View Full Version : yet another xlibgfl254.dll is not a valid...
I saw a few others with this same issue. I followed through with the "BEFORE you POST" thread and below are the logs from the Activescan and Hijackthis scan. This is post 1 of 6 of the logs. Thanks in advance for your help!
Activescan:
Incident Status Location
Virus:Trj/dmRandom.EB Disinfected Operating system
Adware:Adware/WinAntivirus2006 Not disinfected c:\windows\system32\psc_mon.exe
Adware:Adware/SystemDoctor Not disinfected c:\windows\system32\60114164.exe
Adware:adware/dailytoolbar Not disinfected c:\windows\system32\dailytoolbar.dll
Adware:adware/emediacodec Not disinfected c:\windows\system32\ld101.tmp
Adware:adware/securityerror Not disinfected c:\windows\system32\ot.ico
Adware:adware/thespyguard Not disinfected c:\windows\system32\shellgui32.dll
Virus:trj/abwiz.a Disinfected Operating system
Adware:adware/admess Not disinfected c:\windows\system32\tcpservice2.exe
Adware:adware/topspyware Not disinfected c:\windows\system32\txfdb32.dll
Dialer:dialer.avv Not disinfected c:\windows\downloaded program files\gdnUS2218.exe
Potentially unwanted tool:application/spywaresheriff Not disinfected C:\Documents and Settings\Andy\Start Menu\Programs\Startup\spysheriff.lnk
Adware:adware/btgrab Not disinfected c:\windows\BTGrab.dll
Adware:adware/transponder Not disinfected c:\windows\dlmax.dll
Spyware:spyware/betterinet Not disinfected c:\windows\susp.exe
Adware:adware/spymarshal Not disinfected c:\windows\xpupdate.exe
Adware:adware/whenusearch Not disinfected C:\Documents and Settings\Andy\Start Menu\Programs\WhenU
Adware:adware/securitytoolbar Not disinfected c:\program files\Security Toolbar
Adware:adware/megatds Not disinfected Windows Registry
Potentially unwanted tool:application/antispywaresoldier Not disinfected hkey_current_user\software\ADV
Adware:adware/alexa-toolbar Not disinfected Windows Registry
Potentially unwanted tool:application/winantivirus2006 Not disinfected hkey_classes_root\WAP6.PCheck
Adware:adware/intcodec Not disinfected Windows Registry
Potentially unwanted tool:Application/Winantivirus2006 Not disinfected C:\Documents and Settings\Amy\Application Data\winantiviruspro2006freeinstall[1].exe
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Amy\Cookies\amy@247realmedia[2].txt
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Amy\Cookies\amy@2o7[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Amy\Cookies\amy@ad.yieldmanager[1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Amy\Cookies\amy@advertising[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Amy\Cookies\amy@atdmt[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Amy\Cookies\amy@belnk[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Amy\Cookies\amy@bluestreak[1].txt
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Amy\Cookies\amy@ct.360i[1].txt
Spyware:Cookie/Coremetrics Not disinfected C:\Documents and Settings\Amy\Cookies\amy@data.coremetrics[1].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Amy\Cookies\amy@did-it[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Amy\Cookies\amy@dist.belnk[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Amy\Cookies\amy@doubleclick[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Amy\Cookies\amy@ehg-dig.hitbox[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Amy\Cookies\amy@go[2].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Amy\Cookies\amy@hitbox[2].txt
Spyware:Cookie/Malwarewipe Not disinfected C:\Documents and Settings\Amy\Cookies\amy@malwarewipe[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Amy\Cookies\amy@mediaplex[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Amy\Cookies\amy@overture[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Amy\Cookies\amy@perf.overture[1].txt
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Amy\Cookies\amy@revenue[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Amy\Cookies\amy@searchportal.information[2].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Amy\Cookies\amy@server.iad.liveperson[2].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Amy\Cookies\amy@statse.webtrendslive[2].txt
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Amy\Cookies\amy@target[2].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Amy\Cookies\amy@winantivirus[2].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Amy\Cookies\amy@www.burstbeacon[2].txt
Spyware:Cookie/SecurityError Not disinfected C:\Documents and Settings\Amy\Cookies\amy@www.syssecuritysite[2].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Amy\Cookies\amy@www.winantivirus[2].txt
Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Amy\Local Settings\Application Data\60114164.exe
Potentially unwanted tool:Application/Winantivirus2006 Not disinfected C:\Documents and Settings\Amy\Local Settings\Temporary Internet Files\Content.IE5\Y72LO9WZ\WinAntiVirusPro2006FreeInstall[1].exe
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Andy\Cookies\andy@2o7[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Andy\Cookies\andy@adultfriendfinder[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Andy\Cookies\andy@belnk[1].txt
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Andy\Cookies\andy@ccbill[2].txt
Spyware:Cookie/Clickbank Not disinfected C:\Documents and Settings\Andy\Cookies\andy@clickbank[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Andy\Cookies\andy@com[1].txt
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Andy\Cookies\andy@cs.sexcounter[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Andy\Cookies\andy@dist.belnk[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Andy\Cookies\andy@go[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Andy\Cookies\andy@searchportal.information[1].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Andy\Cookies\andy@server.iad.liveperson[1].txt
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Andy\Cookies\andy@target[2].txt
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Andy\Cookies\andy@toplist[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Andy\Cookies\andy@tribalfusion[1].txt
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Andy\Cookies\andy@webpower[1].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Andy\Cookies\andy@www.burstbeacon[2].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Andy\Cookies\andy@xiti[1].txt
Spyware:Cookie/XXXCounter Not disinfected C:\Documents and Settings\Andy\Cookies\andy@xxxcounter[1].txt
Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Andy\Local Settings\Application Data\60114164.exe
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\ehorqmis.exe
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\nqubmtox.exe
Adware:Adware/SpywareQuake Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\tmp19A.tmp
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\ujgjjdfw.exe
Adware:Adware/SpySheriff Not disinfected C:\Documents and Settings\Andy\Local Settings\Temp\vdrnegjj.exe
Virus:VBS/Psyme.C Disinfected C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\G5EZGHIJ\index[3].htm
Adware:Adware/SaveNow Not disinfected C:\Program Files\DAEMON Tools\SetupDTSB.exe
Virus:Trj/Ruins.CS Disinfected C:\WINDOWS\system32\cshgo.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmacb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmaek.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmafp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmakn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmast.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmauq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmauv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbfk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbfq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbgi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbgw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbvz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmbzu.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcbb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcch.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcdn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmciy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmcju.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmckm.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmckz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdgu.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdhz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdkj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdtj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdtn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmduz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmdze.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeex.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmehx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmejd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeky.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeps.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeqd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeqh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmetc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmeuj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfca.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfiq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfnn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmfzg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgah.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgaz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmggs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgro.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmguh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgvz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgwn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmgza.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhee.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhfp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhge.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhip.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhqo.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhqy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmhwc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmifi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmikh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmilw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmiov.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmipg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmiru.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmivn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmixz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjdd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjhx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjva.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmjwi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkfs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkne.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmknm.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkpy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkqe.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkqs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmksi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkwb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmkzz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlig.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmllr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlpa.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlqh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmltz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlyx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmlzs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmez.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmlv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmmc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmqs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmrs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmmss.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnaw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnfd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnga.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnsp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmnxw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmodd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmodk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmodn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoei.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoes.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmofx.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoiq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmoko.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmomw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmonb.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmooi.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmooo.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmote.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpbr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpcg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpco.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpko.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpne.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpnk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpur.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmpuy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqar.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqdv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqqr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmquj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqvq.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmqvw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmrii.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmrke.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmrnc.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsit.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmskj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsnh.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsny.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsrn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmstw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsxs.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmszd.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmsze.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmthg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmtjw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmtpe.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmtxu.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmucw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmudz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmufy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmukg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmupg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmuqf.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvad.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvim.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvlt.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvng.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvnv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvou.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvoz.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvsj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvsv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmvyv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwcr.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwdp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwfn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwhw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwnt.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwqt.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwqy.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwtn.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwup.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmwyl.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxeo.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxjf.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxpj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmxrg.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmydv.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyfj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyjw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyki.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyww.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmyzk.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzbj.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzfp.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzmw.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzna.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzor.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzvm.exe
Virus:Trj/dmRandom.EB Disinfected C:\WINDOWS\system32\dmzww.exe
Virus:Trj/Gagar.CE Disinfected C:\WINDOWS\system32\fjpgqlds.exe
Virus:Trj/Gagar.P Disinfected C:\WINDOWS\system32\iedfxgtd.exe
Virus:Trj/Firebypass.AR Disinfected C:\WINDOWS\system32\ntoskrnl.dll
Adware:Adware/SpyMarshal Not disinfected C:\WINDOWS\system32\spmrgaat.exe
Potentially unwanted tool:Application/Restart Not disinfected C:\WINDOWS\system32\Tools\Restart.exe
Virus:Trj/Alanchum.BQ Disinfected C:\WINDOWS\system32\uqeclzsl.exe
Hijackthis scan:
Logfile of HijackThis v1.99.1
Scan saved at 4:38:08 PM, on 3/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ntsystem.exe
C:\WINDOWS\system32\psc_mon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25B8CA4C-CF54-61C1-EF06-0281E92C4E4E} - C:\WINDOWS\system32\buxxrqn.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {75416740-A8F0-3EA3-DCC7-044323343C7D} - C:\WINDOWS\system32\yhrbrqi.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll (file missing)
O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINDOWS\system32\hp100.tmp (file missing)
O3 - Toolbar: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file)
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\system32\ntsystem.exe
O4 - HKLM\..\Run: [Personal Security Center Monitor] C:\WINDOWS\system32\psc_mon.exe
O4 - HKLM\..\Run: [dmzvm.exe] C:\WINDOWS\system32\dmzvm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - Startup: spysheriff.lnk = C:\Program Files\SpywareSheriff\spysheriff.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{17E18E55-35FB-4E53-B60E-DA46E96A9C28}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E57EBF6-E4BD-4977-B8E4-E58DF995D3FB}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3C16CCE-36BA-4A8B-B81D-528A0F428C51}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: coursings - {f8d02387-789a-4c0f-a1d8-8a93f33ee4df} - C:\WINDOWS\system32\yephk.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Okay, I was off by one post, but it's all here. Thanks again and I'm looking forward to your response!
