Need help, have a keylogger[solved]

mikekess10mikekess10
edited November 2006 in Spyware & Virus Removal
Today, on an online game i play, someone got ahold of my account/password 2 times, after i changed my password. This had lead me to believe i most definitley 100% have a keylogger on my computer. Please help me remove this, as i can not find it . Here is my log file


Logfile of HijackThis v1.99.1
Scan saved at 9:34:46 PM, on 10/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
c:\program files\common files\aol\1102897905\ee\services\antiSpywareApp\ver2_0_7\AOLSP Scheduler.exe
C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\Grisoft\AVG Free\avgwb.dat
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\Rar$EX00.156\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 216.19.0.250 idenupdate.motorola.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - F:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [explorer]
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134677080139
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161991097409
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} (Personal System Administrator Control) - http://206.65.172.231/check/netset//install/gtdowngc.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: explorer - explorer.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: win_spool2 - C:\WINDOWS\SYSTEM32\win_spool2.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Card Adapter (NETDown) - Unknown owner - C:\WINDOWS\smss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
«1345

Comments

  • TroganTrogan London, UK
    edited October 2006
    Hi mikekess10,

    Your log is infected with a Keylogger. :( Please do the following immediately...

    1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

    2. From a clean computer, change *all* your online passwords -- for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

    Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.
    ______________________________

    You have McAfee and AVG as anti-virus programs. Have more than ONE can cause problems. Please uninstall one through Add/Remove programs.
    ______________________________

    I would like to see another log from HijackThis.
    • Run Hijackthis.
    • Click on Open the Misc Tools section.
    • Next click on Open uninstall manager.
    • Press the Save list button.
    • Save the file to your desktop, with the default name of uninstall_list
    • Copy & Paste the entire contents of that file in your in your next post.
    ______________________________

    I need you to scan a file.
    • Please go to Jotti's malware scan
    • Copy and paste the following file path into the "File to upload & scan" box on the top of the page:
    • c:\windows\system32\ou6sound.dll
    • Click on the submit button
    • Please post the results in your next reply.
    ______________________________

    Please post the following:

    1) Scan results
    2) Uninstall list
    3) New HijackThis log

    Please tell me if your having any internet problems
  • mikekess10mikekess10
    edited October 2006
    Ad-Aware SE Personal
    Adobe Download Manager 1.2 (Remove Only)
    Adobe Reader 6.0
    AOL Coach Version 2.0(Build:20041026.5 en)
    AOL Connectivity Services
    AOL Instant Messenger
    AOL Uninstaller
    Ares 1.8.6
    aspi
    Auto Macro Recorder V4.5 Full Version
    AV Voice Changer Software 3.0.89
    AVG Free Edition
    Britannica Ready Reference
    Broadcom Advanced Control Suite
    CCHelp
    CCScore
    Cool Edit Pro 2.0
    Cowabanga by OIN
    CR2
    DAO
    dBpowerAMP Music Converter
    Dell Picture Studio - Dell Image Expert
    Dell Solution Center
    Dell Support
    DivX Player
    DivX Pro Trial
    ESSAdpt
    ESSANUP
    ESSBrwr
    ESSCAM
    ESSCDBK
    ESScore
    ESSCT
    ESSgui
    ESShelp
    ESSini
    ESSPCD
    ESSPDock
    ESSTUTOR
    ESSvpaht
    ESSvpot
    Fraps
    HijackThis 1.99.1
    HLPCCTR
    HLPIndex
    HLPPDOCK
    HLSW v1.0.0.39
    Install_AIMKICKEROFFER
    Intel(R) Extreme Graphics Driver
    iPod for Windows 2005-09-23
    iTunes
    Java 2 Runtime Environment, SE v1.4.2
    Kodak EasyShare software
    KSU
    Macromedia Flash Player 8
    Macromedia Shockwave Player
    Microsoft .NET Framework (English)
    Microsoft .NET Framework (English) v1.0.3705
    Microsoft .NET Framework 1.0 Hotfix (KB886906)
    Microsoft AntiSpyware
    Microsoft Data Access Components KB870669
    MSN Messenger 7.5
    Nero - Burning Rom
    Notifier
    NVIDIA Drivers
    Optimum Online net guide
    OTtBP
    Paint Shop Pro 7
    Panda ActiveScan
    PCDLNCH
    PokerStars
    QuickTime
    RealOne Player
    Registry Mechanic
    RollerCoaster Tycoon
    SFR
    SFR2
    Shockwave
    SmartFTP Client
    Spyware Doctor 3.1
    Steam
    SwiftSwitch
    TeamSpeak 2 RC2
    ToolBar888
    Update for Windows XP (KB898461)
    VCAMCEN
    Ventrilo Client
    Viewpoint Manager (Remove Only)
    Viewpoint Media Player
    Windows Genuine Advantage v1.3.0254.0
    Windows Installer 3.1 (KB893803)
    Windows Installer 3.1 (KB893803)
    Windows Media Format Runtime
    Windows Media Player 10
    Windows Media Player Hotfix [See Q828026 for more information]
    Windows XP Hotfix - KB822603
    Windows XP Hotfix - KB823182
    Windows XP Hotfix - KB824105
    Windows XP Hotfix - KB825119
    Windows XP Hotfix - KB826939
    Windows XP Hotfix - KB828035
    Windows XP Hotfix - KB828741
    Windows XP Hotfix - KB833987
    Windows XP Hotfix - KB835732
    Windows XP Hotfix - KB837001
    Windows XP Hotfix - KB840315
    Windows XP Hotfix - KB840987
    Windows XP Hotfix - KB841356
    Windows XP Hotfix - KB841533
    Windows XP Hotfix - KB841873
    Windows XP Hotfix - KB842773
    Windows XP Hotfix - KB867282
    Windows XP Hotfix - KB871250
    Windows XP Hotfix - KB873333
    Windows XP Hotfix - KB873376
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890047
    Windows XP Hotfix - KB890175
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB890923
    Windows XP Hotfix - KB891711
    Windows XP Hotfix - KB891781
    Windows XP Hotfix - KB893066
    Windows XP Hotfix - KB893086
    Windows XP Hotfix (SP2) Q816843
    WinRAR archiver
    WordPerfect Office 2002
    WordPerfect Office 2002
    World of Warcraft
  • mikekess10mikekess10
    edited October 2006
    File: ou6sound.dll
    Status: OK
    MD5 12c256ffd9739f5ef97f6eb5272b510e
    Packers detected: -
    Scanner results
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    Fortinet Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing
  • mikekess10mikekess10
    edited October 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 10:26:17 PM, on 10/27/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\system32\drivers\KodakCCS.exe
    C:\WINDOWS\smss.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\WINDOWS\System32\ScsiAccess.EXE
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
    c:\program files\common files\aol\1102897905\ee\services\antiSpywareApp\ver2_0_7\AOLSP Scheduler.exe
    C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Grisoft\AVG Free\avgcc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\Rar$EX00.157\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: 216.19.0.250 idenupdate.motorola.com
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - F:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [explorer]
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [msci] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221510_mcinfo.exe /insfin
    O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221540_mcappins.exe /v=3 /cleanup
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM95\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
    O15 - Trusted Zone: *.adgate.info
    O15 - Trusted Zone: *.dollarrevenue.com
    O15 - Trusted Zone: *.imagesrvr.com
    O15 - Trusted Zone: *.matcash.com
    O15 - Trusted Zone: *.snipernet.biz
    O15 - Trusted Zone: *.systemdoctor.com
    O15 - Trusted Zone: *.adgate.info (HKLM)
    O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
    O15 - Trusted Zone: *.imagesrvr.com (HKLM)
    O15 - Trusted Zone: *.matcash.com (HKLM)
    O15 - Trusted Zone: *.snipernet.biz (HKLM)
    O15 - Trusted Zone: *.systemdoctor.com (HKLM)
    O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134677080139
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161991097409
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
    O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} (Personal System Administrator Control) - http://206.65.172.231/check/netset//install/gtdowngc.cab
    O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: explorer - explorer.dll (file missing)
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: win_spool2 - C:\WINDOWS\SYSTEM32\win_spool2.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: Card Adapter (NETDown) - Unknown owner - C:\WINDOWS\smss.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
    O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • mikekess10mikekess10
    edited October 2006
    My internet is fine, I used my laptop to change all my passwords, sorry for the dumb question here but i want to be 100% safe, its just this computer thats keylogged right? what i type on my laptop they cant see even if it uses the same internet connection/router correct? Pretty sure im correct just want to be 100%.
  • TroganTrogan London, UK
    edited October 2006
    Hi mikekess10
    My internet is fine, I used my laptop to change all my passwords, sorry for the dumb question here but i want to be 100% safe, its just this computer thats keylogged right? what i type on my laptop they cant see even if it uses the same internet connection/router correct? Pretty sure im correct just want to be 100%.
    Thats correct!
    _____________________________

    Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

    Let's begin:

    You have HijackThis in your Temp directory. HijackThis will create backups that will be lost/deleted in the Temp directory. Follow the instructions below to install HijackThis in a better location.

    Click here to download HJTsetup.exe, and save it to your desktop.
    • Double click on the HJTsetup.exe icon on your desktop.
    • By default it will install to C:\Program Files\Hijack This.
    • Continue to click Next in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
    • Put a check by Create a desktop icon then click Next again.
    • Continue to follow the rest of the prompts from there.
    • At the final dialogue box click Finish and it will launch Hijack This.
    • Close HijackThis for now.
    _____________________________

    I see you have removed McAfee. This means you do not have a Firewall. Please download one from the list below - They are Free!

    Zone Alarm << I recommend this
    Sunbelt Kerio PF
    Outpost Firewall
    _____________________________

    Click Start > Run > type in appwiz.cpl and hit enter. From the list uninstall the following, if present:

    ToolBar888
    _____________________________

    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it.

    Under Main select the following:
      Windows Temp
      Current User Temp
      All Users Temp
      Temporary Internet Files
      Prefetch
      Java Cache
      *The other boxes are optional*
      Then click the Empty Selected button.

      Click Exit on the Main menu to close the program.
      _____________________________

      Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
      http://www.ewido.net/en/download/
      • Install AVG Anti-Spyware by double clicking the installer.
      • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
      • On the main screen under Your Computer's security.
        • Click on Change state next to Resident shield. It should now change to inactive.
        • Click on Change state next to Automatic updates. It should now change to inactive.
        • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
        • Wait until you see the Update succesfull message.
      • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
      • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
      If you are having problems with the updater, you can use this link to manually update ewido.
      AVG Anti-Spyware manual updates.
      Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update
      _____________________________

      Open HijackThis
      - Click the Do a system scan only button
      - Check the following entries (below)

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

      O1 - Hosts: 216.19.0.250 idenupdate.motorola.com

      O4 - HKLM\..\Run: [explorer]
      O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221540_ mcappins.exe /v=3 /cleanup

      O15 - Trusted Zone: *.adgate.info
      O15 - Trusted Zone: *.dollarrevenue.com
      O15 - Trusted Zone: *.imagesrvr.com
      O15 - Trusted Zone: *.matcash.com
      O15 - Trusted Zone: *.snipernet.biz
      O15 - Trusted Zone: *.systemdoctor.com
      O15 - Trusted Zone: *.adgate.info (HKLM)
      O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
      O15 - Trusted Zone: *.imagesrvr.com (HKLM)
      O15 - Trusted Zone: *.matcash.com (HKLM)
      O15 - Trusted Zone: *.snipernet.biz (HKLM)
      O15 - Trusted Zone: *.systemdoctor.com (HKLM)

      O20 - Winlogon Notify: explorer - explorer.dll (file missing)
      O20 - Winlogon Notify: win_spool2 - C:\WINDOWS\SYSTEM32\win_spool2.dll

      - Close ALL open windows (especially Internet Explorer!)
      - Click Fix Checked
      Close HiajckThis
      _____________________________

      Reboot your computer in Safe Mode.
      • If the computer is running, shut down Windows, and then turn off the power.
      • Wait 30 seconds, and then turn the computer on.
      • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
      • Ensure that the Safe Mode option is selected.
      • Press Enter. The computer then begins to start in Safe mode.
      • Login on your usual account.
      Once in Safe Mode:

