Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

System Check-up


  • Please log in to reply
6 replies to this topic

#1 Gem

Gem

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Location:Santa Maria, California
  • Local time:06:28 AM

Posted 28 December 2005 - 02:47 PM

Hi Folks - Gem here!

I'm doing some maintenance on my daughter's laptop and have scanned using Norton 2006 Antivirus / NoAdware / Spybot / SpySweeper and have removed quite a bit of adware/spyware junk. The HD is now coming up clean, but if you would, can you please review the Hijackthis logfile below and tell me if I've had success in removing the nasties from her PC. I know the nasties are famous for hiding out in places my eyes can't see

Thank you,

Gem

Logfile of HijackThis v1.99.1
Scan saved at 11:36:39 AM, on 12/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\WPC54Cfg.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Symantec\Norton Ghost\Console\V2iConsole.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [peiikm] C:\WINDOWS\system32\yeimnw.exe
O4 - HKLM\..\Run: [xuqhax] C:\WINDOWS\system32\pgguijhw.exe
O4 - HKLM\..\Run: [ydamdy] C:\WINDOWS\system32\tswghkzl.exe
O4 - HKLM\..\Run: [vugton] C:\WINDOWS\system32\gpgj.exe
O4 - HKLM\..\Run: [lznnso] C:\WINDOWS\system32\qkdvbgfe.exe
O4 - HKLM\..\Run: [ceqah] C:\WINDOWS\system32\meva.exe
O4 - HKLM\..\Run: [bzdc] C:\WINDOWS\system32\tlnerto.exe
O4 - HKLM\..\Run: [bivntzb] C:\WINDOWS\system32\brvhtnms.exe
O4 - HKLM\..\Run: [mujaiq] C:\WINDOWS\system32\ltasuf.exe
O4 - HKLM\..\Run: [bffqlwc] C:\WINDOWS\system32\aywh.exe
O4 - HKLM\..\Run: [etopp] C:\WINDOWS\system32\lscaiuq.exe
O4 - HKLM\..\Run: [mwfrq] C:\WINDOWS\system32\zvqscycu.exe
O4 - HKLM\..\Run: [fmzlqi] C:\WINDOWS\system32\uzybho.exe
O4 - HKLM\..\Run: [iqfhmrm] C:\WINDOWS\system32\zrpsjps.exe
O4 - HKLM\..\Run: [tzfe] C:\WINDOWS\system32\dthjfow.exe
O4 - HKLM\..\Run: [klhrsqn] C:\WINDOWS\system32\fwpsk.exe
O4 - HKLM\..\Run: [koufcll] C:\WINDOWS\system32\wtmhfwb.exe
O4 - HKLM\..\Run: [eibb] C:\WINDOWS\system32\fjor.exe
O4 - HKLM\..\Run: [kauj] C:\WINDOWS\system32\eurufv.exe
O4 - HKLM\..\Run: [xwdf] C:\WINDOWS\system32\zxahfxl.exe
O4 - HKLM\..\Run: [llsefopm] C:\WINDOWS\system32\ntposv.exe
O4 - HKLM\..\Run: [mcqmc] C:\WINDOWS\system32\qwicwcj.exe
O4 - HKLM\..\Run: [gpunu] C:\WINDOWS\system32\ftgwmri.exe
O4 - HKLM\..\Run: [dhavrkv] C:\WINDOWS\system32\ncvqmw.exe
O4 - HKLM\..\Run: [lszzuuqh] C:\WINDOWS\system32\hpemrivy.exe
O4 - HKLM\..\Run: [bhjqwx] C:\WINDOWS\system32\upwcricp.exe
O4 - HKLM\..\Run: [caxvg] C:\WINDOWS\system32\ojvdjhb.exe
O4 - HKLM\..\Run: [piqkbj] C:\WINDOWS\system32\hfelyjpi.exe
O4 - HKLM\..\Run: [cayadu] C:\WINDOWS\system32\szjezc.exe
O4 - HKLM\..\Run: [hcpciqh] C:\WINDOWS\system32\hlfaeym.exe
O4 - HKLM\..\Run: [gcnid] C:\WINDOWS\system32\atbg.exe
O4 - HKLM\..\Run: [uqeevrem] C:\WINDOWS\system32\pdcgcpo.exe
O4 - HKLM\..\Run: [nmos] C:\WINDOWS\system32\fdzcnosg.exe
O4 - HKLM\..\Run: [vdfsn] C:\WINDOWS\system32\yrrpguif.exe
O4 - HKLM\..\Run: [jozybawj] C:\WINDOWS\system32\elxdrk.exe
O4 - HKLM\..\Run: [mfay] C:\WINDOWS\system32\kyngku.exe
O4 - HKLM\..\Run: [cbx4m] C:\WINDOWS\jhcck.exe
O4 - HKLM\..\Run: [cbx4m*aaaYC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jhcck.exe
O4 - HKLM\..\Run: [cbx4m*aaaaaYC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jhcck.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Wireless-G Notebook Adapter with SpeedBooster Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\Startup.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
And he said, how can I except some man should guide me? -- Acts 8:31a

