 HJT log Morgan, Please help |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Mar 5 2005, 08:53 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 12 Joined: 5-March 05 Member No.: 13,669  |
Logfile of HijackThis v1.99.1 Scan saved at 5:23:17 PM, on 3/5/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NuCam\CamCheck\CamCheck.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\WDBtnMgr.exe C:\WINDOWS\system32\mfcok32.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLHOS~1.EXE C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLServiceHost.exe C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\apiuz.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\MORGAN~1\DESKTOP\WINZIP\winzip32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\hijack\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\menwd.dll/sp.html#28129 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\menwd.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\menwd.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\menwd.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\menwd.dll/sp.html#28129 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\menwd.dll/sp.html#28129 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {722E5D99-3739-E117-AA77-5AF0213C5DD6} - C:\WINDOWS\system32\crgl.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1107402573\EE\AOLHostManager.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [mfcok32.exe] C:\WINDOWS\system32\mfcok32.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\RunOnce: [crql32.exe] C:\WINDOWS\system32\crql32.exe O4 - HKLM\..\RunOnce: [apiuz.exe] C:\WINDOWS\apiuz.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - Startup: DLHelperEXE.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe O4 - Global Startup: Microsoft Broadband Networking.lnk = ? O4 - Global Startup: Microsoft Windows.hta O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...84/mcinsctl.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/15bb264591aebcb40721/...ip/RdxIE601.cab O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg...,16/mcgdmgr.cab O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe O23 - Service: Blink2PnP - Unknown owner - C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Remote Procedure Call (RPC) Helper ( 6Q'8) - Unknown owner - C:\WINDOWS\mfcqt32.exe (file missing) StartupList report, 3/5/2005, 5:32:36 PM StartupList version: 1.52.2 Started from : C:\Program Files\hijack\HijackThis.EXE Detected: Windows XP SP1 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NuCam\CamCheck\CamCheck.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\WDBtnMgr.exe C:\WINDOWS\system32\mfcok32.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLHOS~1.EXE C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLServiceHost.exe C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\apiuz.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\MORGAN~1\DESKTOP\WINZIP\winzip32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\hijack\HijackThis.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup: [C:\Documents and Settings\Morgan Kozloski\Start Menu\Programs\Startup] DLHelperEXE.exe Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe Microsoft Broadband Networking.lnk = ? Microsoft Windows.hta -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run MCUpdateExe = C:\PROGRA~1\mcafee.com\agent\mcupdate.exe MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe VSOCheckTask = "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask VirusScan Online = "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" HostManager = C:\Program Files\Common Files\AOL\1107402573\EE\AOLHostManager.exe AOLDialer = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe AOL Spyware Protection = "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime mfcok32.exe = C:\WINDOWS\system32\mfcok32.exe MSConfig = C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce crql32.exe = C:\WINDOWS\system32\crql32.exe apiuz.exe = C:\WINDOWS\apiuz.exe -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:\WINDOWS\system32\crgl.dll - {722E5D99-3739-E117-AA77-5AF0213C5DD6} -------------------------------------------------- Enumerating Task Scheduler jobs: FRU Task #Hewlett-Packard#hp psc 2100 series#1050193684.job FRU Task #Hewlett-Packard#hp psc 2100 series#1050525083.job FRU Task #Hewlett-Packard#hp psc 2100 series#1051587855.job McAfee.com Update Check (MORGAN-Morgan Kozloski).job -------------------------------------------------- Enumerating Download Program Files: [BrowseFolderPopup Class] InProcServer32 = C:\WINDOWS\MCBin\Shared\MGBrwFld.dll CODEBASE = http://download.mcafee.com/molbin/Shared/MGBrwFld.cab [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab [YInstStarter Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll CODEBASE = http://download.yahoo.com/dl/yinst/yinst_current.cab [Cult3D ActiveX Player] InProcServer32 = C:\WINDOWS\System32\Cult3D\IECult.dll CODEBASE = http://i.a.cnn.net/cnn/resources/cult3d/cult.cab [{41F17733-B041-4099-A042-B518BB6A408C}] CODEBASE = http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe [QDiagAOLCCUpdateObj Class] InProcServer32 = C:\WINDOWS\System32\qdiagcc.ocx CODEBASE = http://aolcc.aol.com/computercheckup/qdiagcc.cab [McAfee.com Operating System Class] InProcServer32 = C:\WINDOWS\System32\mcinsctl.dll CODEBASE = http://download.mcafee.com/molbin/shared/m...84/mcinsctl.cab [RdxIE Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\RdxIE.dll CODEBASE = http://207.188.7.150/15bb264591aebcb40721/...ip/RdxIE601.cab [TLIEFlashObj Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\TLIEFlashCtrlU.dll CODEBASE = https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB [DwnldGroupMgr Class] InProcServer32 = C:\WINDOWS\System32\mcgdmgr.dll CODEBASE = http://bin.mcafee.com/molbin/shared/mcgdmg...,16/mcgdmgr.cab [Live365Player Class] InProcServer32 = C:\WINDOWS\DOWNLO~1\CONFLICT.1\Play365.dll CODEBASE = http://www.live365.com/players/play365.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash.ocx CODEBASE = http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab [PopCapLoader Object] InProcServer32 = C:\WINDOWS\Downloaded Program Files\popcaploader.dll CODEBASE = http://www.popcap.com/games/popcaploader_v6.cab [MSN Chat Control 4.5] InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx CODEBASE = http://fdl.msn.com/public/chat/msnchat45.cab -------------------------------------------------- Enumerating Winsock LSP files: Protocol #1: connwsp.dll (file MISSING) Protocol #2: connwsp.dll (file MISSING) Protocol #3: connwsp.dll (file MISSING) Protocol #4: connwsp.dll (file MISSING) Protocol #28: connwsp.dll (file MISSING) -------------------------------------------------- Enumerating Windows NT logon/logoff scripts: *No scripts set to run* Windows NT checkdisk command: BootExecute = autocheck autochk * Windows NT 'Wininit.ini': PendingFileRenameOperations: C:\WINDOWS\system32\crql32.exe => C:\DOCUME~1\MORGAN~1\LOCALS~1\Temp\temp.frB109||O -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\System32\webcheck.dll SysTray: C:\WINDOWS\System32\stobject.dll -------------------------------------------------- End of report, 8,771 bytes Report generated in 0.060 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only C:\WINDOWS\KB824146.log : kjfejl (29256 bytes) C:\WINDOWS\PROTOCOL.INI : uewii (103534 bytes) C:\WINDOWS\Q314862.log : fyzte (29256 bytes) C:\WINDOWS\Q323172.log : wbnzz (103534 bytes) C:\WINDOWS\Q329048.log : zurrn (29256 bytes) C:\WINDOWS\Q810833.log : bhown (103534 bytes) C:\WINDOWS\Q814033.log : tagbp (103534 bytes) C:\WINDOWS\Q819696.log : mbrok (11336 bytes) C:\WINDOWS\winnt256.bmp : rbiygo (11336 bytes) C:\WINDOWS\winnt256.bmp : ujlxw (103534 bytes) C:\WINDOWS\WMSysPr9.prx : jcsdi (29256 bytes) C:\WINDOWS\WMSysPr9.prx : jcsdiy (29256 bytes) C:\WINDOWS\xpsp1hfm.log : flpqs (29256 bytes) C:\WINDOWS\xpsp1hfm.log : inwsy (29256 bytes) C:\WINDOWS\_default.pif : iykzxt (64000 bytes) C:\WINDOWS\_default.pif : jkwkdq (66560 bytes) C:\WINDOWS\_default.pif : qklfjo (3567 bytes) C:\WINDOWS\_default.pif : qyzmvi (3567 bytes) C:\WINDOWS\_default.pif : rfurut (11336 bytes) C:\WINDOWS\_default.pif : uvewel (11736 bytes) C:\WINDOWS\_default.pif : vhqhtq (11736 bytes) C:\WINDOWS\_default.pif : xxhhby (7471 bytes) C:\WINDOWS\_default.pif : yjtahd (7471 bytes) |
 |
 
|
|
Mar 6 2005, 03:21 PM
Post
#2
|
|
 Cleaner on Duty Group: HJT Team Posts: 5,480 Joined: 1-September 04 From: Bucharest, Romania Member No.: 2,383 |
Some items are disabled in MSCONFIG, and not all your startup items are visible.
