 Infected: Antispy Spider, Http Quickbrowser Activity, Etc..., Massive amount of popups, slow machine, etc... |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
 Jun 8 2008, 12:09 AM
Post
#1
|
|
|
Member  Group: Members Posts: 97 Joined: 7-June 08 Member No.: 214,894  |
Every few seconds I have popups from antispy spider as well as multiple webads.
My background has changed to red and says 'Warning: Your Computer Is Under Spyware Attack' 'Your Computer is infected by anonymous spyware program' In addition, Norton antivirus pops up every few minutes and says that it has blocked: http quickbrowser activity Risk: High Protocol: TCP Attacked IP: www.top-banners.com(193.189.93.14) Attacked Port: http(80) As well, I don't have use of task manager right now, either. It says that the administrator has disabled it. I am running Window XP. Also, I was running the Kaspersky program and got to around 86% complete and I guess my computer had enough with the popups and decided to close all the windows, including the Kaspersky program, so sorry I don't have that information right now. Deckard's System Scanner v20071014.68 Run by J on 2008-06-07 23:43:01 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 79: 2008-06-08 04:43:30 UTC - RP833 - Deckard's System Scanner Restore Point 78: 2008-06-07 21:33:35 UTC - RP832 - System Checkpoint 77: 2008-06-06 19:13:54 UTC - RP831 - System Checkpoint 76: 2008-06-05 18:20:06 UTC - RP830 - System Checkpoint 75: 2008-06-04 07:52:40 UTC - RP829 - Installed QuickTime -- First Restore Point -- 1: 2008-03-09 21:49:51 UTC - RP755 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 479 MiB (512 MiB recommended). -- HijackThis (run as J.exe) --------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:49:46 PM, on 6/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\dvd43\dvd43_tray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\DIGStream\digstream.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\ESPNRunTime\DIGServices.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe C:\WINDOWS\s?mbols\msconfig.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\explorer.exe C:\Program Files\Windows NT\Accessories\wordpad.exe C:\Documents and Settings\J\Local Settings\Temporary Internet Files\Content.IE5\KP2BW9Y3\dss[1].exe C:\PROGRA~1\TRENDM~1\HIJACK~1\J.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.knology.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.knology.net R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {741F5804-701F-46B9-9C60-FBDCCFF240CA} - C:\Program Files\MSN Gaming Zone\cofyr66225.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {F662EE3E-23AD-0C56-FD48-0EA2E6EF43E5} - C:\WINDOWS\system32\vmgnyn.dll O2 - BHO: Microsoft copyright - {FFFFFFFF-BBBB-4146-86FD-A722E8AB3489} - sockins32.dll (file missing) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Microsoft Windows Installer] C:\Documents and Settings\J\Application Data\Microsoft\dtsc\6747.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Translate with ABBYY &Lingvo... - res://C:\Program Files\ABBYY Lingvo 11 First Step\Lingvo.exe/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u...can_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/testgen/i...GenXInstall.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase8300.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab O20 - Winlogon Notify: crypt - crypts.dll (file missing) O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.470.exe (file missing) O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Windows MS32workstation Service (Windows MS32workstation) - Unknown owner - c:\windows\ws32.exe (file missing) -- End of file - 11999 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R3 dvd43llh - c:\windows\system32\drivers\dvd43llh.sys <Not Verified; RIF; DVD For Free> R3 TnIDriver - c:\docume~1\j\locals~1\temp\tni5e6.tmp (file missing) S2 Service Host Driver - c:\docume~1\j\locals~1\temp\svchost.sys (file missing) S3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys (file missing) S3 Windows MS32workstation Driver - c:\windows\msi32dos.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> S2 MsSecurity1.209.4 (MsSecurity Updated) - c:\windows\444.470 service (file missing) S2 PlugPlayRPC (Plug and Play (RPC)) - c:\windows\portsv.exe service (file missing) S2 Windows MS32workstation (Windows MS32workstation Service) - c:\windows\ws32.exe (file missing) S3 hpqwmi (HP WMI Interface) - c:\program files\hpq\shared\hpqwmi.exe <Not Verified; Hewlett-Packard Development Company, L.P.; hpqwmi Module> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-07 23:47:01 366 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job 2008-06-07 02:25:03 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job 2008-06-06 21:32:48 522 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - J.job 2008-06-03 22:43:05 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2007-05-20 16:58:44 98 --a------ C:\WINDOWS\Tasks\Low Battery Alarm Program.job -- Files created between 2008-05-07 and 2008-06-07 ----------------------------- 2008-06-07 23:49:23 0 d-------- C:\Program Files\Trend Micro 2008-06-07 22:29:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-06-07 22:29:40 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-06-07 14:47:26 0 d-------- C:\Program Files\Outerinfo 2008-06-07 14:47:25 0 d-------- C:\WINDOWS\s?mbols 2008-06-07 14:47:24 60928 --a------ C:\WINDOWS\system32\vmgnyn.dll 2008-06-07 14:46:50 41724 ---hs---- C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe 2008-06-07 14:46:46 86144 --a------ C:\WINDOWS\system32\drivers\drmkk.sys 2008-06-07 14:46:41 0 d-------- C:\WINDOWS\system32\expo 2008-06-07 14:46:40 0 d-------- C:\WINDOWS\system32\xrem 2008-06-07 14:46:40 0 d-------- C:\WINDOWS\system32\NMP 2008-06-07 14:46:40 0 d-------- C:\WINDOWS\system32\inet2 2008-06-07 14:46:40 0 d-------- C:\WINDOWS\system32\105772 2008-06-07 14:46:39 0 d-------- C:\WINDOWS\system32\btz 2008-06-07 14:46:37 0 d-------- C:\Documents and Settings\J\Application Data\??sks 2008-06-07 14:46:35 32768 --a------ C:\WINDOWS\system32\sockins32.dll <Not Verified; ThinkPad; ThinkPad repl> 2008-06-07 14:46:28 0 d-------- C:\WINDOWS\system32\vntiho06 2008-06-07 14:46:27 0 d-------- C:\Temp 2008-06-07 14:46:14 0 d-------- C:\WINDOWS\system32\8567 2008-06-06 17:31:37 0 d-------- C:\WINDOWS\LastGood 2008-06-06 12:35:46 187904 ---hs---- C:\Program Files\Common Files\Yazzle1552OinAdmin.exe 2008-06-04 02:52:48 0 d-------- C:\Program Files\QuickTime 2008-05-29 23:42:45 0 d-------- C:\Documents and Settings\J\Application Data\Sonic 2008-05-29 23:36:33 0 d-------- C:\Program Files\iPod 2008-05-29 23:35:34 0 d-------- C:\Program Files\iTunes 2008-05-29 23:33:56 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-05-29 23:33:20 0 d-------- C:\Program Files\Common Files\Apple 2008-05-29 23:30:24 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-05-25 03:43:04 0 d-------- C:\Program Files\Apple Software Update -- Find3M Report --------------------------------------------------------------- 2008-06-07 21:19:47 0 d-------- C:\Documents and Settings\J\Application Data\AVG7 2008-06-07 14:46:51 0 d-------- C:\Program Files\MSN Gaming Zone 2008-06-07 14:46:50 0 d-------- C:\Program Files\Common Files 2008-06-07 14:46:38 0 d-------- C:\Documents and Settings\J\Application Data\??sks 2008-06-06 20:18:20 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-28 22:06:55 0 d-------- C:\Documents and Settings\J\Application Data\uTorrent 2008-04-27 12:34:36 4 --a------ C:\WINDOWS\system32\winfrun32.bin 2008-04-26 17:44:28 0 d-------- C:\Program Files\AIM 2008-04-11 05:54:56 0 d-------- C:\Program Files\VideoLAN 2008-04-07 00:44:00 0 d-------- C:\Documents and Settings\J\Application Data\Macromedia 2008-04-07 00:40:57 0 d-------- C:\Program Files\Common Files\Macromedia 2008-04-07 00:40:41 0 d-------- C:\Program Files\Macromedia 2008-04-07 00:40:40 0 d--h----- C:\Program Files\InstallShield Installation Information -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{741F5804-701F-46B9-9C60-FBDCCFF240CA}] 02/27/2008 08:54 PM 217088 --a------ C:\Program Files\MSN Gaming Zone\cofyr66225.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F662EE3E-23AD-0C56-FD48-0EA2E6EF43E5}] 05/29/2008 01:34 PM 60928 --a------ C:\WINDOWS\system32\vmgnyn.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [06/17/2004 03:48 PM] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [06/17/2004 03:43 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [10/12/2006 04:10 AM] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [08/19/2003 04:01 AM] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [10/05/2004 11:25 AM] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [10/05/2004 11:24 AM] "eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [09/17/2004 07:19 PM] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [10/13/2004 08:34 PM] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [07/11/2007 04:33 PM] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [05/12/2004 03:18 PM] "dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [02/17/2005 10:44 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/09/2007 08:32 AM] "DIGStream"="C:\Program Files\DIGStream\digstream.exe" [05/18/2005 02:49 PM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/20/2008 07:42 PM] "@"="" [] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [01/31/2008 11:13 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [03/01/2005 11:33 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] "Microsoft Windows Installer"="C:\Documents and Settings\J\Application Data\Microsoft\dtsc\6747.exe" [06/07/2008 02:45 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [12/14/2004 5:44:06 AM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) "DisableRegistryTools"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktop"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "WebProxy"= {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt] crypts.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Service Host Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lingvo Launcher] "C:\Program Files\ABBYY Lingvo 11 First Step\Lvagent.exe" /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tutor.exe] C:\Program Files\ABBYY Lingvo 11 First Step\Tutor.exe /AS [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fba58b3d-13d5-11dd-a6fa-000e35df30e4}] AutoRun\command- E:\setupSNK.exe *Newly Created Service* - DRMKK *Newly Created Service* - MSSECURITY1.209.4 *Newly Created Service* - PLUGPLAYRPC *Newly Created Service* - SYSMONLOG *Newly Created Service* - TNIDRIVER [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{04FD0F03-ADE1-F1A3-545A-CAE86BA3A181}] C:\WINDOWS\IME\imeupdt.exe s [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}] rundll32 sockins32.dll,InitModule -- Hosts ----------------------------------------------------------------------- 127.0.0.1 1.httpdads.com 127.0.0.1 207-87-18-203.wsmg.digex.net 127.0.0.1 a.mktw.net 127.0.0.1 a.tribalfusion.com 127.0.0.1 a207.p.f.qz3.net 127.0.0.1 a3.suntimes.com 127.0.0.1 actionsplash.com 127.0.0.1 ad.abcnews.com 127.0.0.1 ad.adsmart.net 127.0.0.1 ad.adtraq.com 9 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-06-07 23:52:30 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel® Pentium® M processor 1.60GHz Percentage of Memory in Use: 66% Physical Memory (total/avail): 478.42 MiB / 161.25 MiB Pagefile Memory (total/avail): 1120.98 MiB / 667.21 MiB Virtual Memory (total/avail): 2047.88 MiB / 1918.88 MiB C: is Fixed (NTFS) - 92.95 GiB total, 30.41 GiB free. D: is CDROM (No Media) \\.\PHYSICALDRIVE0 - ST9100822A - 93.16 GiB - 2 partitions \PARTITION0 (bootable) - Installable File System - 92.95 GiB - C: \PARTITION1 - Unknown - 203.95 MiB -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FirstRunDisabled is set. AntiVirusDisableNotify is set. FirewallDisableNotify is set. FW: Norton Internet Worm Protection v2005 (Symantec) AV: AVG 7.5.524 v7.5.524 (Grisoft) AV: Norton AntiVirus 2005 v2005 (Symantec Corporation) Outdated [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Disabled:AOL Instant Messenger" "C:\\Documents and Settings\\J\\Desktop\\Teknap\\TekNap.exe"="C:\\Documents and Settings\\J\\Desktop\\Teknap\\TekNap.exe:*:Enabled:TekNap" "C:\\Documents and Settings\\J\\Local Settings\\Temp\\j2eesdk-1_4_02_2005Q2-windows[1].exe2\\package\\jre\\bin\\javaw.exe"="C:\\Documents and Settings\\J\\Local Settings\\Temp\\j2eesdk-1_4_02_2005Q2-windows[1].exe2\\package\\jre\\bin\\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary" "C:\\Program Files\\AIM\\AIM95_c0\\aim.exe"="C:\\Program