Hello and sorry for the wait.
If you have not resolved the problem, we have this sticky topic:
If you have waited four days for advice post here. (http://forums.spybot.info/showthread.php?p=4836#post4836)
HI andywo and welcome to the Forums :)
Sorry for the long wait.
You're infected....
You may want to print out these instructions for reference, since you will have to restart your computer during the fix.
Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe
Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.
At the end of the fix, you may need to restart your computer again.
===========
Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
==========
Please download SmitfraudFix (http://siri.urz.free.fr/Fix/SmitfraudFix.exe) (by S!Ri)
Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply along with a fresh HijackThis log.
**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm (http://www.beyondlogic.org/consulting/processutil/processutil.htm)
NOTE: Do not run any other options from SmitfraudFix until I tell you to do so!
==========
Finally, please post a fresh HijackThis log, along with the contents of the logfile C:\fixwareout\report.txt and the contents of C:\vundofix.txt and the contents of C:\Rapport.txt
:bigthumb:
Logfile of HijackThis v1.99.1
Scan saved at 7:46:20 PM, on 3/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\psc_mon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25B8CA4C-CF54-61C1-EF06-0281E92C4E4E} - C:\WINDOWS\system32\buxxrqn.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {75416740-A8F0-3EA3-DCC7-044323343C7D} - C:\WINDOWS\system32\yhrbrqi.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll (file missing)
O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINDOWS\system32\hp100.tmp (file missing)
O3 - Toolbar: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file)
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Personal Security Center Monitor] C:\WINDOWS\system32\psc_mon.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: spysheriff.lnk = C:\Program Files\SpywareSheriff\spysheriff.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{17E18E55-35FB-4E53-B60E-DA46E96A9C28}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E57EBF6-E4BD-4977-B8E4-E58DF995D3FB}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3C16CCE-36BA-4A8B-B81D-528A0F428C51}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: coursings - {f8d02387-789a-4c0f-a1d8-8a93f33ee4df} - C:\WINDOWS\system32\yephk.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
report.txt:
»»»»» System restarted
»»»»» Postrun check
HKLM\SOFTWARE\~\version\Run\ "dmzvm"
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "1trap" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "2trap" Deleted
HKLM\~\currentversion\run "dmzvm.exe" Deleted
....
»»»»» Misc files.
C:\Documents and Settings\Andy\Application Data\Install.dat Deleted
....
»»»»» Checking for older varients.
....
Search five digit cs, dm, kd, jb, other, files.
The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection.
Click browse, find the file then click submit.
http://www.virustotal.com/flash/index_en.html
Or http://virusscan.jotti.org/
»»»»» Other
»»»»» Current runs
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"USIUDF_Eject_Monitor"="C:\\Program Files\\Common Files\\Ulead Systems\\DVD\\USISrv.exe"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"Ulead Quick-Drop"="\"C:\\Program Files\\Ulead Systems\\Ulead DVD MovieFactory 4.0 Suite\\Ulead Quick-Drop 1.0\\Quick-Drop.exe\" WINDOWCALL"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nTrayFw"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\bin\\nTrayFw.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2ZS\\Surround Mixer\\CTSysVol.exe /r"
"CTHelper"="CTHELPER.EXE"
"CTDVDDET"="C:\\Program Files\\Creative\\SBAudigy2ZS\\DVDAudio\\CTDVDDet.EXE"
"AGRSMMSG"="AGRSMMSG.exe"
"NWEReboot"=""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SNM"="C:\\Program Files\\SpyNoMore\\SNM.exe /startup"
"Personal Security Center Monitor"="C:\\WINDOWS\\system32\\psc_mon.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"RemoteCenter"="C:\\Program Files\\Creative\\MediaSource\\RemoteControl\\RCMan.EXE"
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_9"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»
rapport.txt:
SmitFraudFix v2.151
Scan done at 19:42:19.76, Tue 03/20/2007
Run from C:\Documents and Settings\Andy\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
C:\WINDOWS\adware-sheriff-box.gif FOUND !
