Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virtumundo Infected


  • This topic is locked This topic is locked
3 replies to this topic

#1 Menthu

Menthu

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 20 March 2008 - 02:18 PM

Afternoon, I am having a bit of a problem. I recently was infected with both Virtumundo and Smitfraud. I do believe I got rid of the Smitfraud, but the Virtumundo just won't go away.

I restarted in safe mode. Ran Vundo Fix, found 3, ran again, found none. Ran VirtumundoBegone; log to follow. Ran ATF Cleaner. Followed that up with SUPERAntiSpyware (was updated and had Scanner options properly selected). I then rebooted. And I am still getting a pop-up every time i open a window or tab.

I am running Windows XP SP2 32bit.

Thank you for any time and effort that you can give me on this.


[03/20/2008, 11:05:54] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\johns\My Documents\VirtumundoBeGone.exe" )
[03/20/2008, 11:05:58] - Detected System Information:
[03/20/2008, 11:05:58] - Windows Version: 5.1.2600, Service Pack 2
[03/20/2008, 11:05:58] - Current Username: johns (Admin)
[03/20/2008, 11:05:58] - Windows is in NORMAL mode.
[03/20/2008, 11:05:58] - Searching for Browser Helper Objects:
[03/20/2008, 11:05:58] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/20/2008, 11:05:58] - BHO 2: {168A01DA-3C1E-482D-961D-6C2A6543BC61} ()
[03/20/2008, 11:05:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:58] - No filename found. Continuing.
[03/20/2008, 11:05:58] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/20/2008, 11:05:58] - BHO 4: {7098883F-42B5-4FC1-81DD-0156C2771DA5} ()
[03/20/2008, 11:05:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:58] - Checking for HKLM\...\Winlogon\Notify\xxwtt
[03/20/2008, 11:05:58] - Key not found: HKLM\...\Winlogon\Notify\xxwtt, continuing.
[03/20/2008, 11:05:58] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/20/2008, 11:05:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:58] - No filename found. Continuing.
[03/20/2008, 11:05:58] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[03/20/2008, 11:05:58] - BHO 7: {91223DE9-F8E6-4FFD-8889-BE6784C18696} ()
[03/20/2008, 11:05:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:58] - Checking for HKLM\...\Winlogon\Notify\cbxwvsp
[03/20/2008, 11:05:58] - Found: HKLM\...\Winlogon\Notify\cbxwvsp - This is probably Virtumundo.
[03/20/2008, 11:05:58] - Assigning {91223DE9-F8E6-4FFD-8889-BE6784C18696} MSEvents Object
[03/20/2008, 11:05:58] - BHO list has been changed! Starting over...
[03/20/2008, 11:05:58] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/20/2008, 11:05:58] - BHO 2: {168A01DA-3C1E-482D-961D-6C2A6543BC61} ()
[03/20/2008, 11:05:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:58] - No filename found. Continuing.
[03/20/2008, 11:05:58] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/20/2008, 11:05:59] - BHO 4: {7098883F-42B5-4FC1-81DD-0156C2771DA5} ()
[03/20/2008, 11:05:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:59] - Checking for HKLM\...\Winlogon\Notify\xxwtt
[03/20/2008, 11:05:59] - Key not found: HKLM\...\Winlogon\Notify\xxwtt, continuing.
[03/20/2008, 11:05:59] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/20/2008, 11:05:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:59] - No filename found. Continuing.
[03/20/2008, 11:05:59] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[03/20/2008, 11:05:59] - BHO 7: {91223DE9-F8E6-4FFD-8889-BE6784C18696} (MSEvents Object)
[03/20/2008, 11:05:59] - ALERT: Found MSEvents Object!
[03/20/2008, 11:05:59] - BHO 8: {E3DD2274-6023-47AD-81B1-D56ECB320284} ()
[03/20/2008, 11:05:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:59] - No filename found. Continuing.
[03/20/2008, 11:05:59] - BHO 9: {fc7a0e3c-04b9-4661-b44a-2e89a89f0089} ()
[03/20/2008, 11:05:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:05:59] - Checking for HKLM\...\Winlogon\Notify\yoxaawwn
[03/20/2008, 11:05:59] - Key not found: HKLM\...\Winlogon\Notify\yoxaawwn, continuing.
[03/20/2008, 11:05:59] - Finished Searching Browser Helper Objects
[03/20/2008, 11:05:59] - *** Detected MSEvents Object
[03/20/2008, 11:05:59] - Trying to remove MSEvents Object...
[03/20/2008, 11:06:00] - Terminating Process: IEXPLORE.EXE
[03/20/2008, 11:06:00] - Terminating Process: RUNDLL32.EXE
[03/20/2008, 11:06:01] - Disabling Automatic Shell Restart
[03/20/2008, 11:06:01] - Terminating Process: EXPLORER.EXE
[03/20/2008, 11:06:02] - Suspending the NT Session Manager System Service
[03/20/2008, 11:06:02] - Terminating Windows NT Logon/Logoff Manager

[03/20/2008, 11:27:37] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\johns\My Documents\VirtumundoBeGone.exe" )
[03/20/2008, 11:27:40] - Detected System Information:
[03/20/2008, 11:27:40] - Windows Version: 5.1.2600, Service Pack 2
[03/20/2008, 11:27:40] - Current Username: johns (Admin)
[03/20/2008, 11:27:40] - Windows is in SAFE mode.
[03/20/2008, 11:27:40] - Searching for Browser Helper Objects:
[03/20/2008, 11:27:40] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/20/2008, 11:27:40] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/20/2008, 11:27:40] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/20/2008, 11:27:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:27:40] - No filename found. Continuing.
[03/20/2008, 11:27:40] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[03/20/2008, 11:27:40] - BHO 5: {91223DE9-F8E6-4FFD-8889-BE6784C18696} (MSEvents Object)
[03/20/2008, 11:27:40] - ALERT: Found MSEvents Object!
[03/20/2008, 11:27:40] - BHO 6: {E3DD2274-6023-47AD-81B1-D56ECB320284} ()
[03/20/2008, 11:27:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:27:40] - No filename found. Continuing.
[03/20/2008, 11:27:40] - BHO 7: {EEE0371D-082B-4D5B-971B-8B299A8525F4} ()
[03/20/2008, 11:27:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:27:40] - Checking for HKLM\...\Winlogon\Notify\xxwtt
[03/20/2008, 11:27:40] - Key not found: HKLM\...\Winlogon\Notify\xxwtt, continuing.
[03/20/2008, 11:27:40] - BHO 8: {fc7a0e3c-04b9-4661-b44a-2e89a89f0089} ()
[03/20/2008, 11:27:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:27:40] - Checking for HKLM\...\Winlogon\Notify\yoxaawwn
[03/20/2008, 11:27:40] - Key not found: HKLM\...\Winlogon\Notify\yoxaawwn, continuing.
[03/20/2008, 11:27:40] - Finished Searching Browser Helper Objects
[03/20/2008, 11:27:40] - *** Detected MSEvents Object
[03/20/2008, 11:27:40] - Trying to remove MSEvents Object...
[03/20/2008, 11:27:41] - Terminating Process: IEXPLORE.EXE
[03/20/2008, 11:27:41] - Terminating Process: RUNDLL32.EXE
[03/20/2008, 11:27:42] - Disabling Automatic Shell Restart
[03/20/2008, 11:27:42] - Terminating Process: EXPLORER.EXE
[03/20/2008, 11:27:42] - Suspending the NT Session Manager System Service
[03/20/2008, 11:27:42] - Terminating Windows NT Logon/Logoff Manager
[03/20/2008, 11:32:43] - Re-enabling Automatic Shell Restart
[03/20/2008, 11:32:43] - File to disable: C:\WINDOWS\system32\cbxwvsp.dll
[03/20/2008, 11:32:43] - Renaming C:\WINDOWS\system32\cbxwvsp.dll -> C:\WINDOWS\system32\cbxwvsp.dll.vir
[03/20/2008, 11:32:43] - File successfully renamed!
[03/20/2008, 11:32:43] - Removing HKLM\...\Browser Helper Objects\{91223DE9-F8E6-4FFD-8889-BE6784C18696}
[03/20/2008, 11:32:43] - Removing HKCR\CLSID\{91223DE9-F8E6-4FFD-8889-BE6784C18696}
[03/20/2008, 11:32:43] - Adding Kill Bit for ActiveX for GUID: {91223DE9-F8E6-4FFD-8889-BE6784C18696}
[03/20/2008, 11:32:43] - Deleting ATLEvents/MSEvents Registry entries
[03/20/2008, 11:32:43] - Removing HKLM\...\Winlogon\Notify\cbxwvsp
[03/20/2008, 11:32:43] - Searching for Browser Helper Objects:
[03/20/2008, 11:32:43] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/20/2008, 11:32:43] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/20/2008, 11:32:43] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/20/2008, 11:32:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:32:43] - No filename found. Continuing.
[03/20/2008, 11:32:43] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[03/20/2008, 11:32:43] - BHO 5: {E3DD2274-6023-47AD-81B1-D56ECB320284} ()
[03/20/2008, 11:32:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:32:43] - No filename found. Continuing.
[03/20/2008, 11:32:43] - BHO 6: {EEE0371D-082B-4D5B-971B-8B299A8525F4} ()
[03/20/2008, 11:32:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:32:43] - Checking for HKLM\...\Winlogon\Notify\xxwtt
[03/20/2008, 11:32:43] - Key not found: HKLM\...\Winlogon\Notify\xxwtt, continuing.
[03/20/2008, 11:32:43] - BHO 7: {fc7a0e3c-04b9-4661-b44a-2e89a89f0089} ()
[03/20/2008, 11:32:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 11:32:43] - Checking for HKLM\...\Winlogon\Notify\yoxaawwn
[03/20/2008, 11:32:43] - Key not found: HKLM\...\Winlogon\Notify\yoxaawwn, continuing.
[03/20/2008, 11:32:43] - Finished Searching Browser Helper Objects
[03/20/2008, 11:32:43] - Finishing up...
[03/20/2008, 11:32:43] - A restart is needed.
[03/20/2008, 11:32:43] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[03/20/2008, 11:35:56] - Attempting to Restart via STOP error (Blue Screen!)

[03/20/2008, 12:17:36] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\johns\My Documents\VirtumundoBeGone.exe" )
[03/20/2008, 12:17:40] - Detected System Information:
[03/20/2008, 12:17:40] - Windows Version: 5.1.2600, Service Pack 2
[03/20/2008, 12:17:40] - Current Username: johns (Admin)
[03/20/2008, 12:17:40] - Windows is in SAFE mode.
[03/20/2008, 12:17:40] - Searching for Browser Helper Objects:
[03/20/2008, 12:17:40] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/20/2008, 12:17:40] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/20/2008, 12:17:40] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/20/2008, 12:17:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 12:17:40] - No filename found. Continuing.
[03/20/2008, 12:17:40] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[03/20/2008, 12:17:40] - BHO 5: {91223DE9-F8E6-4FFD-8889-BE6784C18696} ()
[03/20/2008, 12:17:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 12:17:40] - No filename found. Continuing.
[03/20/2008, 12:17:40] - BHO 6: {E3DD2274-6023-47AD-81B1-D56ECB320284} ()
[03/20/2008, 12:17:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 12:17:40] - No filename found. Continuing.
[03/20/2008, 12:17:40] - BHO 7: {ECC96D00-25AE-4B6E-8756-ADFC284188BE} ()
[03/20/2008, 12:17:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 12:17:40] - Checking for HKLM\...\Winlogon\Notify\xxwtt
[03/20/2008, 12:17:40] - Key not found: HKLM\...\Winlogon\Notify\xxwtt, continuing.
[03/20/2008, 12:17:40] - BHO 8: {fc7a0e3c-04b9-4661-b44a-2e89a89f0089} ()
[03/20/2008, 12:17:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/20/2008, 12:17:40] - Checking for HKLM\...\Winlogon\Notify\yoxaawwn
[03/20/2008, 12:17:40] - Key not found: HKLM\...\Winlogon\Notify\yoxaawwn, continuing.
[03/20/2008, 12:17:40] - Finished Searching Browser Helper Objects
[03/20/2008, 12:17:40] - Finishing up...
[03/20/2008, 12:17:40] - Nothing found! Exiting...




SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/20/2008 at 12:54 PM

Application Version : 4.0.1154

Core Rules Database Version : 3421
Trace Rules Database Version: 1413

Scan type : Complete Scan
Total Scan Time : 00:30:25

Memory items scanned : 200
Memory threats detected : 1
Registry items scanned : 5172
Registry threats detected : 9
File items scanned : 16291
File threats detected : 2

Adware.Vundo Variant/Resident
C:\WINDOWS\SYSTEM32\XXWTT.DLL
C:\WINDOWS\SYSTEM32\XXWTT.DLL

Adware.Vundo-Variant/Small-A
HKLM\Software\Classes\CLSID\{fc7a0e3c-04b9-4661-b44a-2e89a89f0089}
HKCR\CLSID\{FC7A0E3C-04B9-4661-B44A-2E89A89F0089}
HKCR\CLSID\{FC7A0E3C-04B9-4661-B44A-2E89A89F0089}\InprocServer32
HKCR\CLSID\{FC7A0E3C-04B9-4661-B44A-2E89A89F0089}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\YOXAAWWN.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fc7a0e3c-04b9-4661-b44a-2e89a89f0089}

Adware.Vundo-Variant
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ECC96D00-25AE-4B6E-8756-ADFC284188BE}
HKCR\CLSID\{ECC96D00-25AE-4B6E-8756-ADFC284188BE}
HKCR\CLSID\{ECC96D00-25AE-4B6E-8756-ADFC284188BE}\InprocServer32
HKCR\CLSID\{ECC96D00-25AE-4B6E-8756-ADFC284188BE}\InprocServer32#ThreadingModel

BC AdBot (Login to Remove)

 


#2 Menthu

Menthu
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 20 March 2008 - 02:19 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:56 PM, on 3/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\ORL\VNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.google.com/mail/#inbox
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {168A01DA-3C1E-482D-961D-6C2A6543BC61} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {91223DE9-F8E6-4FFD-8889-BE6784C18696} - (no file)
O2 - BHO: (no name) - {E3DD2274-6023-47AD-81B1-D56ECB320284} - (no file)
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\ORL\VNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200705...ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312...meInstaller.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4A026B12-94F3-4D2F-A468-96AA55DE20A5} (NetCamPlayerWeb11g Control) - http://192.168.30.33/img/NetCamPlayerWeb11g.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1169250375313
O16 - DPF: {CDF3B180-D408-11CE-AE2C-0080C786E37D} (FarPoint Text Control) - https://nteractonline.com/lib/Edt32x20.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{368D1EDB-FCFB-46F2-B304-7784143DE20A}: NameServer = 24.116.221.232,24.116.2.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{EBA559CA-8CB8-4CBC-90A9-08319BA70CEF}: NameServer = 208.24.218.3,208.24.218.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{368D1EDB-FCFB-46F2-B304-7784143DE20A}: NameServer = 24.116.221.232,24.116.2.34
O17 - HKLM\System\CS4\Services\Tcpip\..\{368D1EDB-FCFB-46F2-B304-7784143DE20A}: NameServer = 24.116.221.232,24.116.2.34
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: cbxwvsp - C:\WINDOWS\
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VNC Server (winvnc) - AT&T Research Labs Cambridge - C:\Program Files\ORL\VNC\WinVNC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 7283 bytes

#3 Menthu

Menthu
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 24 March 2008 - 09:46 AM

Formatted. Not worth fighting it. Close thread.

#4 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:10:50 PM

Posted 24 March 2008 - 05:09 PM

Closed by request.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users