Files\\AIM\\AIM95_c0\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\AIM\\AIM95_c1\\aim.exe"="C:\\Program Files\\AIM\\AIM95_c1\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD:*:Enabled:Age of Empires II Expansion" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer" "C:\\Program Files\\utorrent\\utorrent.exe"="C:\\Program Files\\utorrent\\utorrent.exe:*:Enabled:µTorrent" "C:\\Documents and Settings\\J\\Desktop\\CG Cache\\New Folder\\Azureus\\utorrent.exe"="C:\\Documents and Settings\\J\\Desktop\\CG Cache\\New Folder\\Azureus\\utorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" "C:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe"="C:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe:*:Enabled:Fireworks MX" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\J\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=JOE ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\J LOGONSERVER=\\JOE NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 13 Stepping 6, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0d06 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\J\LOCALS~1\Temp TMP=C:\DOCUME~1\J\LOCALS~1\Temp USERDOMAIN=JOE USERNAME=J USERPROFILE=C:\Documents and Settings\J windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- J (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu --> C:\WINDOWS\system32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf µTorrent --> "C:\Program Files\uTorrent\uninstall.exe" ABBYY Lingvo 11 First Step (En-Ru-En) --> MsiExec.exe /I{A1100001-0001-0001-0000-074957833700} AC3Filter (remove only) --> C:\Program Files\AC3Filter\uninstall.exe Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe MPEG Encoder --> MsiExec.exe /I{9811A185-3D3D-11D6-9E14-00036D172B00} Adobe Premiere 6.5 --> C:\WINDOWS\UNINST.EXE -f"C:\Program Files\Adobe\Premiere 6.5\DeIsL1.isu" -c"C:\Program Files\Adobe\Premiere 6.5\Uninst.dll" Adobe Premiere Pro 1.5 --> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{A14F7508-B784-40B8-B11A-E0E2EEB7229F}\setup.exe" -l0x0009 Adobe Reader 7.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000} Advanced RealMedia Export Plug-in for Premiere 6.0 --> C:\Program Files\Adobe\Premiere 6.5\Plug-ins\RNCompiler\rnuninst.exe RealNetworks|RNCompiler|6.0 Advanced Spyware Remover Free Edition --> "C:\Program Files\Advanced Spyware Remover\unins000.exe" AIM+ (remove only) --> "C:\Program Files\AIM+\uninst.exe" AOL Instant Messenger --> C:\Program Files\AIM\uninstll.exe -LOG= C:\Program Files\AIM\install.log -OEM= Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL Cakewalk VST Adapter 4 --> C:\PROGRA~1\Cakewalk\CAKEWA~1\UNWISE.EXE C:\PROGRA~1\Cakewalk\CAKEWA~1\INSTALL.LOG ccCommon --> MsiExec.exe /I{DC367608-64A7-4BF7-92F4-8BAA25BA02DB} CDex extraction audio --> "C:\Program Files\CDex_150\uninstall.exe" Collab --> C:\Program Files\Image-Line\Collab\uninstall.exe Conexant AC-Link Audio --> CIAunwdm.exe DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN DreamStation DXi --> C:\WINDOWS\DSDXIRMV.EXE C:\PROGRAM FILES\CAKEWALK\SHARED DXI\AUDIO SIMULATION\DREAMSTATION DXI DreamStation DXi2 --> C:\WINDOWS\DSDXIRMV.EXE C:\PROGRAM FILES\CAKEWALK\SHARED DXI\AUDIO SIMULATION\DREAMSTATION DXI2 DVD43 v3.5.2 --> "C:\Program Files\dvd43\unins000.exe" Easy Internet Sign-up --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1033 ESPN RunTime --> C:\Program Files\ESPNRunTime\DIGSvcUninstall.exe /brand=ESPN FixedLength --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9E34B40B-CFF3-11D3-8302-00A024A89C17}\setup.exe" FL Studio 6 --> C:\Program Files\Image-Line\FL Studio 6\uninstall.exe Free WMA to MP3 Converter 1.16 --> "C:\Program Files\Free WMA to MP3 Converter\unins000.exe" Fruity Loops Studio Producer Edition XXL v6.04 Patcher --> C:\PROGRA~1\IMAGE-~1\FLSTUD~1\UNWISE.EXE C:\PROGRA~1\IMAGE-~1\FLSTUD~1\INSTALL.LOG Google Earth --> MsiExec.exe /I{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B} HouseCall 6.6 --> "C:\Documents and Settings\J\Application Data\HouseCall 6.6\uninstaller.exe" HP Deskjet 5400 series --> C:\Program Files\HP\Digital Imaging\{EB57A16E-500D-43d7-85B9-FBE279EBBA6E}\setup\hpzscr01.exe -datfile hpfscr05.dat HP Help and Support --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}\setup.exe" -l0x9 HP Image Zone 4.2 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat HP Image Zone Express --> MsiExec.exe /X{FE64AE29-0883-4C70-8388-DC026019C900} HP Imaging Device Functions 5.0 --> C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat HP PSC & OfficeJet 4.2 --> "C:\Program Files\HP\Digital Imaging\{A1062847-0846-427A-92A1-BB8251A91E91}\setup\hpzscr01.exe" -datfile hposcr04.dat HP Software Update --> MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D} HP Solution Center & Imaging Support Tools 5.0 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat Intel® Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_3582 Internet Worm Protection --> MsiExec.exe /I{2908F0CB-C1D4-447F-97A2-CFC135C9F8D4} InterVideo WinDVD --> "C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL IrfanView (remove only) --> C:\Program Files\IrfanView\iv_uninstall.exe iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060} J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090} Java 2 Runtime Environment, SE v1.4.2_05 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142050} Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe LiveReg (Symantec Corporation) --> C:\Program Files\Common Files\Symantec Shared\LiveReg\VCSetup.exe /REMOVE LiveUpdate 3.0 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U Looper --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9E34B40A-CFF3-11D3-8302-00A024A89C17}\setup.exe" Macromedia Fireworks MX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{930B2432-43D4-11D5-9871-00C04F8EEB39}\Setup.exe" -l0x9 UNINSTALL Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Microsoft Age of Empires II --> "C:\Program Files\Microsoft Games\Age of Empires II\UNINSTAL.EXE" /runtemp /uninstall Microsoft Age of Empires II: The Conquerors Expansion --> "C:\Program Files\Microsoft Games\Age of Empires II\UNINSTALX.EXE" /runtemp /addremove Microsoft Money 2005 --> C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120 Microsoft Office Standard Edition 2003 --> MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9} Microsoft Works --> MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44} Move Networks Media Player for Internet Explorer --> C:\Documents and Settings\J\Application Data\Move Networks\ie_bin\Uninst.exe MSN Music Assistant --> rundll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msninst.inf,Uninstall muvee autoProducer 3.5 - SE --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{37E31FCE-A048-4D8C-B167-31891BCF6585}\setup.exe" -l0x9 Nero 6 Ultra Edition --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL Norton AntiVirus 2005 --> MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B} Norton AntiVirus 2005 (Symantec Corporation) --> C:\Program Files\Common Files\Symantec Shared\SymSetup\{C6F5B6CF-609C-428E-876F-CA83176C021B}.exe /X Norton AntiVirus Help --> MsiExec.exe /I{34EEB1F5-E939-40A1-A6BA-957282A4B2C8} Norton AntiVirus Parent MSI --> MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43} Norton AntiVirus SYMLT MSI --> MsiExec.exe /I{D1FF75E7-DD42-4CFD-B052-20B3FFF4EDB8} Norton Security Center --> MsiExec.exe /X{503AA035-41E2-4858-B31F-1E49AC66C309} Norton WMI Update --> MsiExec.exe /X{F64306A5-4C32-41bb-B153-53986527FAB4} Outerinfo --> "C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe" Quick Launch Buttons 5.00 C2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CEB326EC-8F40-47B2-BA22-BB092565D66F}\setup.exe" -l0x9 -uninst QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067} Rhapsody Player Engine --> MsiExec.exe /I{84F1DE76-C48C-4281-87A0-CC9548D1E7F9} Rosetta Stone 2.1.2.0A --> "C:\Program Files\Rosetta Stone\RS2.1.2.0A_Support\Uninstall Rosetta Stone 2.1.2.0A\Uninstall Rosetta Stone 2.1.2.0A.exe" Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe" Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe" SoftV92 Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_3080103C\HXFSETUP.EXE -U -Ihpm30805.inf SONAR 3 Studio Edition --> C:\PROGRA~1\Cakewalk\SONAR3~1\UNWISE.EXE C:\PROGRA~1\Cakewalk\SONAR3~1\INSTALL.LOG Sonic RecordNow! --> MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19} Sonic Update Manager --> MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3} SPBBC --> MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56} Spy Sweeper --> "C:\Program Files\Webroot\Spy Sweeper\unins000.exe" Symantec --> MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09} Symantec Script Blocking Installer --> MsiExec.exe /I{D327AFC9-7BAA-473A-8319-6EB7A0D40138} SymNet --> MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2} Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Tassman DXi SE 2.