C:\WINDOWS\adware-sheriff-header.gif FOUND !
C:\WINDOWS\alexaie.dll FOUND !
C:\WINDOWS\alxie328.dll FOUND !
C:\WINDOWS\alxtb1.dll FOUND !
C:\WINDOWS\antispylab-logo.gif FOUND !
C:\WINDOWS\about_spyware_bg.gif FOUND !
C:\WINDOWS\blue-bg.gif FOUND !
C:\WINDOWS\BTGrab.dll FOUND !
C:\WINDOWS\button_freescan.gif FOUND !
C:\WINDOWS\buy-now-btn.gif FOUND !
C:\WINDOWS\corner-left.gif FOUND !
C:\WINDOWS\corner-right.gif FOUND !
C:\WINDOWS\dlmax.dll FOUND !
C:\WINDOWS\facts.gif FOUND !
C:\WINDOWS\footer.giff FOUND !
C:\WINDOWS\free-scan-btn.gif FOUND !
C:\WINDOWS\h-line-gradient.gif FOUND !
C:\WINDOWS\header_1.gif FOUND !
C:\WINDOWS\header-bg.gif FOUND !
C:\WINDOWS\info.gif FOUND !
C:\WINDOWS\no-icon.gif FOUND !
C:\WINDOWS\Pynix.dll FOUND !
C:\WINDOWS\reg-freeze-box.gif FOUND !
C:\WINDOWS\reg-freeze-header.gif FOUND !
C:\WINDOWS\remove-spyware-btn.gif FOUND !
C:\WINDOWS\spyware-sheriff-header.gif FOUND !
C:\WINDOWS\spyware-sheriff-box.gif FOUND !
C:\WINDOWS\star-grey.gif FOUND !
C:\WINDOWS\susp.exe FOUND !
C:\WINDOWS\true-stories.gif FOUND !
C:\WINDOWS\ts_header.gif FOUND !
C:\WINDOWS\win-sec-center-logo.gif FOUND !
C:\WINDOWS\windows-compatible.gif FOUND !
C:\WINDOWS\yes-icon.gif FOUND !
C:\WINDOWS\ZServ.dll FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
C:\WINDOWS\system32\dailytoolbar.dll FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\questmod.dll FOUND !
C:\WINDOWS\system32\runsrv32.dll FOUND !
C:\WINDOWS\system32\shellgui32.dll FOUND !
C:\WINDOWS\system32\smaexp32.dll FOUND !
C:\WINDOWS\system32\tcpservice2.exe FOUND !
C:\WINDOWS\system32\thlwin32.dll FOUND !
C:\WINDOWS\system32\txfdb32.dll FOUND !
C:\WINDOWS\system32\udpmod.dll FOUND !
C:\WINDOWS\system32\wstart.dll FOUND !
C:\WINDOWS\system32\1024\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Andy
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Andy\Application Data
C:\Documents and Settings\Andy\Local Settings\Application Data\SpywareSheriff FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
C:\DOCUME~1\Andy\STARTM~1\Programs\Startup\spysheriff.lnk FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Andy\FAVORI~1
C:\DOCUME~1\Andy\FAVORI~1\Online Security Test.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
C:\Program Files\EliteCodec\ FOUND !
C:\Program Files\HQVideoCodec\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"coursings"="{f8d02387-789a-4c0f-a1d8-8a93f33ee4df}"
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Hello :)
Ok, please post the contents of C:\vundofix.txt too then we'll kill the remainings
:bigthumb:
VundoFix V6.3.17
Checking Java version...
Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.
Java version is 1.5.0.10
Scan started at 7:37:43 PM 3/20/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
Hi again, we'll continue :)
You seem to have this SpyNoMore software installed.It has a suspicious reputation and Irecommend that you remove it via Control Panel, Add/Remove programs.
More info here (http://www.spywarewarrior.com/rogue_anti-spyware.htm)
This is the line to fix with HijackThis, O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
This is the folder to delete, C:\Program Files\SpyNoMore
You should print these instructions or save these to a text file. Follow these instructions carefully.
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
Click on Change state next to Resident shield. It should now change to inactive.
Click on Change state next to Automatic updates. It should now change to inactive.
Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates (http://www.ewido.net/en/download/updates/).
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.
Do NOT run yet.
Make your hidden files visible:
Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.
==================
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt
Warning : running option #2 on a non infected computer will remove your Desktop background.
Stop the following processes using Task Manager (press ctrl+alt+del, select the Processes tab, highlight the first process in the list and click End Process). Continue through the list (one at a time) until all processes have been ended. If something isn't found, please continue with the next process in the list.
psc_mon.exe
Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\Media-Codec\isaddon.dll (file missing)
O2 - BHO: (no name) - {25B8CA4C-CF54-61C1-EF06-0281E92C4E4E} - C:\WINDOWS\system32\buxxrqn.dll
O2 - BHO: (no name) - {75416740-A8F0-3EA3-DCC7-044323343C7D} - C:\WINDOWS\system32\yhrbrqi.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll (file missing)
O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINDOWS\system32\hp100.tmp (file missing)
O3 - Toolbar: (no name) - {a2595f37-48d0-46a1-9b51-478591a97764} - (no file)
O4 - HKLM\..\Run: [Personal Security Center Monitor] C:\WINDOWS\system32\psc_mon.exe
O4 - Startup: spysheriff.lnk = C:\Program Files\SpywareSheriff\spysheriff.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{17E18E55-35FB-4E53-B60E-DA46E96A9C28}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E57EBF6-E4BD-4977-B8E4-E58DF995D3FB}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3C16CCE-36BA-4A8B-B81D-528A0F428C51}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D534C20-F794-44BB-9D42-999FAE087487}: NameServer = 85.255.116.133,85.255.112.195
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.133 85.255.112.195
O21 - SSODL: coursings - {f8d02387-789a-4c0f-a1d8-8a93f33ee4df} - C:\WINDOWS\system32\yephk.dll (file missing)
Now lets check some settings on your system.
(2000/XP) Only
In the windows control panel. If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections. Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Click the Networking tab. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot if it asks.
That option might not be avaiable on some systems
Next Go start run type cmd and hit OK
type
ipconfig /flushdns
then hit enter, type exit hit enter
(that space between g and / is needed)
Restart your computer to the safe mode:
Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.
Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\buxxrqn.dll
C:\WINDOWS\system32\yhrbrqi.dll
C:\WINDOWS\system32\psc_mon.exe
Run ATF Cleaner Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act?
Click on Recommended Action and choose Quarantine from the popup menu.
Under How to scan?
All checkboxes should be ticked.
Under Possibly unwanted software:
All checkboxes should be ticked.
Under Reports:
Select Automatically generate report after every scan and uncheck Only if threats were found.
Under What to scan?
Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)
http://img509.imageshack.us/img509/4851/scanavgjk2.jpg
When done, click the Save Scan Report button. (4)
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
================
When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log
- contents of C:\Rapport.txt
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 11:31:00 PM 3/24/2007
+ Scan result:
HKLM\SOFTWARE\Classes\DailyToolbar.IEBand -> Adware.DailyToolbar : Error during cleaning.
HKLM\SOFTWARE\Classes\DailyToolbar.SysMgr -> Adware.DailyToolbar : Error during cleaning.
HKLM\SOFTWARE\Classes\IEToolbar.AffiliateCtl -> Adware.DailyToolbar : Error during cleaning.
HKU\S-1-5-21-527237240-1715567821-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1DA7DBE8-C51B-4AE4-BC6E-21863349B0B4} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-527237240-1715567821-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-527237240-1715567821-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F7D40011-29BB-43EB-9C97-875CE89E9E36} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027758.dll -> Adware.Pesttrap : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027762.exe -> Adware.Pesttrap : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Start Menu\Programs\WhenU -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Start Menu\Programs\WhenU\Uninstall.lnk -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Start Menu\Programs\WhenU\WhenU Help Desk.lnk -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027759.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027760.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027761.dll -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP105\A0037145.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP106\A0037209.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP107\A0038416.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\WINDOWS\system32\isc_cpl.cpl -> Adware.SecurityCenter : Cleaned with backup (quarantined).
