repair~1.dll Thu Aug 31 2006 12:29:06p ..... 96,768 94.50 K
    rmoc3260.dll Fri Jul 7 2006 8:59:46p A.... 176,167 172.04 K
    sintf16.dll Wed Jun 28 2006 9:15:38p A.... 12,067 11.78 K
    sintf32.dll Wed Jun 28 2006 9:15:40p A.... 17,212 16.81 K
    sintfnt.dll Wed Jun 28 2006 9:15:40p A.... 21,840 21.33 K
    vxblock.dll Mon Aug 14 2006 12:43:24p ..... 38,568 37.66 K

    20 items found: 20 files (3 H/S), 0 directories.
    Total of file sizes: 3,058,117 bytes 2.91 M
    Locate .tmp files:

    C:\WINDOWS\SYSTEM32\
    ~glh0001.tmp Thu Aug 31 2006 12:31:04p A.... 32,768 32.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 32,768 bytes 32.00 K
    **********************************************************************************
    Directory Listing of system files:
    Volume in drive C has no label.
    Volume Serial Number is 7C12-8EB3

    Directory of C:\WINDOWS\System32

    08/31/2006 04:39 PM <DIR> ..
    08/31/2006 04:39 PM <DIR> .
    08/31/2006 04:36 PM 235,464 mcvcrt40.dll
    08/31/2006 01:49 PM 234,775 en2ul1f91.dll
    08/31/2006 01:46 PM 235,464 lv8609lse.dll
    06/17/2006 05:34 PM <DIR> dllcache
    01/06/2004 12:39 AM <DIR> Microsoft
    03/29/2003 12:42 AM 9,216 Thumbs.db
    4 File(s) 714,919 bytes
    4 Dir(s) 25,563,738,112 bytes free

    _____________________________________________________

    Uninstall log?

    _____________________________________________________

    Logfile of HijackThis v1.99.1
    Scan saved at 4:43:13 PM, on 8/31/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\dfndrff_15.exe
    C:\WINDOWS\sys031590963208.exe
    C:\windows\system32\dwdsregt.exe
    C:\WINDOWS\System32\mwinlpex.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\ms059096320815.exe
    C:\WINDOWS\ms045909632081.exe
    C:\WINDOWS\ncxhnjyA.exe
    C:\Program Files\Common Files\{7C128EB3-081A-1033-0604-040825030001}\Update.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\PSLister\PSLister.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\Duce6.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\System32\cmd.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Homicide\Desktop\Virus Protectors\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R3 - URLSearchHook: (no name) - _{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [defender] C:\\dfndrff_15.exe
    O4 - HKLM\..\Run: [sys031590963208] C:\WINDOWS\sys031590963208.exe
    O4 - HKLM\..\Run: [hgvd455a] RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c
    O4 - HKLM\..\Run: [{28-8E-EB-B3-ZN}] C:\windows\system32\dwdsregt.exe GEN001
    O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\mwinlpex.exe GEN001
    O4 - HKLM\..\Run: [loaddr] C:\topaff.exe
    O4 - HKLM\..\Run: [ms059096320815] C:\WINDOWS\ms059096320815.exe
    O4 - HKLM\..\Run: [ms045909632081] C:\WINDOWS\ms045909632081.exe
    O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
    O4 - HKLM\..\Run: [ncxhnjyA] C:\WINDOWS\ncxhnjyA.exe
    O4 - HKLM\..\Run: [themonitor] C:\WINDOWS\Duce6.exe
    O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
    O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\mwinlpex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O15 - Trusted Zone: *.elitemediagroup.net
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - AppInit_DLLs: repairs303169590.dll
    O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\lv8609lse.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SG9taWNpZGU\command.exe (file missing)
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\ncxhnjy.exe (file missing)
  • TroganTrogan London, UK
    edited August 2006
    Can you post the Uninstall list please.
  • HomicideHomicide
    edited August 2006
    Absolute Poker Basic
    Ad-Aware SE Personal
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Download Manager 2.0 (Remove Only)
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Stock Photos 1.0
    Adobe Stock Photos 1.0
    AOL Instant Messenger
    BearFlix
    BearShare
    CC_ccStart
    ccCommon
    CCleaner (remove only)
    C-Media WDM Audio Driver
    DivX
    DivX Player
    Enhanced Ads by Think-Adz removal
    ewido anti-malware
    HijackThis 1.99.1
    Internet Explorer Q831167
    J2SE Runtime Environment 5.0 Update 6
    LiveReg (Symantec Corporation)
    LiveUpdate 1.90 (Symantec Corporation)
    Macromedia Flash Player 8
    Macromedia Shockwave Player
    Microsoft .NET Framework 1.1
    Microsoft Office 2000 Premium
    Microsoft Windows Journal Viewer
    Mozilla Firefox (1.5.0.6)
    MSN Messenger 7.5
    MSRedist
    Norton AntiVirus 2004
    Norton AntiVirus 2004 (Symantec Corporation)
    Norton AntiVirus Parent MSI
    Norton WMI Update
    Outlook Express Q837009
    PowerDVD
    QuickTime
    RealPlayer
    S3 S3Display
    S3 S3Gamma2
    S3 S3Info2
    S3 S3Overlay
    Search Enhancer
    Sierra Utilities
    Snes9x
    Spybot - Search & Destroy 1.3
    Spyware Doctor 3.2
    Sunbelt Kerio Personal Firewall
    Surf SideKick
    Symantec Script Blocking Installer
    SymNet
    Tibia 7.72
    Windows Overlay Components
    WinRAR archiver
    XoftSpy




    sorry im kind of slow sometimes.
  • TroganTrogan London, UK
    edited August 2006
    Please do the following...