Go to Start -> Run -> Type msconfig and press Enter. Click the Startup tab and check all Startup items or press the Enable All button and Close. Then press the Exit without restart button. Do not reboot your computer. Run HijackThis and post a new log please. --------------------  Everyday is virus day. Do you know where your recovery CDs are ? Did you create them yet ? |
|
|
|
|
Mar 7 2005, 10:13 AM
Post
#3
|
|
|
New Member Group: Members Posts: 12 Joined: 5-March 05 Member No.: 13,669 |
Here's a repost per Daisuke's request. Thanks again for taking a look!
Logfile of HijackThis v1.99.1 Scan saved at 7:04:30 AM, on 3/7/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\apiuz.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\mfcok32.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLHOS~1.EXE C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\freescan\freescan.exe C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLServiceHost.exe C:\WINDOWS\System32\dwwin.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\MORGAN~1\DESKTOP\WINZIP\winzip32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\hijack\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {2B7E95AD-F49A-B2B2-7702-10D4ABFF9B32} - C:\WINDOWS\system32\addia.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1107402573\EE\AOLHostManager.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [mfcok32.exe] C:\WINDOWS\system32\mfcok32.exe O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 8\LaunchList.exe O4 - HKLM\..\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY O4 - HKLM\..\Run: [HPCDTray] "C:\Program Files\HP CD-DVD\Umbrella\hpcdtray.exe" O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [CamCheck] C:\Program Files\NuCam\CamCheck\CamCheck.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\RunOnce: [apiuz.exe] C:\WINDOWS\apiuz.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - Startup: DLHelperEXE.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0a\aoltray.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: Image Transfer.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Broadband Networking.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: officejet 6100.lnk = ? O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/m...83/mcinsctl.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/15bb264591aebcb40721/...ip/RdxIE601.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1110126906063 O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m...,20/mcgdmgr.cab O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe O23 - Service: Blink2PnP - Unknown owner - C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Remote Procedure Call (RPC) Helper ( 6Q'8) - Unknown owner - C:\WINDOWS\mfcqt32.exe (file missing) StartupList report, 3/7/2005, 7:05:36 AM StartupList version: 1.52.2 Started from : C:\Program Files\hijack\HijackThis.EXE Detected: Windows XP SP1 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\apiuz.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\mfcok32.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLHOS~1.EXE C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\freescan\freescan.exe C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLServiceHost.exe C:\WINDOWS\System32\dwwin.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\MORGAN~1\DESKTOP\WINZIP\winzip32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\hijack\HijackThis.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup: [C:\Documents and Settings\Morgan Kozloski\Start Menu\Programs\Startup] DLHelperEXE.exe PowerReg Scheduler.exe Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0a\aoltray.exe America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe Image Transfer.lnk = ? InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe Microsoft Broadband Networking.lnk = ? Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE Microsoft Works Calendar Reminders.lnk = ? officejet 6100.lnk = ? -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run HostManager = C:\Program Files\Common Files\AOL\1107402573\EE\AOLHostManager.exe AOLDialer = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe AOL Spyware Protection = "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime mfcok32.exe = C:\WINDOWS\system32\mfcok32.exe VSOCheckTask = "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask VirusScan Online = "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" MCAgentExe = c:\PROGRA~1\mcafee.com\agent\McAgent.exe MCUpdateExe = C:\PROGRA~1\mcafee.com\agent\mcupdate.exe WorksFUD = C:\Program Files\Microsoft Works\wkfud.exe WD Button Manager = WDBtnMgr.exe TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot Share-to-Web Namespace Daemon = C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe Pure Networks Port Magic = "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run P2P Networking = C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART nwiz = nwiz.exe /installquiet NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers LaunchList = C:\Program Files\Pinnacle\Studio 8\LaunchList.exe KAZAA = C:\Program Files\Kazaa\kazaa.exe /SYSTRAY HPCDTray = "C:\Program Files\HP CD-DVD\Umbrella\hpcdtray.exe" DVDBitSet = "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI dla = C:\WINDOWS\system32\dla\tfswctrl.exe CamCheck = C:\Program Files\NuCam\CamCheck\CamCheck.exe BJCFD = C:\Program Files\BroadJump\Client Foundation\CFD.exe -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce apiuz.exe = C:\WINDOWS\apiuz.exe -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" Spyware Begone = c:\freescan\freescan.exe -FastScan Yahoo! Pager = C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background Microsoft Works Update Detection = C:\Program Files\Microsoft Works\WkDetect.exe -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:\WINDOWS\system32\addia.dll - {2B7E95AD-F49A-B2B2-7702-10D4ABFF9B32} -------------------------------------------------- Enumerating Task Scheduler jobs: FRU Task #Hewlett-Packard#hp psc 2100 series#1050193684.job FRU Task #Hewlett-Packard#hp psc 2100 series#1050525083.job FRU Task #Hewlett-Packard#hp psc 2100 series#1051587855.job McAfee.com Scan for Viruses - My Computer (MORGAN-Morgan Kozloski).job McAfee.com Update Check (MORGAN-Morgan Kozloski).job -------------------------------------------------- Enumerating Download Program Files: [BrowseFolderPopup Class] InProcServer32 = C:\WINDOWS\MCBin\Shared\MGBrwFld.dll CODEBASE = http://download.mcafee.com/molbin/Shared/MGBrwFld.cab [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab [YInstStarter Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll CODEBASE = http://download.yahoo.com/dl/yinst/yinst_current.cab [Cult3D ActiveX Player] InProcServer32 = C:\WINDOWS\System32\Cult3D\IECult.dll CODEBASE = http://i.a.cnn.net/cnn/resources/cult3d/cult.cab [{41F17733-B041-4099-A042-B518BB6A408C}] CODEBASE = http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe [QDiagAOLCCUpdateObj Class] InProcServer32 = C:\WINDOWS\System32\qdiagcc.ocx CODEBASE = http://aolcc.aol.com/computercheckup/qdiagcc.cab [McAfee.com Operating System Class] InProcServer32 = C:\WINDOWS\System32\mcinsctl.dll CODEBASE = http://download.av.aol.com/molbin/shared/m...83/mcinsctl.cab [RdxIE Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\RdxIE.dll CODEBASE = http://207.188.7.150/15bb264591aebcb40721/...ip/RdxIE601.cab [WUWebControl Class] InProcServer32 = C:\WINDOWS\System32\wuweb.dll CODEBASE = http://v5.windowsupdate.microsoft.com/v5co...b?1110126906063 [TLIEFlashObj Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\TLIEFlashCtrlU.dll CODEBASE = https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB [DwnldGroupMgr Class] InProcServer32 = C:\WINDOWS\System32\McGDMgr.dll CODEBASE = http://download.av.aol.com/molbin/shared/m...,20/mcgdmgr.cab [Live365Player Class] InProcServer32 = C:\WINDOWS\DOWNLO~1\CONFLICT.1\Play365.dll CODEBASE = http://www.live365.com/players/play365.