BC AdBot (Login to Remove)

 


#2 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:06:28 AM

Posted 28 December 2005 - 05:53 PM

Bunches

Download the trial version of Ewido Security Suite http://www.ewido.net/en/download/ (W2K/XP Only)
Install ewido.
During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Launch ewido
It will prompt you to update click the OK button and it will go to the main screen
On the left side of the main screen click update
Click on Start and let it update.
DO NOT run a scan yet. You will do that later in safe mode.

Restart your computer into safe mode now. Perform the following steps in safe mode:
(Start tapping F8 at the first black screen after power up)

Run Ewido:
Click on scanner
Click Complete System Scan and the scan will begin.
During the scan it will prompt you to clean files, click OK
When the scan is finished, look at the bottom of the screen and click the Save report button.
Save the report to your C: Drive
This will take some time to run!
Boot to normal mode
Post that log and a new HiJack log
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#3 Gem

Gem
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Location:Santa Maria, California
  • Local time:06:28 AM

Posted 28 December 2005 - 08:19 PM

Oiye - You know how they say ignorance is bliss? Well, it's not when it comes to PCs.

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 5:00:53 PM, 12/28/2005
+ Report-Checksum: 7170AA14

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000EF1-0786-4633-87C6-1AA7A44296DA} -> Spyware.FavoriteMan : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00320615-B6C2-40A6-8F99-F1C52D674FAD} -> Spyware.Transponder : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10E42047-DEB9-4535-A118-B3F6EC39B807} -> Spyware.SideFind : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -> Spyware.PopularScreensavers : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{205FF73B-CA67-11D5-99DD-444553540006} -> Spyware.CnsMin : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6685509E-B47B-4F47-8E16-9A5F3A62F683} -> Spyware.MoneyMaker : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83DE62E0-5805-11D8-9B25-00E04C60FAF2} -> Spyware.BlazeFind : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C52CBAEC-D969-4635-9F50-426CC15CE463} -> Spyware.MyBHOSpy : Cleaned with backup
HKU\S-1-5-21-2996890081-1333060988-3925585780-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@247realmedia[2].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@ad-logics[2].txt -> Spyware.Cookie.Ad-logics : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@commission-junction[1].txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@doubleclick[2].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@edge.ru4[2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@ehg-wizardsofthecoast.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@euniverseads[1].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@gator[1].txt -> Spyware.Cookie.Gator : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@install.xxxtoolbar[1].txt -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@linksynergy[1].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@revenue[1].txt -> Spyware.Cookie.Revenue : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/casey mccormick@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/1150_1.dat -> Spyware.TopMoxie : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\10,9,2004_13,24,20.zip/1150_1.dat -> Spyware.TopMoxie : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\11,10,2004_18,32,12.zip/casey mccormick@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
C:\Program Files\NoAdware\NoAdwareBackup\11,10,2004_18,32,12.zip/casey mccormick@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP106\A0019666.exe -> Downloader.Agent.ae : Cleaned with backup
C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP107\A0019770.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\inst.exe -> Dropper.Small.lg : Cleaned with backup
C:\WINDOWS\SYSTEM32\41675245.dll -> Spyware.Toolbar.k : Cleaned with backup
C:\WINDOWS\SYSTEM32\gyllev.exe -> Backdoor.Agent.ec : Cleaned with backup


