Options

New HiJack this Log

Unknown
edited July 2007 in Spyware & Virus Removal
Hi

My pc has been slowing down quite a bit recently and i was wondering if you could help me with the HiJack This Log.

Logfile of HijackThis v1.99.1
Scan saved at 10:38:26, on 29/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\cbugmsky.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Antivirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\All Users.ScotExec1\My Documents\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.bt.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O4 - HKLM\..\Run: [cpqek] "C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe"
O4 - HKLM\..\Run: [Microsoft Works Portfolio] "C:\Program Files\Microsoft Works\WksSb.exe" /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\fqtollqg.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\B12U14K\WATCH.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} (Virgin Digital MusicNet Class) - http://www.virgindigital.co.uk/activeX/VirginWMA.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1147359471000
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\cbugmsky.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1\RpcSandraSrv.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE


I would be very thankful if anybody could help me get rid of what ever i have on my pc.

Comments

  • NuppiNuppi South Ostrobothnia (Finland)
    edited June 2007
    Hi Jamiex, and Welcome to Icrontic :D

    First Rename your hijackthis.exe to Scanner.exe

    Second, Please Download ComboFix from Here or Here to your Desktop.
    • Double click combofix.exe and follow the prompts.
    • When finished, it shall produce a log for you. Post that log and a HiJackthis(scanner) log in your next reply
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
  • Jamiex
    edited June 2007
    I hope this is what you were wanting

    2002-02-21 18:56      24576    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\msxml3a.dll.vir
2005-04-27 16:17      104    --a--c---    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1.SCO\Desktop\Internet.lnk.vir
2006-10-14 11:15      89    --a------    C:\Qoobox\Quarantine\C\Program Files\INSTALL.LOG.vir
2007-06-07 19:38      33302    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ljjifda.dll.vir
2007-06-07 19:39      58130    --a------    C:\Qoobox\Quarantine\C\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll.vir
2007-06-07 19:39      73727    --a------    C:\Qoobox\Quarantine\C\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll.vir
2007-06-07 19:44      1215999    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mlnmp.bak1.vir
2007-06-07 19:44      263220    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnlm.dll.vir
2007-06-07 19:45      58420    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tlggeftk.dll.vir
2007-06-11 18:38      76412    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ivuiqvpl.dll.vir
2007-06-12 18:30      943877    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\nuktfpse.ini.vir
2007-06-12 18:37      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\espftkun.dll.vir
2007-06-14 18:20      62516    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\lbveylcg.dll.vir
2007-06-19 20:33      76412    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\bavxlyjj.dll.vir
2007-06-27 19:37      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ndyhpast.dll.vir
2007-06-27 19:37      1796817    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tsaphydn.ini.vir
2007-06-27 19:42      76412    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qbejyexi.dll.vir
2007-06-29 19:39      1276759    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mlnmp.bak2.vir
2007-06-29 19:42      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\jkkpxdfu.dll.vir
2007-06-30 11:37      960299    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ufdxpkkj.ini.vir
2007-06-30 11:48      352    --a------    C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf
2007-06-30 11:49      1277164    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mlnmp.ini.vir
2007-06-30 11:53      104    --a------    C:\Qoobox\Quarantine\catchme.log


Folder PATH listing
Volume serial number is 401D-9F04
C:\QOOBOX
\---Quarantine
    |   catchme.log
    |   
    +---C
    |   +---DOCUME~1
    |   |   \---ALLUSE~1.SCO
    |   |       \---Desktop
    |   |               Internet.lnk.vir
    |   |               
    |   +---Program Files
    |   |   |   INSTALL.LOG.vir
    |   |   |   
    |   |   \---Common Files
    |   |       \---Microsoft Shared
    |   |           \---Web Folders
    |   |                   ibm00001.dll.vir
    |   |                   ibm00002.dll.vir
    |   |                   
    |   \---WINDOWS
    |       \---system32
    |               bavxlyjj.dll.vir
    |               espftkun.dll.vir
    |               ivuiqvpl.dll.vir
    |               jkkpxdfu.dll.vir
    |               lbveylcg.dll.vir
    |               ljjifda.dll.vir
    |               mlnmp.bak1.vir
    |               mlnmp.bak2.vir
    |               mlnmp.ini.vir
    |               msxml3a.dll.vir
    |               ndyhpast.dll.vir
    |               nuktfpse.ini.vir
    |               pmnlm.dll.vir
    |               qbejyexi.dll.vir
    |               tlggeftk.dll.vir
    |               tsaphydn.ini.vir
    |               ufdxpkkj.ini.vir
    |               
    \---Registry_backups
            services_nm.reg.cf
  • Jamiex
    edited June 2007
    It just came up with this aswell

    ComboFix 07-06-18.2 - C:\Documents and Settings\All Users.ScotExec1\Desktop\ComboFix.exe
    "All Users" - 2007-06-30 11:38:46 - Service Pack 2 NTFS


    (((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\system32\bavxlyjj.dll
    C:\WINDOWS\system32\espftkun.dll
    C:\WINDOWS\system32\ivuiqvpl.dll
    C:\WINDOWS\system32\jkkpxdfu.dll
    C:\WINDOWS\system32\lbveylcg.dll
    C:\WINDOWS\system32\ndyhpast.dll
    C:\WINDOWS\system32\qbejyexi.dll
    C:\WINDOWS\system32\tlggeftk.dll
    C:\WINDOWS\system32\nuktfpse.ini
    C:\WINDOWS\system32\ufdxpkkj.ini
    C:\WINDOWS\system32\tsaphydn.ini
    C:\WINDOWS\system32\mlnmp.bak1
    C:\WINDOWS\system32\mlnmp.bak2
    C:\WINDOWS\system32\mlnmp.ini
    C:\WINDOWS\system32\mlnmp.bak1
    C:\WINDOWS\system32\mlnmp.bak2
    C:\WINDOWS\system32\mlnmp.ini
    C:\WINDOWS\system32\pmnlm.dll
    C:\WINDOWS\system32\ljjifda.dll


    * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\DOCUME~1\ALLUSE~1.SCO\Desktop\internet.lnk
    C:\Program Files\Common Files\microsoft shared\web folders\ibm00001.dll
    C:\Program Files\Common Files\microsoft shared\web folders\ibm00002.dll
    C:\Program Files\install.log
    C:\WINDOWS\system32\msxml3a.dll


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    \nm


    ((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-30 )))))))))))))))))))))))))))))))