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash.ocx CODEBASE = http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab [PopCapLoader Object] InProcServer32 = C:\WINDOWS\Downloaded Program Files\popcaploader.dll CODEBASE = http://www.popcap.com/games/popcaploader_v6.cab [MSN Chat Control 4.5] InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx CODEBASE = http://fdl.msn.com/public/chat/msnchat45.cab -------------------------------------------------- Enumerating Winsock LSP files: Protocol #1: connwsp.dll (file MISSING) Protocol #2: connwsp.dll (file MISSING) Protocol #3: connwsp.dll (file MISSING) Protocol #4: connwsp.dll (file MISSING) Protocol #28: connwsp.dll (file MISSING) -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\System32\webcheck.dll SysTray: C:\WINDOWS\System32\stobject.dll -------------------------------------------------- End of report, 10,354 bytes Report generated in 0.120 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only C:\WINDOWS\cdplayer.ini : nbokdg (7471 bytes) C:\WINDOWS\control.ini : fcgqfq (3567 bytes) C:\WINDOWS\dasetup.log : yczdza (66560 bytes) C:\WINDOWS\KB824146.log : kjfejl (29256 bytes) C:\WINDOWS\Prairie Wind.bmp : swkbou (11736 bytes) C:\WINDOWS\PROTOCOL.INI : uewii (103534 bytes) C:\WINDOWS\Q311889.log : kxcgqe (7471 bytes) C:\WINDOWS\Q314147.log : cqnmko (3567 bytes) C:\WINDOWS\Q314862.log : fyzte (29256 bytes) C:\WINDOWS\Q317277.log : vqfrer (66560 bytes) C:\WINDOWS\Q323172.log : wbnzz (103534 bytes) C:\WINDOWS\Q329048.log : zurrn (29256 bytes) C:\WINDOWS\Q810833.log : bhown (103534 bytes) C:\WINDOWS\Q811630.log : kxoxmn (11336 bytes) C:\WINDOWS\Q814033.log : tagbp (103534 bytes) C:\WINDOWS\Q817287.log : cyydhx (29256 bytes) C:\WINDOWS\Q819696.log : mbrok (11336 bytes) C:\WINDOWS\sessmgr.setup.log : vgtkou (11736 bytes) C:\WINDOWS\setuperr.log : gievkp (3567 bytes) C:\WINDOWS\Sti_Trace.log : ienfsw (11336 bytes) C:\WINDOWS\Sti_Trace.log : yipinr (66560 bytes) C:\WINDOWS\tiscali_it_2.ico : bfgsuh (29256 bytes) C:\WINDOWS\winnt256.bmp : rbiygo (11336 bytes) C:\WINDOWS\winnt256.bmp : ujlxw (103534 bytes) C:\WINDOWS\wmsetup.log : kvkwat (11336 bytes) C:\WINDOWS\WMSysPr9.prx : jcsdi (29256 bytes) C:\WINDOWS\WMSysPr9.prx : jcsdiy (29256 bytes) C:\WINDOWS\WMSysPrx.prx : cvdbcw (29256 bytes) C:\WINDOWS\xpsp1hfm.log : flpqs (29256 bytes) C:\WINDOWS\xpsp1hfm.log : inwsy (29256 bytes) C:\WINDOWS\_default.pif : gfpcqw (11736 bytes) C:\WINDOWS\_default.pif : iykzxt (64000 bytes) C:\WINDOWS\_default.pif : jkwkdq (66560 bytes) C:\WINDOWS\_default.pif : qklfjo (3567 bytes) C:\WINDOWS\_default.pif : qyzmvi (3567 bytes) C:\WINDOWS\_default.pif : rfurut (11336 bytes) C:\WINDOWS\_default.pif : uvewel (11736 bytes) C:\WINDOWS\_default.pif : vhqhtq (11736 bytes) C:\WINDOWS\_default.pif : xxhhby (7471 bytes) C:\WINDOWS\_default.pif : yjtahd (7471 bytes) |
|
|
|
|
Mar 7 2005, 10:33 AM
Post
#4
|
|
 Malware Sniffer Group: HJT Team Posts: 757 Joined: 4-September 04 From: West Coast of Scotland Member No.: 2,438 |
Morgan,
Please use the Add Reply button in the existing thread when posting a reply. |
|
|
|
|
Mar 7 2005, 01:32 PM
Post
#5
|
|
|
Cleaner on Duty Group: HJT Team Posts: 5,480 Joined: 1-September 04 From: Bucharest, Romania Member No.: 2,383 |
Thanks penmore
Morgan, follow carefully my instructions. You are using Kazaa. This is not technically malware by itself, but it installs malware in order to run properly and it opens the door for every other nasty program you can think of. I strongly recommend that you remove it. Read this article for alternatives that will provide some of the same function without the garbage: http://www.spywareinfo.com/articles/p2p/ If you opt to remove it, first use Add/Remove Program to remove it and any reference to Altnet and P2P Networking. Go to your control panel, then to add/remove programs...uninstall P2P networking...If/when asked whether you also want to remove Altnet components, say 