    Click Start > Run > type in appwiz.cpl and hit enter. From the list uninstall the following, if present:

    Enhanced Ads by Think-Adz removal
    Surf SideKick
    Windows Overlay Components

    The following are old versions of the programs
    ewido anti-malware
    Spybot - Search & Destroy 1.3

    Download Spybot - Search & Destroy 1.4 from here. We will download Ewido later on.

    =====

    Please download and unzip Ren-cmdservice to your desktop.
    It will only work correctly if the folder is placed on your desktop and extracted.

    ren-cmdservice.zip

    Open the ren-cmdservice folder by doubleclicking it and then doubleclick the
    ren-cmdservice.bat file to run the program.
    A text will open when it is finished, Post it please.
    Then restart the PC run SpyBot check for and fix any problems found.


    Please post the report from ren-cmdservice tool, a new HijackThis log, and a new uninstall list.
  • HomicideHomicide
    edited August 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 6:07:19 PM, on 8/31/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\dfndrff_15.exe
    C:\WINDOWS\sys031590963208.exe
    C:\WINDOWS\ms045909632081.exe
    C:\WINDOWS\ncxhnjyA.exe
    C:\WINDOWS\Duce6.exe
    C:\Program Files\Common Files\{7C128EB3-081A-1033-0604-040825030001}\Update.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\PSLister\PSLister.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Documents and Settings\Homicide\Desktop\Virus Protectors\HijackThis.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R3 - URLSearchHook: (no name) - _{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [defender] C:\\dfndrff_15.exe
    O4 - HKLM\..\Run: [sys031590963208] C:\WINDOWS\sys031590963208.exe
    O4 - HKLM\..\Run: [hgvd455a] RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c
    O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\mwinlpex.exe GEN001
    O4 - HKLM\..\Run: [loaddr] C:\topaff.exe
    O4 - HKLM\..\Run: [ms059096320815] C:\WINDOWS\ms059096320815.exe
    O4 - HKLM\..\Run: [ms045909632081] C:\WINDOWS\ms045909632081.exe
    O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
    O4 - HKLM\..\Run: [ncxhnjyA] C:\WINDOWS\ncxhnjyA.exe
    O4 - HKLM\..\Run: [themonitor] C:\WINDOWS\Duce6.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
    O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\mwinlpex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O15 - Trusted Zone: *.elitemediagroup.net
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\en2ul1f91.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    _____________________________________________________

    Absolute Poker Basic
    Ad-Aware SE Personal
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Download Manager 2.0 (Remove Only)
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Stock Photos 1.0
    Adobe Stock Photos 1.0
    AOL Instant Messenger
    BearFlix
    BearShare
    CC_ccStart
    ccCommon
    CCleaner (remove only)
    C-Media WDM Audio Driver
    DivX
    DivX Player
    ewido anti-malware
    HijackThis 1.99.1
    Internet Explorer Q831167
    J2SE Runtime Environment 5.0 Update 6
    LiveReg (Symantec Corporation)
    LiveUpdate 1.90 (Symantec Corporation)
    Macromedia Flash Player 8
    Macromedia Shockwave Player
    Microsoft .NET Framework 1.1
    Microsoft Office 2000 Premium
    Microsoft Windows Journal Viewer
    Mozilla Firefox (1.5.0.6)
    MSN Messenger 7.5
    MSRedist
    Norton AntiVirus 2004
    Norton AntiVirus 2004 (Symantec Corporation)
    Norton AntiVirus Parent MSI
    Norton WMI Update
    Outlook Express Q837009
    PowerDVD
    QuickTime
    RealPlayer
    S3 S3Display
    S3 S3Gamma2
    S3 S3Info2
    S3 S3Overlay
    Search Enhancer
    Sierra Utilities
    Snes9x
    Spybot - Search & Destroy 1.4
    Spyware Doctor 3.2
    Sunbelt Kerio Personal Firewall
    Symantec Script Blocking Installer
    SymNet
    Tibia 7.72
    WinRAR archiver
    XoftSpy

    _____________________________________________________

    Running from C:\Documents and Settings\Homicide\Desktop\ren-cmdservice
    Folder Present C:\WINDOWS\SG9taWNpZGU
    C:\WINDOWS\SG9taWNpZGU\m36QuqhDt3o.vbs
    C:\Documents and Settings\LocalService\Application Data\NetMon
    Deleting cmdservice key
    [SWSC] DeleteService SUCCESS
    cmdservice key deleted
    ..
    Commandline utilities (SWReg and SWSC)
    Written by Bobbi Flekman © 2005
    Finised, Post this text then
    Please Restart your PC
    ren-cmdservice.bat edited 6-25-2006


    thanks for your help. Its appreciated it alot.
  • TroganTrogan London, UK
    edited August 2006
    Close any browsers and programs you have open since this step requires a reboot.