    2007-06-30 11:37 49,152 --a
    C:\WINDOWS\nircmd.exe
    2007-06-29 19:39 122,900 --a
    C:\WINDOWS\system32\xkaianpy.exe
    2007-06-29 19:38 122,900 --a
    C:\WINDOWS\system32\mrvftcxp.exe
    2007-06-28 19:36 122,900 --a
    C:\WINDOWS\system32\glkbvews.exe
    2007-06-27 19:37 122,900 --a
    C:\WINDOWS\system32\ndivtvec.exe
    2007-06-26 17:38 122,900 --a
    C:\WINDOWS\system32\dtnwruii.exe
    2007-06-25 17:36 122,900 --a
    C:\WINDOWS\system32\ljcbmvnx.exe
    2007-06-22 20:01 <DIR> d
    C:\Program Files\SpywareBlaster
    2007-06-22 19:54 122,900 --a
    C:\WINDOWS\system32\pkhxwshe.exe
    2007-06-22 19:51 4,628 --a
    C:\WINDOWS\system32\abxvrijx.exe
    2007-06-22 19:49 122,900 --a
    C:\WINDOWS\system32\pbmrbbpx.exe
    2007-06-21 18:06 86,036 --a
    C:\WINDOWS\system32\slyufwmk.exe
    2007-06-21 18:03 122,900 --a
    C:\WINDOWS\system32\gpnvghim.exe
    2007-06-21 18:03 <DIR> d
    C:\Program Files\Lavasoft
    2007-06-21 18:03 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
    2007-06-21 17:40 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2007-06-19 20:27 122,900 --a
    C:\WINDOWS\system32\cbugmsky.exe
    2007-06-07 19:47 2,580 --a
    C:\WINDOWS\system32\tigpkuut.exe
    2007-06-07 19:39 7,200 --a
    C:\llmbv.exe
    2007-06-07 19:39 48,128 --a
    C:\bsgvjmep.exe
    2007-06-07 19:39 1,536 --a
    C:\wyjgsa.exe
    2007-06-04 20:22 127,086 --a
    C:\WINDOWS\SuperSpice Uninstaller.exe
    2007-06-04 20:22 <DIR> d
    C:\Program Files\AnaSoft
    2007-06-04 15:18 9,344 --a
    C:\WINDOWS\system32\drivers\NSDriver.sys
    2007-06-04 15:17 8,320 --a
    C:\WINDOWS\system32\drivers\AWRTRD.sys
    2007-06-04 15:14 6,272 --a
    C:\WINDOWS\system32\drivers\AWRTPD.sys
    2007-05-31 20:46 <DIR> d
    C:\Program Files\ABBYY FineReader 4.0 Sprint
    2007-05-31 19:53 57,344 --a
    C:\WINDOWS\system\BPEnhan.dll
    2007-05-31 19:53 188,416 --a
    C:\WINDOWS\system32\P3usd.dll
    2007-05-31 19:53 176,128 --a
    C:\WINDOWS\system32\PuzzSaver.scr
    2007-05-31 19:53 172,032 --a
    C:\WINDOWS\system32\SpotSaver.scr
    2007-05-31 19:53 15,104 --a
    C:\WINDOWS\system32\drivers\usbscan.sys
    2007-05-31 19:53 135,168 --a
    C:\WINDOWS\system32\ParaSaver.scr
    2007-05-31 19:53 <DIR> d
    C:\Program Files\BearPaw 2400
    2007-05-31 19:42 95,232 --a
    C:\WINDOWS\system\LFKODAK.DLL
    2007-05-31 19:42 93,184 --a
    C:\WINDOWS\system\LFTIF70N.DLL
    2007-05-31 19:42 81,946 --a
    C:\WINDOWS\system32\Vb5ko.dll
    2007-05-31 19:42 76,800 --a
    C:\WINDOWS\system32\Lffax10n.dll
    2007-05-31 19:42 600,576 --a
    C:\WINDOWS\system32\Ltwrp10n.dll
    2007-05-31 19:42 55,808 --a
    C:\WINDOWS\system\LFFAX70N.DLL
    2007-05-31 19:42 55,296 --a
    C:\WINDOWS\system\LTFIL70N.DLL
    2007-05-31 19:42 350,208 --a
    C:\WINDOWS\system\LTKRN70N.DLL
    2007-05-31 19:42 35,840 --a
    C:\WINDOWS\system32\Lflma10n.dll
    2007-05-31 19:42 35,328 --a
    C:\WINDOWS\system\LFFPX70N.DLL
    2007-05-31 19:42 34,304 --a
    C:\WINDOWS\system32\Lfbmp10n.dll
    2007-05-31 19:42 33,280 --a
    C:\WINDOWS\system32\Lfpcx10n.dll
    2007-05-31 19:42 32,768 --a
    C:\WINDOWS\system\Lfgif70n.dll
    2007-05-31 19:42 31,232 --a
    C:\WINDOWS\system32\Lfpct10n.dll
    2007-05-31 19:42 31,232 --a
    C:\WINDOWS\system32\Lflmb10n.dll
    2007-05-31 19:42 306,688 --a
    C:\WINDOWS\system\LFFPX7.DLL
    2007-05-31 19:42 297,472 --a
    C:\WINDOWS\system32\Ltkrn10n.dll
    2007-05-31 19:42 28,672 --a
    C:\WINDOWS\system\LFLMA70N.DLL
    2007-05-31 19:42 28,160 --a
    C:\WINDOWS\system32\Lfwmf10n.dll
    2007-05-31 19:42 27,136 --a
    C:\WINDOWS\system32\Lfimg10n.dll
    2007-05-31 19:42 27,136 --a
    C:\WINDOWS\system32\Lfcal10n.dll
    2007-05-31 19:42 266,752 --a
    C:\WINDOWS\system32\Lfcmp10n.dll
    2007-05-31 19:42 26,112 --a
    C:\WINDOWS\system\LFICA70N.DLL
    2007-05-31 19:42 25,600 --a
    C:\WINDOWS\system32\Lfmac10n.dll
    2007-05-31 19:42 25,088 --a
    C:\WINDOWS\system\LFLMB70N.DLL
    2007-05-31 19:42 240,640 --a
    C:\WINDOWS\system32\Lfdic10n.dll
    2007-05-31 19:42 24,576 --a
    C:\WINDOWS\system\Lfpcx70n.dll
    2007-05-31 19:42 24,576 --a
    C:\WINDOWS\system\LFBMP70N.DLL
    2007-05-31 19:42 24,064 --a
    C:\WINDOWS\system\LFPCT70N.DLL
    2007-05-31 19:42 24,064 --a
    C:\WINDOWS\system\Lfeps70n.dll
    2007-05-31 19:42 228,864 --a
    C:\WINDOWS\system32\Ltdis10n.dll
    2007-05-31 19:42 224,768 --a
    C:\WINDOWS\system\LFCMP70N.DLL
    2007-05-31 19:42 22,016 --a
    C:\WINDOWS\system\Lfpsd70n.dll
    2007-05-31 19:42 20,992 --a
    C:\WINDOWS\system\Lftga70n.dll
    2007-05-31 19:42 20,480 --a
    C:\WINDOWS\system\Lfwpg70n.dll
    2007-05-31 19:42 20,480 --a
    C:\WINDOWS\system\LFIMG70N.DLL
    2007-05-31 19:42 19,968 --a
    C:\WINDOWS\system\LFCAL70N.DLL
    2007-05-31 19:42 19,456 --a
    C:\WINDOWS\system\Lfras70n.dll
    2007-05-31 19:42 19,456 --a
    C:\WINDOWS\system\LFPCD70N.DLL
    2007-05-31 19:42 19,456 --a
    C:\WINDOWS\system\Lfmsp70n.dll
    2007-05-31 19:42 18,944 --a
    C:\WINDOWS\system\Lfwfx70n.dll
    2007-05-31 19:42 18,944 --a
    C:\WINDOWS\system\LFMAC70N.DLL
    2007-05-31 19:42 17,920 --a
    C:\WINDOWS\system\LFAVI70N.DLL
    2007-05-31 19:42 122,368 --a
    C:\WINDOWS\system32\Lftif10n.dll
    2007-05-31 19:42 117,760 --a
    C:\WINDOWS\system32\Ltimg10n.dll
    2007-05-31 19:42 111,104 --a
    C:\WINDOWS\system\Lfpng70n.dll
    2007-05-31 19:42 103,424 --a
    C:\WINDOWS\system32\Ltfil10n.dll
    2007-05-31 19:41 996,872 --a
    C:\WINDOWS\system32\Cp3240mt.dll
    2007-05-31 19:41 81,920 --a
    C:\WINDOWS\system\Capi2032.dll
    2007-05-31 19:41 29,952 --a
    C:\WINDOWS\system32\Borlndmm.dll
    2007-05-31 19:41 212,480 --a
    C:\WINDOWS\system\Pcdlib32.dll
    2007-05-31 16:52 1,156 --a
    C:\WINDOWS\mozver.dat
    2007-05-28 19:00 <DIR> d
    C:\Program Files\Eidos Interactive
    2007-05-15 16:25 <DIR> d
    C:\Pics DO NOT DELETE
    2007-05-12 13:28 <DIR> d
    C:\FF_Endless Nova
    2007-05-12 10:59 <DIR> d--h
    C:\WINDOWS\PIF
    2007-05-11 20:38 <DIR> d
    C:\Program Files\DOSBox-0.70
    2007-05-11 20:11 <DIR> d
    C:\Dosgames
    2007-05-07 18:35 <DIR> d
    C:\Program Files\FastStone Capture
    2007-05-07 18:35 <DIR> d
    C:\DOCUME~1\ALLUSE~1.SCO\APPLIC~1\FastStone