C:\Documents and Settings\Andy\Desktop\SmitfraudFix\SmiUpdate.exe -> Adware.SmiUpdate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031411.exe -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031412.exe -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031413.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031414.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031415.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031416.dll -> Adware.SpyMarshal : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP104\A0037086.exe -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP104\A0037088.exe -> Adware.SpySheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027763.exe -> Adware.Spysheriff : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP114\A0038945.exe -> Adware.UltimateDefender : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032705.dll -> Downloader.Agent.bfj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\snapshot\MFEX-1.DAT -> Downloader.Agent.bfj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\snapshot\MFEX-2.DAT -> Downloader.Agent.bfj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP79\A0027599.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027615.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027633.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027648.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027666.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027682.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027715.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027733.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027769.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027787.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027827.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027850.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027886.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027908.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027922.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027938.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027967.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027998.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028031.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028049.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP84\A0028107.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028156.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028175.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028200.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028229.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028238.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029238.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029268.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029309.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029341.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029375.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0030375.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0031375.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0031387.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0031420.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0032421.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP87\A0032457.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP88\A0032516.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP88\A0032557.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP88\A0032587.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032637.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032652.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032677.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032691.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032735.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032766.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032784.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032814.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032831.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032884.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0032997.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033028.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033043.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033063.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033089.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033120.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034120.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034139.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034183.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034244.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034259.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034277.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034292.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034339.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034409.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034426.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034442.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034532.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0035532.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035566.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035590.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035620.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035637.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035789.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035821.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035838.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035845.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035861.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035879.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP93\A0036545.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032635.exe -> Downloader.AIO : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0029321.exe -> Downloader.Busky : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0033132.exe -> Downloader.Busky : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP105\A0037144.exe -> Downloader.Busky.aw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027612.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027627.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027645.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027660.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027919.exe -> Downloader.Obfuscated.bc : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027679.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027694.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027727.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027745.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027781.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027799.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027839.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027862.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027898.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027934.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027950.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0027979.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028010.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028044.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP83\A0028061.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP84\A0028125.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028169.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP85\A0028187.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028212.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP86\A0028252.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032649.exe -> Downloader.Obfuscated.be : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP79\A0027600.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027616.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027634.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027649.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027667.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027683.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP80\A0027716.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027734.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027770.exe -> Downloader.Oleloa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036076.exe -> Downloader.Small.cpt : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036077.exe -> Downloader.Small.dkt : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036079.exe -> Downloader.Small.dkt : Cleaned with backup (quarantined).
C:\Documents and Settings\Amy\Application Data\winantiviruspro2006freeinstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027750.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP82\A0027764.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032632.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032636.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP89\A0032765.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035843.exe -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP81\A0027751.dll -> Trojan.Agent.rx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036078.dll -> Trojan.Agent.rx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP90\A0034545.exe -> Trojan.Obfuscated.ev : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035651.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP91\A0035795.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035828.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035852.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035872.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035886.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035896.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035897.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035898.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035899.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035900.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035901.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035902.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035903.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035904.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035905.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035906.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035907.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035908.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035909.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035910.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035911.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035912.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035913.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035914.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035915.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035916.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035917.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035918.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035919.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035920.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035921.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035922.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035923.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035924.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035925.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035926.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035927.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035928.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035929.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035930.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035931.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035932.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035933.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035934.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035935.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035936.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035937.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035938.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035939.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035940.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035941.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035942.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035943.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035944.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035945.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035946.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035947.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035948.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035949.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035950.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035951.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035952.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035953.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035954.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035955.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035956.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035957.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035958.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035959.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035960.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035961.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035962.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035963.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035964.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035965.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035966.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035967.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035968.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035969.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035970.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035971.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035972.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035973.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035974.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035975.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035976.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035977.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035978.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035979.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035980.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035981.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035982.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035983.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035984.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035985.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035986.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035987.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035988.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035989.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035990.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035991.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035992.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035993.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035994.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035995.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035996.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035997.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035998.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0035999.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036000.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036001.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036002.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036003.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036004.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036005.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036006.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036007.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036008.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036009.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036010.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036011.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036012.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036013.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036014.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036015.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036016.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036017.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036018.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036019.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036020.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036021.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036022.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036023.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036024.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036025.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036026.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036027.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036028.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036029.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036030.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036031.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036032.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036033.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036034.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036035.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036036.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036037.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036038.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036039.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036040.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036041.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036042.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036043.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036044.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036045.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036046.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036047.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036048.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036049.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036050.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036051.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036052.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036053.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036054.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036055.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036056.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036057.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036058.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036059.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036060.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036061.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036062.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036063.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036064.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036065.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036066.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036067.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036068.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036069.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036070.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036071.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036072.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036073.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036074.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP92\A0036075.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{365EB715-49A1-4C4D-8455-CB31DA2DE4D6}\RP93\A0036546.exe -> Trojan.Small.fb : Cleaned with backup (quarantined).
::Report end
Logfile of HijackThis v1.99.1
Scan saved at 11:34:43 PM, on 3/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
SmitFraudFix v2.151
Scan done at 22:50:28.79, Sat 03/24/2007
Run from C:\Documents and Settings\Andy\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
Hello, good work :D:
Looks much better now.
You have some Symantec/Norton leftovers there. You have uninstalled it, right? In that case, Please run this removal tool -> Link (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039)
Restart the computer.
1. Download this file - combofix.exe (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
==========
Download F-Secure Blacklight (http://www.f-secure.com/blacklight/try_blacklight.html) and save it to your desktop.
Doubleclick blbeta.exe, accept the agreement, click Scan, then click Next
You'll see a list what have been found. A log will appear to your desktop, it is named fsbl.xxxxxxx.log (xxxxxxx will be random numbers).
DON'T choose Rename if something was found!
Post the contents of fsbl.xxxx.log to here (blacklight log from your desktop) along with a fresh HijackThis log and ComboFix log.
Let me also know that how is the computer running :bigthumb:
fsbl-20070329002742:
03/28/07 20:27:42 [Info]: BlackLight Engine 1.0.55 initialized
03/28/07 20:27:42 [Info]: OS: 5.1 build 2600 (Service Pack 2)
03/28/07 20:27:42 [Note]: 7019 4
03/28/07 20:27:42 [Note]: 7005 0
03/28/07 20:27:44 [Note]: 7006 0
03/28/07 20:27:44 [Note]: 7011 636
03/28/07 20:27:44 [Note]: 7026 0
03/28/07 20:27:45 [Note]: 7026 0
03/28/07 20:27:48 [Note]: FSRAW library version 1.7.1021
03/28/07 20:33:44 [Note]: 2000 1012
03/28/07 20:34:08 [Note]: 7007 0
ComboFix:
"Andy" - 07-03-28 20:20:09 Service Pack 2
ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\Andy\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-28 ))))))))))))))))))))))))))))))))))
2007-03-24 22:50 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-03-24 22:50 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-03-24 22:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-03-24 22:50 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-03-24 22:50 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-03-24 22:50 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-03-24 22:40 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-20 19:42 4,076 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-20 19:37 <DIR> d-------- C:\VundoFix Backups
2007-03-19 20:12 <DIR> d-------- C:\DOCUME~1\Andy\APPLIC~1\Pixela
2007-03-19 19:56 <DIR> d-------- C:\Program Files\PIXELA
2007-03-19 18:49 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-03-19 18:49 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-03-19 18:49 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-03-11 09:25 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-03-04 20:11 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-03-04 20:08 <DIR> d-------- C:\agnis-sites
2007-03-04 20:05 <DIR> d-------- C:\Program Files\SpywareGuard
2007-03-04 19:47 <DIR> d-------- C:\Program Files\Windows Defender
2007-03-04 19:42 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-03-04 19:33 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-03-04 18:59 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-03-04 18:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
2007-03-04 18:56 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\pdf995
2007-03-04 18:56 <DIR> d-------- C:\DOCUME~1\Andy\APPLIC~1\pdf995
2007-03-04 17:23 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-03-04 16:24 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-03-04 16:12 49,152 --a------ C:\WINDOWS\system32\ugorahl.dll
2007-03-04 11:30 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2007-03-04 11:30 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll
2007-03-04 11:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\pdf995
2007-03-04 11:29 54,272 --a------ C:\WINDOWS\system32\tmpwisc1.exe
2007-03-04 11:28 <DIR> d-------- C:\Program Files\TaxCut06
2007-03-04 11:25 48,640 --a------ C:\WINDOWS\system32\qwrmvrj.dll
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-03-28 20:16 384 --a------ C:\WINDOWS\system32\dvcstatebkp-{00000001-00000000-00000007-00001102-00000004-20021102}.dat
2007-03-28 20:16 384 --a------ C:\WINDOWS\system32\dvcstate-{00000001-00000000-00000007-00001102-00000004-20021102}.dat
2007-03-28 20:15 -------- d-------- C:\Program Files\Common Files\symantec shared
2007-03-19 19:56 -------- d--h----- C:\Program Files\installshield installation information
2007-03-19 18:49 -------- d-------- C:\Program Files\divx
2007-03-18 11:58 -------- d-------- C:\Program Files\java
2007-03-04 16:54 -------- d-------- C:\Program Files\quicktime
2007-03-04 11:16 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-02-23 00:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe
2007-02-23 00:29 36624 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-02-23 00:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-02-23 00:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-02-23 00:29 118520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-02-23 00:29 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-02-23 00:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-02-23 00:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-02-23 00:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-02-23 00:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-02-23 00:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-02-23 00:25 639066 --a------ C:\WINDOWS\system32\divx.dll
2007-02-23 00:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll
2007-02-23 00:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-02-23 00:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll
2007-02-23 00:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-02-23 00:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-02-23 00:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-02-23 00:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-02-20 14:34 71088 --a------ C:\WINDOWS\system32\drivers\khips.sys
2007-02-20 14:34 302000 --a------ C:\WINDOWS\system32\drivers\fwdrv.sys
2007-02-15 21:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe
2007-02-01 20:16 -------- d-------- C:\DOCUME~1\Andy\APPLIC~1\ultra
2007-01-08 20:01 17408 --a------ C:\WINDOWS\system32\corpol.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"RemoteCenter"="C:\\Program Files\\Creative\\MediaSource\\RemoteControl\\RCMan.EXE"
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_9"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"USIUDF_Eject_Monitor"="C:\\Program Files\\Common Files\\Ulead Systems\\DVD\\USISrv.exe"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"Ulead Quick-Drop"="\"C:\\Program Files\\Ulead Systems\\Ulead DVD MovieFactory 4.0 Suite\\Ulead Quick-Drop 1.0\\Quick-Drop.exe\" WINDOWCALL"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nTrayFw"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\bin\\nTrayFw.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2ZS\\Surround Mixer\\CTSysVol.exe /r"
"CTHelper"="CTHELPER.EXE"
"CTDVDDET"="C:\\Program Files\\Creative\\SBAudigy2ZS\\DVDAudio\\CTDVDDet.EXE"
"AGRSMMSG"="AGRSMMSG.exe"
"NWEReboot"=""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SNM"="C:\\Program Files\\SpyNoMore\\SNM.exe /startup"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{81559C35-8464-49F7-BB0E-07A383BEF910}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll, xlibgfl254.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command D:\stub.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0b48b29-8fe9-11da-88eb-806d6172696f}]
Shell\AutoRun\command D:\Setup.EXE
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Backup060714.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
********************************************************************
catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-03-28 20:24:59
Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 8:34:47 PM, on 3/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
My computer is running noticeably better. Thanks so far! Although, I'm still getting the xlibgfl254.dll error.
Hi again, we'll continue :)
You should print these instructions or save these to a text file. Follow these instructions carefully.
Backup your registry:
Start
Run
Type the following to the box and hit Ok: regedit
A window opens, click on File
Choose Export form the menu
Change the save location to C:\
Give the filename, RegBackUp
Make sure that the filetype is set to Registryfiles (*.reg)
Click on Save and Close the window
Open Notepad (NOT WORDPAD!) and copy the following lines from the quote box below into a new document, leaving a blank line at the end. (don't forget to copy and paste the word REGEDIT4) :
REGEDIT4
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll"
Make sure there are NO blank lines before REGEDIT4
Make sure there IS one blank line at the end of the file.
Save the document to your desktop as Fix.reg and filetype: All Files
Go to your desktop and double click on the file to run Fix.reg and when it asks you if you want to merge the contents to the registry, click yes/ok.
Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\qwrmvrj.dll
Use the Windows search Start
Search
All files and folders
More advanced options Checkmark these options: "Search system folders"
"Search hidden files and folders"
"Search subfolders"
Search for this and delete if found: xlibgfl254.dll
Restart the computer and post a one more HijackThis log
Logfile of HijackThis v1.99.1
Scan saved at 9:23:04 PM, on 3/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Ulead Quick-Drop] "C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe" WINDOWCALL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152762830625
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152762826359
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\MDT5\AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\MDT5\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\MDT5\AcPreview.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
I don't get the error anymore!
Looking good :)
How's the computer running? Any issues?
:::EDIT:::
I overlooked something, sorry :oops:
Backup your registry:
Start
Run
Type the following to the box and hit Ok: regedit
A window opens, click on File
Choose Export form the menu
Change the save location to C:\
Give the filename, RegBackUp
Make sure that the filetype is set to Registryfiles (*.reg)
Click on Save and Close the window
Open Notepad (NOT WORDPAD!) and copy the following lines from the quote box below into a new document, leaving a blank line at the end. (don't forget to copy and paste the word REGEDIT4) :
REGEDIT4
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Make sure there are NO blank lines before REGEDIT4
Make sure there IS one blank line at the end of the file.
Save the document to your desktop as Fix.reg and filetype: All Files
Go to your desktop and double click on the file to run Fix.reg and when it asks you if you want to merge the contents to the registry, click yes/ok.
==========
Do you know if these drives with autoplay function are CD-drives or Flash-drives or what?
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command D:\stub.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0b48b29-8fe9-11da-88eb-806d6172696f}]
Shell\AutoRun\command D:\Setup.EXE
==========
Please do an online scan with Kaspersky WebScanner (http://www.kaspersky.com/virusscanner)
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.
This topic has been closed to prevent others with similar issues posting in it.
If you need it re-opened please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.