::Report End



Logfile of HijackThis v1.99.1
Scan saved at 5:12:43 PM, on 12/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\WPC54Cfg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [peiikm] C:\WINDOWS\system32\yeimnw.exe
O4 - HKLM\..\Run: [xuqhax] C:\WINDOWS\system32\pgguijhw.exe
O4 - HKLM\..\Run: [ydamdy] C:\WINDOWS\system32\tswghkzl.exe
O4 - HKLM\..\Run: [vugton] C:\WINDOWS\system32\gpgj.exe
O4 - HKLM\..\Run: [lznnso] C:\WINDOWS\system32\qkdvbgfe.exe
O4 - HKLM\..\Run: [ceqah] C:\WINDOWS\system32\meva.exe
O4 - HKLM\..\Run: [bzdc] C:\WINDOWS\system32\tlnerto.exe
O4 - HKLM\..\Run: [bivntzb] C:\WINDOWS\system32\brvhtnms.exe
O4 - HKLM\..\Run: [mujaiq] C:\WINDOWS\system32\ltasuf.exe
O4 - HKLM\..\Run: [bffqlwc] C:\WINDOWS\system32\aywh.exe
O4 - HKLM\..\Run: [etopp] C:\WINDOWS\system32\lscaiuq.exe
O4 - HKLM\..\Run: [mwfrq] C:\WINDOWS\system32\zvqscycu.exe
O4 - HKLM\..\Run: [fmzlqi] C:\WINDOWS\system32\uzybho.exe
O4 - HKLM\..\Run: [iqfhmrm] C:\WINDOWS\system32\zrpsjps.exe
O4 - HKLM\..\Run: [tzfe] C:\WINDOWS\system32\dthjfow.exe
O4 - HKLM\..\Run: [klhrsqn] C:\WINDOWS\system32\fwpsk.exe
O4 - HKLM\..\Run: [koufcll] C:\WINDOWS\system32\wtmhfwb.exe
O4 - HKLM\..\Run: [eibb] C:\WINDOWS\system32\fjor.exe
O4 - HKLM\..\Run: [kauj] C:\WINDOWS\system32\eurufv.exe
O4 - HKLM\..\Run: [xwdf] C:\WINDOWS\system32\zxahfxl.exe
O4 - HKLM\..\Run: [llsefopm] C:\WINDOWS\system32\ntposv.exe
O4 - HKLM\..\Run: [mcqmc] C:\WINDOWS\system32\qwicwcj.exe
O4 - HKLM\..\Run: [gpunu] C:\WINDOWS\system32\ftgwmri.exe
O4 - HKLM\..\Run: [dhavrkv] C:\WINDOWS\system32\ncvqmw.exe
O4 - HKLM\..\Run: [lszzuuqh] C:\WINDOWS\system32\hpemrivy.exe
O4 - HKLM\..\Run: [bhjqwx] C:\WINDOWS\system32\upwcricp.exe
O4 - HKLM\..\Run: [caxvg] C:\WINDOWS\system32\ojvdjhb.exe
O4 - HKLM\..\Run: [piqkbj] C:\WINDOWS\system32\hfelyjpi.exe
O4 - HKLM\..\Run: [cayadu] C:\WINDOWS\system32\szjezc.exe
O4 - HKLM\..\Run: [hcpciqh] C:\WINDOWS\system32\hlfaeym.exe
O4 - HKLM\..\Run: [gcnid] C:\WINDOWS\system32\atbg.exe
O4 - HKLM\..\Run: [uqeevrem] C:\WINDOWS\system32\pdcgcpo.exe
O4 - HKLM\..\Run: [nmos] C:\WINDOWS\system32\fdzcnosg.exe
O4 - HKLM\..\Run: [vdfsn] C:\WINDOWS\system32\yrrpguif.exe
O4 - HKLM\..\Run: [jozybawj] C:\WINDOWS\system32\elxdrk.exe
O4 - HKLM\..\Run: [mfay] C:\WINDOWS\system32\kyngku.exe
O4 - HKLM\..\Run: [cbx4m] C:\WINDOWS\jhcck.exe
O4 - HKLM\..\Run: [cbx4m*aaaYC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jhcck.exe
O4 - HKLM\..\Run: [cbx4m*aaaaaYC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jhcck.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Wireless-G Notebook Adapter with SpeedBooster Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\Startup.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
And he said, how can I except some man should guide me? -- Acts 8:31a