    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot. After the reboot notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

    IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
    If after the reboot the log does not open double click on it in the l2mfix folder.

    =====

    1. Download this file - combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your next reply, along with a new HijackThis log

    Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    =====
  • HomicideHomicide
    edited August 2006
    Running from C:\Documents and Settings\Homicide\Desktop\ren-cmdservice
    Folder Present C:\WINDOWS\SG9taWNpZGU
    C:\WINDOWS\SG9taWNpZGU\m36QuqhDt3o.vbs
    C:\Documents and Settings\LocalService\Application Data\NetMon
    Deleting cmdservice key
    [SWSC] DeleteService SUCCESS
    cmdservice key deleted
    ..
    Commandline utilities (SWReg and SWSC)
    Written by Bobbi Flekman © 2005
    Finised, Post this text then
    Please Restart your PC
    ren-cmdservice.bat edited 6-25-2006

    ___________________________________________________

    Homicide - 06-08-31 18:39:05.40
    ComboFix 06.08.30BT - Running from: C:\Documents and Settings\Homicide\Desktop

    ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))


    Granting sedebugprivilege to Administrators ... successful


    (((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\Duce6.exe
    C:\dfndrff_15.exe
    C:\kybrdff_15.exe
    C:\nwnmff_15.exe
    C:\WINDOWS\system32\aaa00000.dll
    C:\WINDOWS\system32\aaa00000.sys
    C:\xz.exe
    C:\WINDOWS\csvhost.exe
    C:\WINDOWS\justin.exe
    C:\WINDOWS\uninst104.exe
    C:\Program Files\Common Files\Download\mc-110-12-0000352.exe
    C:\Program Files\Common Files\download
    C:\Program Files\Deskbar
    C:\Program Files\PSLister
    C:\Program Files\Common Files\{7C128EB3-081A-1033-0604-040825030001}


    ((((((((((((((((((((((((((((((( Files Created from 2006-07-31 to 2006-08-31 ))))))))))))))))))))))))))))))))))


    2006-08-31 16:37 126,976 --a
    C:\WINDOWS\system32\ieserv.exe
    2006-08-31 12:33 45,076 --a
    C:\WINDOWS\system32\okdsregj.exe
    2006-08-31 12:30 251,262 --a
    C:\deskbar2.exe
    2006-08-31 12:30 215,308 --a
    C:\WINDOWS\Setup90.exe
    2006-08-31 12:30 2,560 --a
    C:\WINDOWS\ac3_0002.exe
    2006-08-31 12:30 186,219 --a
    C:\WINDOWS\srvefkmvml.exe
    2006-08-31 12:30 15,104 --a
    C:\WINDOWS\system32\stonedrv.exe
    2006-08-31 12:30 146 --a
    C:\WINDOWS\file.bat
    2006-08-31 12:30 139,264 --a
    C:\WINDOWS\MirarSetup_876075.exe
    2006-08-31 12:30 115,160 --a
    C:\WINDOWS\Eim03.exe
    2006-08-31 12:29 926 --a
    C:\WINDOWS\system32\winpfg32.sys
    2006-08-31 12:29 614,816 -r-hs---- C:\WINDOWS\ncxhnjyA.exe
    2006-08-31 12:29 61,952 --a
    C:\WINDOWS\system32\hgvd455a.dll
    2006-08-31 12:29 53,248 --a
    C:\topaff.exe
    2006-08-31 12:29 45,056 --a
    C:\TIGEN001.exe
    2006-08-31 12:29 353,280 --a
    C:\803_104.exe
    2006-08-31 12:29 2,560 --a
    C:\ac3_0003.exe
    2006-08-31 12:29 186,223 --a
    C:\WINDOWS\srvgwedegf.exe
    2006-08-31 12:29 168,076 --a
    C:\WINDOWS\system32\mwinlpex.exe
    2006-08-31 12:29 1,233 --a
    C:\WINDOWS\system32\hgvd455a.sys
    2006-08-31 12:28 365,568 --a
    C:\814.exe
    2006-08-31 12:28 215,308 --a
    C:\WINDOWS\srvfspvpxq.exe
    2006-08-31 12:28 159,744 --a
    C:\WINDOWS\sys031590963208.exe
    2006-08-21 18:41 159,744 --a
    C:\WINDOWS\ms059096320815.exe
    2006-08-21 18:41 159,744 --a
    C:\WINDOWS\ms045909632081.exe
    2006-08-21 16:48 53,248 --a
    C:\WINDOWS\uni_ehhhh.exe
    2006-08-14 20:52 78,848 --a
    C:\WINDOWS\system32\nsd6B.dll


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


    2006-08-31 18:41
    d
    C:\Program Files\Common Files
    2006-08-31 18:37
    d
    C:\Program Files\Mozilla Firefox
    2006-08-31 15:07
    d
    C:\Program Files\ewido anti-malware
    2006-08-31 13:17
    d
    C:\Program Files\XoftSpy
    2006-08-31 13:04
    d
    C:\Program Files\Yahoo!
    2006-08-31 13:01
    d--h
    C:\Program Files\WindowsUpdate
    2006-08-31 13:01
    d
    C:\Program Files\Common Files\fiuo
    2006-08-31 12:30
    d
    C:\Program Files\Common Files\misc002
    2006-08-31 12:14
    d
    C:\Program Files\illiminable
    2006-08-30 21:40
    d
    C:\Program Files\Tibia
    2006-08-24 20:26
    d---s---- C:\Documents and Settings\Homicide\Application Data\Microsoft
    2006-08-22 23:36
    d
    C:\Program Files\BearFlix
    2006-08-20 20:41
    d
    C:\Program Files\Absolute Poker Basic
    2006-08-16 12:42
    d
    C:\Program Files\Common Files\Adobe
    2006-08-16 12:31
    d
    C:\Program Files\AnalogX
    2006-08-14 12:43 36528
    C:\WINDOWS\system32\drivers\PxHelp20.sys
    2006-08-14 12:43 115880
    C:\WINDOWS\system32\pxinsi64.exe
    2006-08-14 12:43 114856
    C:\WINDOWS\system32\pxcpyi64.exe
    2006-08-06 21:39 338 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb1942.dat
    2006-08-05 18:50
    d
    C:\Documents and Settings\Homicide\Application Data\AVG7
    2006-08-02 17:40
    d
    C:\Program Files\Sierra On-Line
    2006-08-02 13:51
    d
    C:\Program Files\BearShare
    2006-08-02 13:48
    d
    C:\Program Files\Norton AntiVirus
    2006-08-02 13:47
    d
    C:\Program Files\Common Files\Symantec Shared
    2006-08-02 13:24
    d
    C:\Program Files\Symantec
    2006-08-02 13:23
    d
    C:\Program Files\MyGlobalSearch
    2006-08-02 13:22 13046 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb5436.dat
    2006-08-02 13:22 122880 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb4827.dat
    2006-08-02 13:22 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb4604.dat
    2006-07-17 15:09 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb153.dat
    2006-07-07 21:22
    d
    C:\Documents and Settings\Homicide\Application Data\Real
    2006-07-07 21:00
    d
    C:\Program Files\Common Files\xing shared
    2006-07-07 20:59
    d
    C:\Program Files\Common Files\Real
    2006-07-07 20:54
    d
    C:\Program Files\Real
    2006-06-28 21:17 43520 --a
    C:\WINDOWS\system32\CmdLineExt03.dll
    2006-06-28 21:15 21840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
    2006-06-28 21:15 17212 --a----t- C:\WINDOWS\system32\SIntf32.dll
    2006-06-28 21:15 12067 --a----t- C:\WINDOWS\system32\SIntf16.dll
    2006-06-28 04:15 23 --a
    C:\Documents and Settings\Homicide\Application Data\inifile41.ini
    2006-06-28 04:15 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb3902.dat
    2006-06-28 04:15 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb2391.dat
    2006-06-28 04:15 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb1538.dat
    2006-06-22 15:24 857 --a
    C:\Documents and Settings\Homicide\Application Data\AdobeDLM.log
    2006-06-22 15:24 0 --a
    C:\Documents and Settings\Homicide\Application Data\dm.ini


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

    *Note* empty entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
    "BluetoothAuthenticationAgent"="rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent"
    "VTTimer"="VTTimer.exe"
    "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
    "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
    "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
    "sys031590963208"="C:\\WINDOWS\\sys031590963208.exe"
    "ACTX1"=""
    "hgvd455a"="RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c"
    "loaddr"="C:\\topaff.exe"
    "ms059096320815"="C:\\WINDOWS\\ms059096320815.exe"
    "ms045909632081"="C:\\WINDOWS\\ms045909632081.exe"
    "ncxhnjyA"="C:\\WINDOWS\\ncxhnjyA.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "NoChange"="1"
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "Installed"="1"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
    "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
    "PSLister"="\"C:\\Program Files\\PSLister\\PSLister.exe\""
    "actx1"=""
    "themonitor"=""

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    "dontdisplaylastusername"=dword:00000000
    "legalnoticecaption"=""
    "legalnoticetext"=""
    "shutdownwithoutlogon"=dword:00000001
    "undockwithoutlogon"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
    "DeskHtmlVersion"=dword:00000110
    "DeskHtmlMinorVersion"=dword:00000005
    "Settings"=dword:00000001
    "GeneralFlags"=dword:00000000