      We need to view hidden files and folders:
      • Click Start.
      • Open My Computer.
      • Select the Tools menu and click Folder Options.
      • Select the View Tab.
      • Under the Hidden files and folders heading select Show hidden files and folders.
      • Uncheck the Hide protected operating system files (recommended) option.
      • Click Yes to confirm.
      • Click OK.
      _____________________________

      Next, find and delete the following:

      C:\WINDOWS\SYSTEM32\win_spool2.dll << this file
      C:\WINDOWS\SYSTEM32\explorer.dll << this file
      _____________________________

      Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
      • Click on Scanner on the toolbar.
      • Click on the Settings tab.
        • Under How to act?
          • Click on Recommended Action and choose Quarantine from the popup menu.
        • Under How to scan?
          • All checkboxes should be ticked.
        • Under Possibly unwanted software:
          • All checkboxes should be ticked.
        • Under Reports:
          • Select Automatically generate report after every scan and uncheck Only if threats were found.
        • Under What to scan?
          • Select Scan every file.
      • Click on the Scan tab.
      • Click on Complete System Scan to start the scan process.
      • Let the program scan the machine.
      • When the scan has finished, follow the instructions below.
        IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
        • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
        • At the bottom of the window click on the Apply all Actions button. (3)
          scanavgjk2.jpg
      • When done, click the Save Scan Report button. (4)
        • Click the Save Report as button.
        • Save the report to your Desktop.
      • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes
      . Reboot back into Normal Mode, and post a new HJT log, along with the AVG anti-spyware log.
    • mikekess10mikekess10
      edited October 2006
      I'll start doing all that in a min, but i do have a question, Can the keylogger read things that i copy and paste, or only the actual keys i type?
    • mikekess10mikekess10
      edited October 2006
      Hey , im on my laptop typing to you now. I started up in safemode as u did, changed the settings as u said, went to delete winspool2.dll and it said access is denied , can not delete. the explorer.dll i can not find. What to do??
      btw it says this winspool2.dll file was created in april 2003, if thats of any interest to you.
    • mikekess10mikekess10
      edited October 2006
      my virus protector just "healed" some virus's... Generic2.jvp/services.dll, another cpu.exe virus, rinst.exe virus, and the win spool.dll

      dunno if any was the keylogger and if my problem is fixed or not
    • TroganTrogan London, UK
      edited October 2006
      Post a new HijackThis log and we'll see whats left.
    • mikekess10mikekess10
      edited October 2006
      Logfile of HijackThis v1.99.1
      Scan saved at 11:43:03 AM, on 10/28/2006
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Common Files\Dell\EUSW\Support.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
      C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
      C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\WINDOWS\system32\drivers\KodakCCS.exe
      c:\program files\common files\aol\1102897905\ee\services\antiSpywareApp\ver2_0_7\AOLSP Scheduler.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
      C:\WINDOWS\system32\pctspk.exe
      C:\WINDOWS\System32\ScsiAccess.EXE
      C:\WINDOWS\wanmpsvc.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\Rar$EX00.515\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - F:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
      O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [explorer]
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
      O4 - HKLM\..\Run: [msci] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221510_mcinfo.exe /insfin
      O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221540_mcappins.exe /v=3 /cleanup
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM95\aim.exe
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
      O15 - Trusted Zone: *.adgate.info
      O15 - Trusted Zone: *.dollarrevenue.com
      O15 - Trusted Zone: *.imagesrvr.com
      O15 - Trusted Zone: *.matcash.com
      O15 - Trusted Zone: *.snipernet.biz
      O15 - Trusted Zone: *.systemdoctor.com
      O15 - Trusted Zone: *.adgate.info (HKLM)
      O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
      O15 - Trusted Zone: *.imagesrvr.com (HKLM)
      O15 - Trusted Zone: *.matcash.com (HKLM)
      O15 - Trusted Zone: *.snipernet.biz (HKLM)
      O15 - Trusted Zone: *.systemdoctor.com (HKLM)
      O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
      O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
      O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134677080139
      O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161991097409
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
      O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
      O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
      O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} (Personal System Administrator Control) - http://206.65.172.231/check/netset//install/gtdowngc.cab
      O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - Winlogon Notify: explorer - explorer.dll (file missing)
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O20 - Winlogon Notify: win_spool2 - win_spool2.dll (file missing)
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
      O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
      O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
      O23 - Service: Card Adapter (NETDown) - Unknown owner - C:\WINDOWS\smss.exe (file missing)
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
      O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    • TroganTrogan London, UK
      edited October 2006
      You havn't download the new HijackThis. This is very important, please do that now.

      Please do a search:
      Click Start > Search > All Files and Folders.
      Expand More advanced options and make sure these boxes are checked

      Search system folders
      Search hidden files and folders
      Search subfolders

      Paste this into the Search box at the top:

      explorer.dll

      It will take several mintues, but when it has finished post back ALL the locations found by this file please.
    • mikekess10mikekess10
      edited October 2006
      Link me to where I download the new HijackThis.
    • TroganTrogan London, UK
      edited October 2006
      From my previous post (#7):
      Trogan_1000 wrote:
      You have HijackThis in your Temp directory. HijackThis will create backups that will be lost/deleted in the Temp directory. Follow the instructions below to install HijackThis in a better location.

      Click here to download HJTsetup.exe, and save it to your desktop.
      • Double click on the HJTsetup.exe icon on your desktop.
      • By default it will install to C:\Program Files\Hijack This.
      • Continue to click Next in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
      • Put a check by Create a desktop icon then click Next again.
      • Continue to follow the rest of the prompts from there.
      • At the final dialogue box click Finish and it will launch Hijack This.
      • Close HijackThis for now.
    • mikekess10mikekess10
      edited October 2006
      "Search complete. There are no results to display"
    • mikekess10mikekess10
      edited October 2006
      Is there anyway to check if my computer is sending out information to another IP? i need to get this solved, im paranoid with everything I type.
    • TroganTrogan London, UK
      edited October 2006
      Hi mikekess10
      Is there anyway to check if my computer is sending out information to another IP? i need to get this solved, im paranoid with everything I type.
      I'm not sure, but lets try and get the computer cleaned up as soon as possible. First, make sure you have downloaded the new HijackThis and use it from now on.

      Please do the following...

      Open HijackThis
      - Click the Do a system scan only button
      - Check the following entries (below)

      O4 - HKLM\..\Run: [explorer]
      O4 - HKLM\..\Run: [msci] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221510_ mcinfo.exe /insfin
      O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221540_ mcappins.exe /v=3 /cleanup

      O15 - Trusted Zone: *.adgate.info
      O15 - Trusted Zone: *.dollarrevenue.com
      O15 - Trusted Zone: *.imagesrvr.com
      O15 - Trusted Zone: *.matcash.com
      O15 - Trusted Zone: *.snipernet.biz
      O15 - Trusted Zone: *.systemdoctor.com
      O15 - Trusted Zone: *.adgate.info (HKLM)
      O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
      O15 - Trusted Zone: *.imagesrvr.com (HKLM)
      O15 - Trusted Zone: *.matcash.com (HKLM)
      O15 - Trusted Zone: *.snipernet.biz (HKLM)
      O15 - Trusted Zone: *.systemdoctor.com (HKLM)

      O20 - Winlogon Notify: explorer - explorer.dll (file missing)
      O20 - Winlogon Notify: win_spool2 - win_spool2.dll (file missing)

      - Close ALL open windows (especially Internet Explorer!)
      - Click Fix Checked
      Close HiajckThis

      Reboot your computer in Safe Mode.
      • If the computer is running, shut down Windows, and then turn off the power.
      • Wait 30 seconds, and then turn the computer on.
      • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
      • Ensure that the Safe Mode option is selected.
      • Press Enter. The computer then begins to start in Safe mode.
      • Login on your usual account.
      Once in Safe Mode:

      Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
      • Click on Scanner on the toolbar.
      • Click on the Settings tab.
        • Under How to act?
          • Click on Recommended Action and choose Quarantine from the popup menu.
        • Under How to scan?
          • All checkboxes should be ticked.
        • Under Possibly unwanted software:
          • All checkboxes should be ticked.
        • Under Reports:
          • Select Automatically generate report after every scan and uncheck Only if threats were found.
        • Under What to scan?
          • Select Scan every file.
      • Click on the Scan tab.
      • Click on Complete System Scan to start the scan process.
      • Let the program scan the machine.
      • When the scan has finished, follow the instructions below.
        IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
        • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
        • At the bottom of the window click on the Apply all Actions button. (3)
          scanavgjk2.jpg
      • When done, click the Save Scan Report button. (4)
        • Click the Save Report as button.
        • Save the report to your Desktop.
      • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
      Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware log.
    • mikekess10mikekess10
      edited October 2006
      Before i restart in safe mode, last time i did that, my whole screen was way out of resolution, like all zoomed in, and i could only see like half my desktop icons. After i restarted back into normal mode everything was back to normal. Any ideas before i go back to trying safe mode?
    • TroganTrogan London, UK
      edited October 2006
      Thats how Safe Mode is. I don't know if there's a way to change it, sorry.

      You can run AVG anti-spyware in Normal Mode if you want, but delete the files first in Safe Mode, then run the scan in Normal Mode. Although, AVG anti-spyware is more affective in Safe Mode.
    • mikekess10mikekess10
      edited October 2006
      According to your last post it just says go to safe mode and run the spyware program, I don't see any files to delete?
    • TroganTrogan London, UK
      edited October 2006
      My bad, sorry. Guess I was thinking about another thread. Its upto you if you want to run the scan in Normal Mode or Safe Mode.

      I'll be back in an hour or so.
    • mikekess10mikekess10
      edited October 2006
      ight man np, thanks so much for the help thus far. Ill do the scan and post the results.
    • mikekess10mikekess10
      edited October 2006
      Scan been going about an hour and a half.. like half done.. so far find a trojan Lineage.ajf...
    • TroganTrogan London, UK
      edited October 2006
      Let it do its thing, and stay off the net as much as possible until its finished. :)
    • mikekess10mikekess10
      edited October 2006
      Man , im running world of warcraft in the backround, lagging but working. Anyway, its at about 90% now. will post when its done.
    • mikekess10mikekess10
      edited October 2006
      AVG Anti-Spyware - Scan Report

      + Created at: 9:20:39 PM 10/28/2006

      + Scan result:



      C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP415\A0086342.ocx -> Adware.Gdown : Cleaned with backup (quarantined).
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@2o7[1].txt[/email] -> TrackingCookie.2o7 : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@msnportal.112.2o7[1].txt[/email] -> TrackingCookie.2o7 : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@advertising[2].txt[/email] -> TrackingCookie.Advertising : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@atdmt[2].txt[/email] -> TrackingCookie.Atdmt : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@doubleclick[1].txt[/email] -> TrackingCookie.Doubleclick : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@fastclick[2].txt[/email] -> TrackingCookie.Fastclick : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@counter2.hitslink[1].txt[/email] -> TrackingCookie.Hitslink : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@mediaplex[1].txt[/email] -> TrackingCookie.Mediaplex : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@questionmarket[2].txt[/email] -> TrackingCookie.Questionmarket : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@edge.ru4[1].txt[/email] -> TrackingCookie.Ru4 : Cleaned.
      C:\Documents and Settings\Valued Customer\Cookies\valued [email]customer@tribalfusion[1].txt[/email] -> TrackingCookie.Tribalfusion : Cleaned.
      C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP415\A0086341.exe -> Trojan.Lineage.ajf : Cleaned with backup (quarantined).


      ::Report end
    • mikekess10mikekess10
      edited October 2006
      New HiJack this