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B23F9E40-E6E5-11D4-89B3-00201856C449}\Setup.exe" Texas Instruments PCIxx21/x515 drivers. --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{C569D686-A444-4AF0-A437-15CBB2816E34} VeloMaster Lite CW --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9E34B40D-CFF3-11D3-8302-00A024A89C17}\setup.exe" Viewpoint Manager (Remove Only) --> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe /u /k Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u Virtual Sound Canvas DXi --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4E10E7FC-36CD-4C22-AC20-9E15692E8C2F}\setup.exe" UNINSTALL_XXX WildTangent Web Driver --> C:\Program Files\WildTangent\Apps\CDA\CDAUninstall.exe Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe" Windows Defender --> MsiExec.exe /I{B2D7CE29-614A-4ACC-8BFE-009EB3A244C9} Windows Defender Signatures --> MsiExec.exe /I{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C} Windows Live OneCare safety scanner --> RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe WinZip 11.2 --> MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B6} -- Application Event Log ------------------------------------------------------- Event Record #/Type28689 / Error Event Submitted/Written: 06/07/2008 10:00:28 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application iexplore.exe, version 6.0.2900.2180, faulting module cofyr66225.dll, version 0.0.0.0, fault address 0x0000671b. Processing media-specific event for [iexplore.exe!ws!] Event Record #/Type28687 / Error Event Submitted/Written: 06/07/2008 09:42:36 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application explorer.exe, version 6.0.2900.3156, faulting module unknown, version 0.0.0.0, fault address 0x00000000. Processing media-specific event for [explorer.exe!ws!] Event Record #/Type28682 / Error Event Submitted/Written: 06/07/2008 08:42:39 PM Event ID/Source: 101 / Automatic LiveUpdate Scheduler Event Description: Information Level: error Internet connection not detected. Event Record #/Type28680 / Error Event Submitted/Written: 06/07/2008 08:37:39 PM Event ID/Source: 101 / Automatic LiveUpdate Scheduler Event Description: Information Level: error Internet connection not detected. Event Record #/Type28678 / Error Event Submitted/Written: 06/07/2008 08:32:38 PM Event ID/Source: 101 / Automatic LiveUpdate Scheduler Event Description: Information Level: error Internet connection not detected. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type49542 / Error Event Submitted/Written: 06/07/2008 03:09:25 PM Event ID/Source: 29 / W32Time Event Description: The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time. Event Record #/Type49541 / Error Event Submitted/Written: 06/07/2008 03:09:25 PM Event ID/Source: 17 / W32Time Event Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) Event Record #/Type49536 / Error Event Submitted/Written: 06/07/2008 02:52:32 PM Event ID/Source: 7031 / Service Control Manager Event Description: The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Event Record #/Type49534 / Error Event Submitted/Written: 06/07/2008 02:49:49 PM Event ID/Source: 7031 / Service Control Manager Event Description: The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Event Record #/Type49533 / Error Event Submitted/Written: 06/07/2008 02:49:36 PM Event ID/Source: 7034 / Service Control Manager Event Description: The MsSecurity Updated service terminated unexpectedly. It has done this 1 time(s). -- End of Deckard's System Scanner: finished at 2008-06-07 23:52:30 ------------ |
 |
 
|
Posts in this topic
gloryfalls12 Infected: Antispy Spider, Http Quickbrowser Activity, Etc... Jun 8 2008, 12:09 AM
Cretemonster Hi and Welcome to the Bleeping Computer :thumbup2... Jun 10 2008, 06:01 AM gloryfalls12 Thanks for helping me out!