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
    "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AIM]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="aim"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="iTunesHelper"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MsnMsgr]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="msnmsgr"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="qttask"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="jusched"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Symantec NetDriver Monitor]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="SNDMon"
    "hkey"="HKLM"
    "command"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\XoftSpy]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="XoftSpy"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\XoftSpy\\XoftSpy.exe -s"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Yahoo! Pager]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="YAHOOM~1"
    "hkey"="HKCU"
    "command"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
    "inimapping"="0"



    Contents of the 'Scheduled Tasks' folder
    C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
    C:\WINDOWS\tasks\Symantec NetDetect.job

    Completion time: Thu 08/31/2006 18:42:14.76
    ComboFix.txt


    _________________________________________________

    Logfile of HijackThis v1.99.1
    Scan saved at 6:46:00 PM, on 8/31/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\system32\cscript.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\System32\RunDll32.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\sys031590963208.exe
    C:\WINDOWS\ms059096320815.exe
    C:\WINDOWS\ms045909632081.exe
    C:\WINDOWS\ncxhnjyA.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Documents and Settings\Homicide\Desktop\Virus Protectors\HijackThis.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Messenger\msmsgs.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R3 - URLSearchHook: (no name) - _{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [sys031590963208] C:\WINDOWS\sys031590963208.exe
    O4 - HKLM\..\Run: [hgvd455a] RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c
    O4 - HKLM\..\Run: [loaddr] C:\topaff.exe
    O4 - HKLM\..\Run: [ms059096320815] C:\WINDOWS\ms059096320815.exe
    O4 - HKLM\..\Run: [ms045909632081] C:\WINDOWS\ms045909632081.exe
    O4 - HKLM\..\Run: [ncxhnjyA] C:\WINDOWS\ncxhnjyA.exe
    O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\mwinlpex.exe GEN001
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
    O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\mwinlpex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O15 - Trusted Zone: *.elitemediagroup.net
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • TroganTrogan London, UK
    edited August 2006
    Please do the following....

    You may wish to Print or Save the following instructions, as the internet will not be available once in Safe Mode!

    1) Please download Ewido to your Desktop or to your usual Download Folder.
    http://www.ewido.net/en/download/
    • Install Ewido by double clicking the installer.
    • Follow the prompts. Make sure that Launch Ewido is checked.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
        Note: If the Update now option is grayed out, follow the steps below.
        • Click on Update on the toolbar.
        • Under Manual update, click on the Start Update button.
        • Wait until you see the Update succesfull message.
    • Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update ewido.
    Ewido manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that Ewido is closed before installing the update

    2) Please download Brute Force Uninstaller to your desktop.
    • Right click the BFU folder on your desktop, and choose Extract All
    • Click "Next"
    • In the box to choose where to extract the files to,
    • Click "Browse"
    • Click on the + sign next to "My Computer"
    • Click on "Local Disk (C: ) or whatever your primary drive is
    • Click "Make New Folder"
    • Type in BFU
    • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
    3) RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
    Save it in the same folder you made earlier (c:\BFU).

    Do not do anything with these yet!

    4)Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    Once in Safe Mode:

    5) Close ALL open Windows / Programs / Folders. Please start Ewido and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • Select Automatically generate report after every scan and uncheck Only if threats were found.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
        scan1nx.jpg
    • When done, click the Save Scan Report button.
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.
    6) Then, please go to Start > My Computer and navigate to the C:\BFU folder.
    • Start the Brute Force Uninstaller by doubleclicking BFU.exe
    • Behind the scriptline to execute field click the folder icon foldericon.png and select alcanshorty.bfu
    • Press Execute and let the program do it's job. (You ought to see a progress bar if you did this correctly.)
    • Wait for the complete script execution box to pop up and press OK.
    • Press exit to terminate the BFU program.
    7) Reboot back into normal windows

    8) Rescan with Combofix please and save the new logfile

    9) Post the Ewido log, ComboFix log, and a new HijackThis log
  • HomicideHomicide
    edited August 2006
    Homicide - 06-08-31 21:53:37.09
    ComboFix 06.08.30BT - Running from: C:\Documents and Settings\Homicide\Desktop

    ((((((((((((((((((((((((((((((( Files Created from 2006-07-31 to 2006-08-31 ))))))))))))))))))))))))))))))))))