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-06-30 11:00:40
    d
    w C:\Program Files\Common Files\Symantec Shared
    2007-06-30 11:00:37
    d
    w C:\Program Files\Norton Internet Security
    2007-06-29 08:26:26
    d
    w C:\Program Files\Common Files\stardock
    2007-06-29 08:19:07
    d
    w C:\Program Files\Sony
    2007-06-29 08:08:34
    d
    w C:\Program Files\Stardock
    2007-06-29 08:02:49
    d
    w C:\Program Files\SlySoft
    2007-06-27 15:54:53
    d
    w C:\DOCUME~1\ALLUSE~1.SCO\APPLIC~1\LimeWire
    2007-05-23 15:35:28
    d
    w C:\DOCUME~1\ALLUSE~1.SCO\APPLIC~1\MSN6
    2007-05-14 15:22:48
    d
    w C:\Program Files\Warcraft III
    2007-05-14 15:20:49
    d
    w C:\Program Files\Call of Duty
    2007-05-05 19:18:26
    d
    w C:\Program Files\Symantec
    2007-04-29 18:43:23
    d
    w C:\DOCUME~1\ALLUSE~1.SCO\APPLIC~1\r2 Studios
    2007-04-29 18:43:18
    d
    w C:\Program Files\r2 Studios
    2007-04-29 08:33:15
    d
    w C:\Program Files\Windows Media Connect 2
    2007-04-18 15:37:27 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
    2007-04-16 21:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-04-16 21:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-04-16 21:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-04-16 21:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-04-16 21:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-04-16 21:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-04-16 21:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-04-16 21:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-04-16 21:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
    2007-04-16 21:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
    2007-04-13 14:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
    2007-04-10 18:04:48 874 ----a-w C:\WINDOWS\eReg.dat


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll [2006-09-29 13:53]
    {1935E690-1AC1-4AA5-BA23-3D9D0CEB3A00}=C:\WINDOWS\system32\Lsk_iBlk.dll [2006-02-16 16:31]
    {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 02:04]
    {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll [2006-10-31 16:33]
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23]
    {BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton Antivirus\NavShExt.dll [2002-02-27 11:07]
    {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}=C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll [2005-02-03 18:07]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "cpqek"="C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe" [2001-10-23 10:16]
    "Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 22:52]
    "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 05:41]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23]
    "btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2005-12-29 11:22]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon]
    LogonDll.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\LanSchoolStudent]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "LexBceS"=2 (0x2)
    "LanSchoolStudent"=2 (0x2)
    "iPod Service"=3 (0x3)
    "FirebirdServerMAGIXInstance"=3 (0x3)
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
    NtmlSvc


    Contents of the 'Scheduled Tasks' folder
    2007-06-02 19:01:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    2006-12-30 21:43:33 C:\WINDOWS\tasks\MP Scheduled Scan.job
    2007-06-22 19:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
    2007-06-30 10:55:00 C:\WINDOWS\tasks\Symantec NetDetect.job

    **************************************************************************

    catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer,
    Rootkit scan 2007-06-30 12:01:57
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-06-30 12:04:36 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-06-30 12:04

    --- E O F ---
  • NuppiNuppi South Ostrobothnia (Finland)
    edited June 2007
    Hi ,


    3 : Combofix - do
    Open notepad and copy/paste the text in the quotebox below into it:
    File::
    C:\WINDOWS\system32\xkaianpy.exe
    C:\WINDOWS\system32\mrvftcxp.exe
    C:\WINDOWS\system32\glkbvews.exe
    C:\WINDOWS\system32\ndivtvec.exe
    C:\WINDOWS\system32\dtnwruii.exe
    C:\WINDOWS\system32\ljcbmvnx.exe
    C:\WINDOWS\system32\pkhxwshe.exe
    C:\WINDOWS\system32\abxvrijx.exe
    C:\WINDOWS\system32\pbmrbbpx.exe
    C:\WINDOWS\system32\slyufwmk.exe
    C:\WINDOWS\system32\gpnvghim.exe
    C:\WINDOWS\system32\cbugmsky.exe
    C:\WINDOWS\system32\tigpkuut.exe
    C:\llmbv.exe
    C:\bsgvjmep.exe
    C:\wyjgsa.exe
    C:\WINDOWS\system32\fqtollqg.dll

    Save this as ComboFix-Do.txt
    Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below.
    Combo-Do.gif
    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
  • Jamiex
    edited July 2007
    Here is the new HJT log you wanted



    Logfile of HijackThis v1.99.1
    Scan saved at 16:39, on 2007-07-01
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\cbugmsky.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton Antivirus\navapsvc.exe
    C:\Program Files\Norton Internet Security\NISUM.EXE
    C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norton Internet Security\SymProxySvc.exe
    C:\Program Files\Norton Internet Security\NISSERV.EXE
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
    C:\Program Files\btbb_wcm\McciTrayApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\ALLUSE~1.SCO\My Documents\HJT\scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.bt.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O2 - BHO: lsk_WebBlk Class - {1935E690-1AC1-4AA5-BA23-3D9D0CEB3A00} - C:\WINDOWS\system32\Lsk_iBlk.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Antivirus\NavShExt.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
    O4 - HKLM\..\Run: [cpqek] "C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe"
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] "C:\Program Files\Microsoft Works\WksSb.exe" /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
    O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\B12U14K\WATCH.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} (Virgin Digital MusicNet Class) - http://www.virgindigital.co.uk/activeX/VirginWMA.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1147359471000
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\cbugmsky.exe (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Antivirus\navapsvc.exe
    O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
    O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1\RpcSandraSrv.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
    O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
  • NuppiNuppi South Ostrobothnia (Finland)
    edited July 2007
    Hi,

    Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
    http://www.ewido.net/en/download/
    • Install AVG Anti-Spyware by double clicking the installer.
    • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Click on Change state next to Automatic updates. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
    • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update ewido.
    AVG Anti-Spyware manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    Once in Safe Mode:

    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • Select Automatically generate report after every scan and uncheck Only if threats were found.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
        scanavgjk2.jpg
    • When done, click the Save Scan Report button. (4)
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware report.
  • SPIKE09SPIKE09 Scatland
    edited July 2007
    Thank God you finally took My advice Jamiex, been telling him to come here for several weeks Nuppi,no dedicated anti malware experts on our home site.
  • NuppiNuppi South Ostrobothnia (Finland)
    edited July 2007
    Glad I could be of assistance! The help you received here was free. Please read through some of these Prevention Tips that Short-Media offers.

    This topic is now closed. If you wish it reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

    Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.

    If you are not the user who started this thread, you must start a new Thread instead :)

    Would you also be interested to join Short-Media (Team #93) with the Folding@Home Project? More information available here
Sign In or Register to comment.