#4 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:06:28 AM

Posted 29 December 2005 - 11:17 AM

Fix these with HJT mark them, close IE, click fix checked

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [peiikm] C:\WINDOWS\system32\yeimnw.exe
O4 - HKLM\..\Run: [xuqhax] C:\WINDOWS\system32\pgguijhw.exe
O4 - HKLM\..\Run: [ydamdy] C:\WINDOWS\system32\tswghkzl.exe
O4 - HKLM\..\Run: [vugton] C:\WINDOWS\system32\gpgj.exe
O4 - HKLM\..\Run: [lznnso] C:\WINDOWS\system32\qkdvbgfe.exe
O4 - HKLM\..\Run: [ceqah] C:\WINDOWS\system32\meva.exe
O4 - HKLM\..\Run: [bzdc] C:\WINDOWS\system32\tlnerto.exe
O4 - HKLM\..\Run: [bivntzb] C:\WINDOWS\system32\brvhtnms.exe
O4 - HKLM\..\Run: [mujaiq] C:\WINDOWS\system32\ltasuf.exe
O4 - HKLM\..\Run: [bffqlwc] C:\WINDOWS\system32\aywh.exe
O4 - HKLM\..\Run: [etopp] C:\WINDOWS\system32\lscaiuq.exe
O4 - HKLM\..\Run: [mwfrq] C:\WINDOWS\system32\zvqscycu.exe
O4 - HKLM\..\Run: [fmzlqi] C:\WINDOWS\system32\uzybho.exe
O4 - HKLM\..\Run: [iqfhmrm] C:\WINDOWS\system32\zrpsjps.exe
O4 - HKLM\..\Run: [tzfe] C:\WINDOWS\system32\dthjfow.exe
O4 - HKLM\..\Run: [klhrsqn] C:\WINDOWS\system32\fwpsk.exe
O4 - HKLM\..\Run: [koufcll] C:\WINDOWS\system32\wtmhfwb.exe
O4 - HKLM\..\Run: [eibb] C:\WINDOWS\system32\fjor.exe
O4 - HKLM\..\Run: [kauj] C:\WINDOWS\system32\eurufv.exe
O4 - HKLM\..\Run: [xwdf] C:\WINDOWS\system32\zxahfxl.exe
O4 - HKLM\..\Run: [llsefopm] C:\WINDOWS\system32\ntposv.exe
O4 - HKLM\..\Run: [mcqmc] C:\WINDOWS\system32\qwicwcj.exe
O4 - HKLM\..\Run: [gpunu] C:\WINDOWS\system32\ftgwmri.exe
O4 - HKLM\..\Run: [dhavrkv] C:\WINDOWS\system32\ncvqmw.exe
O4 - HKLM\..\Run: [lszzuuqh] C:\WINDOWS\system32\hpemrivy.exe
O4 - HKLM\..\Run: [bhjqwx] C:\WINDOWS\system32\upwcricp.exe
O4 - HKLM\..\Run: [caxvg] C:\WINDOWS\system32\ojvdjhb.exe
O4 - HKLM\..\Run: [piqkbj] C:\WINDOWS\system32\hfelyjpi.exe
O4 - HKLM\..\Run: [cayadu] C:\WINDOWS\system32\szjezc.exe
O4 - HKLM\..\Run: [hcpciqh] C:\WINDOWS\system32\hlfaeym.exe
O4 - HKLM\..\Run: [gcnid] C:\WINDOWS\system32\atbg.exe
O4 - HKLM\..\Run: [uqeevrem] C:\WINDOWS\system32\pdcgcpo.exe
O4 - HKLM\..\Run: [nmos] C:\WINDOWS\system32\fdzcnosg.exe
O4 - HKLM\..\Run: [vdfsn] C:\WINDOWS\system32\yrrpguif.exe
O4 - HKLM\..\Run: [jozybawj] C:\WINDOWS\system32\elxdrk.exe
O4 - HKLM\..\Run: [mfay] C:\WINDOWS\system32\kyngku.exe
O4 - HKLM\..\Run: [cbx4m] C:\WINDOWS\jhcck.exe

O4 - HKLM\..\Run: [cbx4m* aaaY C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jhcck.exe

O4 - HKLM\..\Run: [cbx4m* aaaaaYC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\jhcck.exe

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)


DownLoad http://www.downloads.subratam.org/KillBox.zip

Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\Program Files\ISTsvc


Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

START RUN type in %temp% OK - Edit Select all File Delete

Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

Empty the recycle bin
Boot and post a new log from normal NOT safe mode

Please give feedback on what worked/didnt work and the current status of your system
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#5 Gem

Gem
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Location:Santa Maria, California
  • Local time:06:28 AM

Posted 29 December 2005 - 12:36 PM

Reboot into normal mode was very slow. Hijackthis froze up at item 23 requiring End Program. This may have been in part to my not waiting for all processes to completely load. Though normally I can begin activity at the point where I did. I didn't take into account the are extra programs loading (Ewido, MS Antispyware, etc.) that I recently installed and booting is probably slower because of these.

KillBox did not find the file to be deleted. Now that the system has settled down, it seems to be running normally.

Here's the log.

Thanks :thumbsup:)


Logfile of HijackThis v1.99.1
Scan saved at 9:25:02 AM, on 12/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\WPC54Cfg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Wireless-G Notebook Adapter with SpeedBooster Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\Startup.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Edited by Gem, 29 December 2005 - 12:37 PM.

And he said, how can I except some man should guide me? -- Acts 8:31a

#6 MFDnSC

MFDnSC

    Ret. Director I/T


  • Members
  • 4,310 posts
  • OFFLINE
  •  
  • Local time:06:28 AM

Posted 29 December 2005 - 02:14 PM

Much better - are things ok

Turn off restore points, boot, turn them back on heres how

XP
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam
"Nothing could be finer than to be in South Carolina ............"

Member ASAP

#7 Gem

Gem
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Location:Santa Maria, California
  • Local time:06:28 AM

Posted 29 December 2005 - 02:56 PM

We're all good now, yes. Booting fine and nothing malicious looking on one final scan. System Restore is enabled.

Thanks again for the help. (((huge hug)))

Happy New Year!

Sincerely,

Gem :thumbsup:
And he said, how can I except some man should guide me? -- Acts 8:31a




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users