    2006-08-31 16:37 126,976 --a
    C:\WINDOWS\system32\ieserv.exe
    2006-08-31 12:30 215,308 --a
    C:\WINDOWS\Setup90.exe
    2006-08-31 12:30 186,219 --a
    C:\WINDOWS\srvefkmvml.exe
    2006-08-31 12:30 146 --a
    C:\WINDOWS\file.bat
    2006-08-31 12:30 115,160 --a
    C:\WINDOWS\Eim03.exe
    2006-08-31 12:29 926 --a
    C:\WINDOWS\system32\winpfg32.sys
    2006-08-31 12:29 61,952 --a
    C:\WINDOWS\system32\hgvd455a.dll
    2006-08-31 12:29 186,223 --a
    C:\WINDOWS\srvgwedegf.exe
    2006-08-31 12:29 1,233 --a
    C:\WINDOWS\system32\hgvd455a.sys
    2006-08-31 12:28 365,568 --a
    C:\814.exe
    2006-08-31 12:28 215,308 --a
    C:\WINDOWS\srvfspvpxq.exe
    2006-08-31 12:28 159,744 --a
    C:\WINDOWS\sys031590963208.exe
    2006-08-14 20:52 78,848 --a
    C:\WINDOWS\system32\nsd6B.dll


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


    2006-08-31 21:43
    d
    C:\Program Files\Common Files\misc002
    2006-08-31 19:46
    d
    C:\Program Files\ewido anti-spyware 4.0
    2006-08-31 18:43
    d
    C:\Program Files\Mozilla Firefox
    2006-08-31 18:41
    d
    C:\Program Files\Common Files
    2006-08-31 15:07
    d
    C:\Program Files\ewido anti-malware
    2006-08-31 13:17
    d
    C:\Program Files\XoftSpy
    2006-08-31 13:04
    d
    C:\Program Files\Yahoo!
    2006-08-31 13:01
    d--h
    C:\Program Files\WindowsUpdate
    2006-08-31 13:01
    d
    C:\Program Files\Common Files\fiuo
    2006-08-31 12:14
    d
    C:\Program Files\illiminable
    2006-08-30 21:40
    d
    C:\Program Files\Tibia
    2006-08-24 20:26
    d---s---- C:\Documents and Settings\Homicide\Application Data\Microsoft
    2006-08-22 23:36
    d
    C:\Program Files\BearFlix
    2006-08-20 20:41
    d
    C:\Program Files\Absolute Poker Basic
    2006-08-16 12:42
    d
    C:\Program Files\Common Files\Adobe
    2006-08-16 12:31
    d
    C:\Program Files\AnalogX
    2006-08-14 12:43 36528
    C:\WINDOWS\system32\drivers\PxHelp20.sys
    2006-08-14 12:43 115880
    C:\WINDOWS\system32\pxinsi64.exe
    2006-08-14 12:43 114856
    C:\WINDOWS\system32\pxcpyi64.exe
    2006-08-06 21:39 338 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb1942.dat
    2006-08-05 18:50
    d
    C:\Documents and Settings\Homicide\Application Data\AVG7
    2006-08-02 17:40
    d
    C:\Program Files\Sierra On-Line
    2006-08-02 13:51
    d
    C:\Program Files\BearShare
    2006-08-02 13:48
    d
    C:\Program Files\Norton AntiVirus
    2006-08-02 13:47
    d
    C:\Program Files\Common Files\Symantec Shared
    2006-08-02 13:24
    d
    C:\Program Files\Symantec
    2006-08-02 13:23
    d
    C:\Program Files\MyGlobalSearch
    2006-08-02 13:22 13046 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb5436.dat
    2006-08-02 13:22 122880 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb4827.dat
    2006-08-02 13:22 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb4604.dat
    2006-07-17 15:09 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb153.dat
    2006-07-07 21:22
    d
    C:\Documents and Settings\Homicide\Application Data\Real
    2006-07-07 21:00
    d
    C:\Program Files\Common Files\xing shared
    2006-07-07 20:59
    d
    C:\Program Files\Common Files\Real
    2006-07-07 20:54
    d
    C:\Program Files\Real
    2006-06-28 21:17 43520 --a
    C:\WINDOWS\system32\CmdLineExt03.dll
    2006-06-28 21:15 21840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
    2006-06-28 21:15 17212 --a----t- C:\WINDOWS\system32\SIntf32.dll
    2006-06-28 21:15 12067 --a----t- C:\WINDOWS\system32\SIntf16.dll
    2006-06-28 04:15 23 --a
    C:\Documents and Settings\Homicide\Application Data\inifile41.ini
    2006-06-28 04:15 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb3902.dat
    2006-06-28 04:15 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb2391.dat
    2006-06-28 04:15 0 --a
    C:\Documents and Settings\Homicide\Application Data\internaldb1538.dat
    2006-06-22 15:24 857 --a
    C:\Documents and Settings\Homicide\Application Data\AdobeDLM.log
    2006-06-22 15:24 0 --a
    C:\Documents and Settings\Homicide\Application Data\dm.ini


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

    *Note* empty entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
    "BluetoothAuthenticationAgent"="rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent"
    "VTTimer"="VTTimer.exe"
    "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
    "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
    "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
    "sys031590963208"="C:\\WINDOWS\\sys031590963208.exe"
    "hgvd455a"="RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c"
    "!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "NoChange"="1"
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "Installed"="1"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
    "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
    "actx1"=""
    "themonitor"=""