Here is the reques... Jun 10 2008, 03:42 PM Cretemonster Copy the text below to notepad and save it to the ... Jun 11 2008, 08:09 AM gloryfalls12 ComboFix 08-06-09.7 - J 2008-06-11 16:15:52.2 - NT... Jun 11 2008, 04:52 PM Cretemonster Post the F-Secure results when the scan completes,... Jun 12 2008, 01:11 AM gloryfalls12 Sorry, I had the F-Secure done earlier today, but ... Jun 12 2008, 02:52 AM gloryfalls12 ...and here are the SDFix and HJT logs...
SDFi... Jun 12 2008, 05:12 AM Cretemonster So hows the PC acting today,looks like we are clos... Jun 12 2008, 02:01 PM gloryfalls12 It is running much better. Thank you so much!
... Jun 12 2008, 02:47 PM Cretemonster Looks good,post the Kaspersky results when you get... Jun 12 2008, 04:03 PM gloryfalls12 I'm really not sure. I know you're not sup... Jun 12 2008, 08:57 PM Cretemonster OK,lets see if we can get rid of Norton for ya,fir... Jun 13 2008, 05:40 AM gloryfalls12 well, everything was running really smoothly and i... Jun 15 2008, 02:43 PM Cretemonster Hmmmm....wonder what happened :huh:
Go back and... Jun 16 2008, 01:11 AM gloryfalls12 For some reason, it won't let me run ComboFix.... Jun 16 2008, 01:53 AM Cretemonster Rename ComboFix to Dangit.exe and try again. Jun 16 2008, 03:30 AM gloryfalls12 alright, i got it to work finally...i read somewhe... Jun 16 2008, 03:32 AM Cretemonster Wow,something is going on inside there,Im not sure... Jun 17 2008, 06:38 AM gloryfalls12 The only thing I have installed is Firefox...and t... Jun 18 2008, 03:59 AM Cretemonster OK,so you have Windows Firewall and AVG7(Think 8 i... Jun 18 2008, 02:17 PM gloryfalls12 That's correct. Usually, I use my wireless, bu... Jun 20 2008, 03:39 PM Cretemonster OK,let me know what the machine state is and if th... Jun 22 2008, 09:55 AM gloryfalls12 the computer seems to be working pretty well. no i... Jun 23 2008, 06:10 PM Cretemonster Hmm,I wanna peek at some other things before we go... Jun 24 2008, 04:59 AM gloryfalls12 GMER 1.0.14.14536 - http://www.gmer.net
Rootkit sc... Jun 25 2008, 02:32 PM Cretemonster Need ya to do me a favor,so i can have a small pie... Jun 26 2008, 02:40 AM gloryfalls12 all of those seemed to have checked out just fine,... Jun 26 2008, 05:45 AM Cretemonster Im wondering if you can uninstall SpySweeper tempo... Jun 27 2008, 02:47 PM gloryfalls12 AVG found just a few things.
"Scan "... Jun 29 2008, 01:39 PM Cretemonster Cant beat those results,we shall take care of thos... Jun 30 2008, 07:05 AM gloryfalls12 thanks! i'll be out of town for the next f... Jul 1 2008, 02:50 PM
gloryfalls12 so far all is still well. i get back into town in ... Jul 6 2008, 01:34 AM  |
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 21st November 2009 - 07:31 PM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.