      Logfile of HijackThis v1.99.1
      Scan saved at 9:21:58 PM, on 10/28/2006
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Common Files\Dell\EUSW\Support.exe
      C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
      C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
      C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\WINDOWS\system32\drivers\KodakCCS.exe
      c:\program files\common files\aol\1102897905\ee\services\antiSpywareApp\ver2_0_7\AOLSP Scheduler.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Common Files\AOL\1102897905\ee\AOLServiceHost.exe
      C:\WINDOWS\system32\pctspk.exe
      C:\WINDOWS\System32\ScsiAccess.EXE
      C:\WINDOWS\wanmpsvc.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
      F:\Program Files\AIM95\aim.exe
      F:\Program Files\AutoMacroRecorder\auto.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Hijackthis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - F:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
      O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1102897905\ee\AOLHostManager.exe
      O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
      O4 - HKLM\..\Run: [explorer]
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
      O4 - HKLM\..\Run: [msci] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221510_mcinfo.exe /insfin
      O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221540_mcappins.exe /v=3 /cleanup
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Program Files\AIM95\aim.exe
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\ou6sound.dll
      O15 - Trusted Zone: *.adgate.info
      O15 - Trusted Zone: *.dollarrevenue.com
      O15 - Trusted Zone: *.imagesrvr.com
      O15 - Trusted Zone: *.matcash.com
      O15 - Trusted Zone: *.snipernet.biz
      O15 - Trusted Zone: *.systemdoctor.com
      O15 - Trusted Zone: *.adgate.info (HKLM)
      O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
      O15 - Trusted Zone: *.imagesrvr.com (HKLM)
      O15 - Trusted Zone: *.matcash.com (HKLM)
      O15 - Trusted Zone: *.snipernet.biz (HKLM)
      O15 - Trusted Zone: *.systemdoctor.com (HKLM)
      O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
      O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
      O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134677080139
      O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161991097409
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
      O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
      O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
      O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} (Personal System Administrator Control) - http://206.65.172.231/check/netset//install/gtdowngc.cab
      O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - Winlogon Notify: explorer - explorer.dll (file missing)
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O20 - Winlogon Notify: win_spool2 - win_spool2.dll (file missing)
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
      O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
      O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
      O23 - Service: Card Adapter (NETDown) - Unknown owner - C:\WINDOWS\smss.exe (file missing)
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
      O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    • TroganTrogan London, UK
      edited October 2006
      Please do the following...

      Copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.
      @echo off
      sc stop NETDown
      sc delete NETDown
      exit
      Double click FixServices.bat. A window will open and close. This is normal.
      ________________________

      Reboot in Safe Mode, because we need to delete some stuff.

      Once in Safe Mode, do the following...

      Open HijackThis
      - Click the Do a system scan only button
      - Check the following entries (below)

      O4 - HKLM\..\Run: [explorer]
      O4 - HKLM\..\Run: [msci] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221510_ mcinfo.exe /insfin
      O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\VALUED~1\LOCALS~1\Temp\20061027221540_ mcappins.exe /v=3 /cleanup

      O15 - Trusted Zone: *.adgate.info
      O15 - Trusted Zone: *.dollarrevenue.com
      O15 - Trusted Zone: *.imagesrvr.com
      O15 - Trusted Zone: *.matcash.com
      O15 - Trusted Zone: *.snipernet.biz
      O15 - Trusted Zone: *.systemdoctor.com
      O15 - Trusted Zone: *.adgate.info (HKLM)
      O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
      O15 - Trusted Zone: *.imagesrvr.com (HKLM)
      O15 - Trusted Zone: *.matcash.com (HKLM)
      O15 - Trusted Zone: *.snipernet.biz (HKLM)
      O15 - Trusted Zone: *.systemdoctor.com (HKLM)

      O20 - Winlogon Notify: explorer - explorer.dll (file missing)
      O20 - Winlogon Notify: win_spool2 - win_spool2.dll (file missing)

      O23 - Service: Card Adapter (NETDown) - Unknown owner - C:\WINDOWS\smss.exe (file missing)

      - Close ALL open windows (especially Internet Explorer!)
      - Click Fix Checked
      Close HiajckThis
      ________________________

      Find and Delete the following:

      C:\WINDOWS\smss.exe << this file
      ________________________

      Reboot back into Normal Mode, and do an online scan with Panda ActiveScan

      - Once you are on the Panda site, click the Scan your PC button
      - A new window will open...click the Check Now button
      - Enter your Country
      - Enter your State/Province
      - Enter your e-mail address and click send
      - Select either Home User or Company
      - Click the big Scan Now button
      - If it wants to install an ActiveX component allow it
      - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
      - When download is complete, click on Local Disks to start the scan
      - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

      Post the contents of the Panda scan report, along with a new HijackThis Log
    • mikekess10mikekess10
      edited October 2006
      posting on my laptop now, in safe mode with my regular computer and I can't find that file
    • mikekess10mikekess10
      edited October 2006
      i found smss.exe in windows\system32, delete it? says this file was created in 2002
    This discussion has been closed.