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    "dontdisplaylastusername"=dword:00000000
    "legalnoticecaption"=""
    "legalnoticetext"=""
    "shutdownwithoutlogon"=dword:00000001
    "undockwithoutlogon"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
    "DeskHtmlVersion"=dword:00000110
    "DeskHtmlMinorVersion"=dword:00000005
    "Settings"=dword:00000001
    "GeneralFlags"=dword:00000000

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
    "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard"
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AIM]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="aim"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="iTunesHelper"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MsnMsgr]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="msnmsgr"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="qttask"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="jusched"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Symantec NetDriver Monitor]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="SNDMon"
    "hkey"="HKLM"
    "command"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\XoftSpy]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="XoftSpy"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\XoftSpy\\XoftSpy.exe -s"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Yahoo! Pager]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="YAHOOM~1"
    "hkey"="HKCU"
    "command"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
    "inimapping"="0"



    Contents of the 'Scheduled Tasks' folder
    C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
    C:\WINDOWS\tasks\Symantec NetDetect.job

    Completion time: Thu 08/31/2006 21:55:25.48
    ComboFix.txt
    ComboFix2.txt

    _________________________________________________

    Logfile of HijackThis v1.99.1
    Scan saved at 9:58:47 PM, on 8/31/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\sys031590963208.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\system32\cscript.exe
    C:\WINDOWS\system32\cscript.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Documents and Settings\Homicide\Desktop\Virus Protectors\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R3 - URLSearchHook: (no name) - _{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [sys031590963208] C:\WINDOWS\sys031590963208.exe
    O4 - HKLM\..\Run: [hgvd455a] RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
    O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\mwinlpex.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O15 - Trusted Zone: *.elitemediagroup.net
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    _____________________________________________________________
    ewido anti-spyware - Scan Report

    + Created at: 9:44:05 PM 8/31/2006

    + Scan result:



    C:\Program Files\BearShare\BearShareZangoInstaller.exe/clientax.dll -> Adware.180Solutions : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\l2mfix\backup.zip/dlls/c8000idme80a0.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\l2mfix\backup.zip/dlls/en2ul1f91.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\l2mfix\backup.zip/dlls/rPsmans.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\l2mfix\dlls\c8000idme80a0.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\l2mfix\dlls\en2ul1f91.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\l2mfix\dlls\rPsmans.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
    C:\WINDOWS\MirarSetup_876075.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
    C:\TIGEN001.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\mwinlpex.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\okdsregj.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
    C:\topaff.exe -> Downloader.Agent.aqx : Cleaned with backup (quarantined).
    C:\WINDOWS\ac3_0002.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
    C:\ac3_0003.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
    C:\Program Files\Common Files\misc002\141.exe -> Downloader.TSUpdate.o : Cleaned with backup (quarantined).
    C:\WINDOWS\ncxhnjyA.exe -> Downloader.VB.alu : Cleaned with backup (quarantined).
    C:\803_104.exe -> Dropper.Mudrop.bq : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\stonedrv.exe -> Proxy.Small.bo : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined).
    :mozilla.27:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
    :mozilla.28:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
    :mozilla.29:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
    :mozilla.30:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
    :mozilla.26:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
    :mozilla.34:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
    :mozilla.50:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
    :mozilla.92:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
    :mozilla.31:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
    :mozilla.21:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
    :mozilla.17:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
    :mozilla.44:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@data2.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
    :mozilla.47:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
    :mozilla.48:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined).
    :mozilla.57:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
    :mozilla.58:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
    :mozilla.59:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
    :mozilla.26:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    :mozilla.27:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    :mozilla.28:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    :mozilla.29:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@h.starware[2].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@try.starware[1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
    :mozilla.69:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    :mozilla.70:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    :mozilla.71:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    :mozilla.72:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    :mozilla.39:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.40:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.41:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.42:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.43:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.44:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.45:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.46:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
    :mozilla.22:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
    :mozilla.23:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
    :mozilla.24:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
    :mozilla.22:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    :mozilla.23:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    :mozilla.54:C:\Documents and Settings\Homicide\Application Data\Mozilla\Firefox\Profiles\2oxgcyo9.default\cookies-1.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Cookies\homicide@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\Movies and Music\Macromedia Dreamweaver 3.0 Crack by OSCARia.zip/setup.exe -> Trojan.Crypt.e : Cleaned with backup (quarantined).
    C:\Documents and Settings\Homicide\Desktop\Movies and Music\Macromedia Dreamweaver 3.0 Serial.zip/setup.exe -> Trojan.Crypt.e : Cleaned with backup (quarantined).
    C:\WINDOWS\ms045909632081.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
    C:\WINDOWS\ms059096320815.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).
    C:\WINDOWS\uni_ehhhh.exe -> Trojan.VB.tg : Cleaned with backup (quarantined).


    ::Report end
  • TroganTrogan London, UK
    edited August 2006
    Please download Killbox and save it to your desktop.

    Next, copy everything in the Quote box below by pressing Ctrl+C
    C:\WINDOWS\system32\ieserv.exe
    C:\WINDOWS\Setup90.exe
    C:\WINDOWS\srvefkmvml.exe
    C:\WINDOWS\Eim03.exe
    C:\WINDOWS\system32\winpfg32.sys
    C:\WINDOWS\system32\hgvd455a.dll
    C:\WINDOWS\srvgwedegf.exe
    C:\WINDOWS\system32\hgvd455a.sys
    C:\814.exe
    C:\WINDOWS\srvfspvpxq.exe
    C:\WINDOWS\sys031590963208.exe
    C:\WINDOWS\system32\nsd6B.dll
    Next, open Killbox
    Go to File tab and select Paste from Clipboard
    Select the Delete on Reboot option
    Select All Files
    Now click on the Red Circle with the White X
    Press Yes to reboot your computer.

    Once rebooted, continue below
    • Please go to Jotti's malware scan
    • Copy and paste the following file path into the "File to upload & scan" box on the top of the page:
    • C:\WINDOWS\system32\cscript.exe
    • Click on the submit button
    • Please post the results in your next reply.
  • HomicideHomicide
    edited August 2006
    Service load:
    0% 100%
    File: cscript.exe
    Status:
    OK
    MD5 00f7e24a0be30a4fe529802c939a9291
    Packers detected:
    -
    Scanner results
    AntiVir
    Found nothing
    ArcaVir
    Found nothing
    Avast
    Found nothing
    AVG Antivirus
    Found nothing
    BitDefender
    Found nothing
    ClamAV
    Found nothing
    Dr.Web
    Found nothing
    F-Prot Antivirus
    Found nothing
    Fortinet
    Found nothing
    Kaspersky Anti-Virus
    Found nothing
    NOD32
    Found nothing
    Norman Virus Control
    Found nothing
    UNA
    Found nothing
    VirusBuster
    Found nothing
    VBA32
    Found nothing
  • TroganTrogan London, UK
    edited August 2006
    Cool...almost finished!

    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
    • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications."
    • Click the "Download" button to the right.
    • Check the box that says: "Accept License Agreement."
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove the following...
      • J2SE Runtime Environment 5.0 Update 6
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version.
    =====

    Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    R3 - URLSearchHook: (no name) - _{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

    O4 - HKLM\..\Run: [sys031590963208] C:\WINDOWS\sys031590963208.exe
    O4 - HKLM\..\Run: [hgvd455a] RUNDLL32.EXE w0054d4c.dll,n 003d4557000000030054d4c

    O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
    O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\mwinlpex.exe

    O15 - Trusted Zone: *.elitemediagroup.net

    - Close ALL open windows (especially Internet Explorer!)
    Click Fix Checked

    =====

    We need to view hidden files and folders:
    • Click Start.
    • Open My Computer.
    • Select the Tools menu and click Folder Options.
    • Select the View Tab.
    • Under the Hidden files and folders heading select Show hidden files and folders.
    • Uncheck the Hide protected operating system files (recommended) option.
    • Click Yes to confirm.
    • Click OK.
    =====

    Find and Delete the following, if found:

    C:\WINDOWS\sys031590963208.exe << this file
    C:\WINDOWS\System32\w0054d4c.dll << this file
    C:\WINDOWS\System32\hgvd455a.sys << this file
    C:\WINDOWS\system32\dwdsregt.exe << this file
    C:\WINDOWS\system32\mwinlpex.exe << this file

    =====

    Reboot and post a new HijackThis log. Let me know how things are. :)
  • HomicideHomicide
    edited August 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 11:45:57 PM, on 8/31/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Documents and Settings\Homicide\Desktop\Virus Protectors\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neoseeker.com/forums/index.php?fn=browse_forum&f=118
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe




    Well it seems to be working, but I have a couple general questions for you now. I dont want my AIM or MSN messengers to start up after each reboot or whatever, but when I change them after a day or so they go right back to coming back at the start up. How do I fix that problem?


    and thanks for all the help.
  • TroganTrogan London, UK
    edited August 2006
    Thats an easy fix :)

    Go to Start > Run > type in: msconfig press OK
    Go to the Startup tab
    Uncheck the entries for AIM and MSN Messenger
    Click Apply > Close > Restart

    When the computer has restarted, a message box will popup...just check the box and press OK.

    Let me know if I can help with anything else or if we can mark this resolved?
  • HomicideHomicide
    edited September 2006
    Ok I did that but its still not working. Oh well its no biggie. This can be marked as resolved. Thanks a bunch I appreciate it alot.
  • TroganTrogan London, UK
    edited September 2006
    That should have worked if you unchecked the right entries.

    You can remove these HijackThis entries and it will stop them from popping up:

    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    Let me know if that worked. :)
  • HomicideHomicide
    edited September 2006
    thanks a bunch man. It worked. You are the best
  • TroganTrogan London, UK
    edited September 2006
    Your welcome! :)

    I'l mark this resolved! :)
This discussion has been closed.