'Yes'. P2P Networking is a totally useless Kazaa add-on, and it's been reported to be responsible for serious system slowdowns. You may want to print out these directions as the Internet will not be available. Please continue with the next step if you run into a problem with the current one. Just be sure to let us know what the problem was when you reply. When choosing anti-spyware protection, you should rely on products with deserved reputations and proven track records: Spyware Begone is a mediocre anti-spy software. http://www.spywarewarrior.com/rogue_anti-spyware.htm You can use these free programs: Ad-Aware SE, Spybot Search & Destroy + SpywareBlaster. Please uninstall Spyware Begone from Add\Remove Programs. This is very important ! Internet Explorer should remain closed during the cleanup. If you open Internet Explorer the fix will fail. (Steps 1 - 8) Please make sure that you can view all hidden files: A. On the Tools menu in Windows Explorer, click Folder Options. B. Click the View tab. C. Under Hidden files and folders, click Show hidden files and folders. D. Uncheck Hide extensions for known filetypes and Hide protected operating system files. How to see hidden files in Windows Please download About:Buster from here: About:Buster Download. Once it is downloaded extract it to c:\aboutbuster. We will use that program later in this process. Don't use it yet. Download Ad-aware SE: here Install it. When you get the last screen, with the "Finish" button and 3 options, uncheck those three items. Open AdAware and click the "Check for updates now" link. Close AdAware. Don't use it yet. Copy the contents of the Quote Box below to Notepad. Click File menu -> Save and name the file as remove.reg Change the Save as Type to All Files Save this file on the desktop. We will use it later. QUOTE REGEDIT4 [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6Q'8] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6Q'8] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\6Q'8] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6Q'8] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW] Step 1: Go to Start -> Run and type Services.msc, then press the OK button. Look for a service called Remote Procedure Call (RPC) Helper. Double click on that service and press the Stop button, and then set the Startup type to Disabled. Press OK, and close all the windows. Step 2: Press control-alt-delete to get into the task manager and end the follow processes if they exist: apiuz.exe mfcok32.exe This is very important ! Internet Explorer should remain closed during the cleanup. If you open Internet Explorer the fix will fail. (Steps 1 - 8) Step 3: Run HijackThis!, press "Scan" and tick the boxes next to all these, close all other windows and browsers, then press "Fix Checked" button. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ifahr.dll/sp.html#28129 R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {2B7E95AD-F49A-B2B2-7702-10D4ABFF9B32} - C:\WINDOWS\system32\addia.dll O4 - HKLM\..\Run: [mfcok32.exe] C:\WINDOWS\system32\mfcok32.exe O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY O4 - HKLM\..\RunOnce: [apiuz.exe] C:\WINDOWS\apiuz.exe O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan \ O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/15bb264591aebcb40721/...ip/RdxIE601.cab O23 - Service: Remote Procedure Call (RPC) Helper ( 6Q'8) - Unknown owner - C:\WINDOWS\mfcqt32.exe (file missing) This is a registration reminder that is used by a number of different companies. It is not needed and some experts think that it reports back to the company about your computer, so I suggest fixing it... O4 - Startup: PowerReg Scheduler.exe Step 4: Reboot your computer into Safe Mode. I now need you to delete the following files, if present: C:\WINDOWS\ifahr.dll <-- this file C:\WINDOWS\system32\addia.dll <-- this file C:\WINDOWS\system32\mfcok32.exe <-- this file C:\WINDOWS\apiuz.exe <-- this file C:\WINDOWS\mfcqt32.exe <-- this file C:\WINDOWS\System32\P2P Networking\ <-- this folder C:\Program Files\Kazaa\ <-- this folder c:\freescan\ <-- this folder If you get an error when deleting a file, right click on the file and check to see if the read only attribute is checked. if it is, uncheck it and try again. Step 5: Double-click on the remove.reg file you saved earlier on your desktop, and when it prompts to merge say Yes, and this will clear some registry entries left behind by the process. Step 6: This is the step where we will use About:Buster that you had downloaded previously. Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so. When it completed move on to step 7. Step 7: Run AdAware, press the Start button, uncheck Scan for negligible risk entries, select Scan Volume for ADS and press Next. Let AdAware remove anything it finds. Run AdAware again, press the "Start" button, uncheck "Scan for negligible risk entries", select "Perform full system scan" and press "Next". Let AdAware remove anything it finds. Step 8: Clean out temporary and Temporary Internet Files. Go to Start -> Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove: Temporary Files Temporary Internet Files Recycle Bin Step 9: Reboot your computer back to normal mode so that we can restore files that were deleted by this infection:
%windir%\system Please check Internet Explorer settings: Open Internet Explorer - > Tools -> Internet Options ... -> click the Security tab -> click Internet icon -> press the Custom Level ,,, button. Under ActiveX controls and plug-ins tick: - Download signed ActiveX controls - Prompt - Download unsigned ActiveX controls Disable - Initialize and script ActiveX controls not marked as safe Disable - Run ActiveX controls and plug-ins Enabled - Script ActiveX controls marked safe for scripting Prompt Run an online antivirus scan at: http://housecall.antivirus.com/ Please make sure that AutoClean is checked. Make sure you Reboot your machine, run hijackthis and post a new HJT log. There is no need to post the Startup List. -------------------- Everyday is virus day. Do you know where your recovery CDs are ? Did you create them yet ? |
|
|
|
|
Mar 8 2005, 10:37 AM
Post
#6
|
|
|
New Member Group: Members Posts: 12 Joined: 5-March 05 Member No.: 13,669 |
Whew, I followed your steps. Here's a repost of HJT log. Logfile of HijackThis v1.99.1 Scan saved at 7:33:02 AM, on 3/8/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\mcafee.com\agent\McAgent.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLHOS~1.EXE c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINDOWS\System32\WDBtnMgr.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\PROGRA~1\COMMON~1\AOL\110740~1\EE\AOLServiceHost.exe C:\Program Files\HP CD-DVD\Umbrella\hpcdtray.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\NuCam\CamCheck\CamCheck.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe C:\Program Files\Microsoft ActiveSync\WCESMgr.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p...er=6&ar=msnhome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...B_PVER}&ar=home R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1107402573\EE\AOLHostManager.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 8\LaunchList.exe O4 - HKLM\..\Run: [HPCDTray] "C:\Program Files\HP CD-DVD\Umbrella\hpcdtray.exe" O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [CamCheck] C:\Program Files\NuCam\CamCheck\CamCheck.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - Startup: DLHelperEXE.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0a\aoltray.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: Image Transfer.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Broadband Networking.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: officejet 6100.lnk = ? O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/m...83/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1110126906063 O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - |