View Full Version : Virtumonde, Smitfraud-C, and Microsoft.WindowsSecurityCenter_disabled
Can't get rid of the Virtumonde or Smitfraud with Spybot. Any help would be appreciated. HJT log as follows:
Logfile of HijackThis v1.99.1
Scan saved at 9:10:50 PM, on 12/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Nexon\Mabinogi\npkcmsvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Program Files\V CAST Music Manager\MEMonitor.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Norton AntiVirus\NAVW32.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jhv1704u.slt\prefs.js)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: MEMonitor.lnk = C:\Program Files\V CAST Music Manager\MEMonitor.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA}: NameServer = 66.75.160.63,66.75.160.64
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\Mabinogi\npkcmsvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)
Hi KimHoJo
Rename HijackThis.exe to KimHoJo.exe and post back a fresh HijackThis log, please :)
Thanks, Shaba! This has been one nasty, persistent little problem... Log as follows:
Logfile of HijackThis v1.99.1
Scan saved at 7:58:53 AM, on 1/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Nexon\Mabinogi\npkcmsvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Program Files\V CAST Music Manager\MEMonitor.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Owner\Desktop\KimHoJo.exe
C:\Program Files\Internet Explorer\iexplore.exe
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\jhv1704u.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A8BCB48-B49E-4732-8CFC-574956ED237F} - (no file)
O2 - BHO: (no name) - {284D4434-5B16-4908-B7CF-DEFD7CC7DB31} - C:\WINDOWS\system32\byXRlMcb.dll
O2 - BHO: (no name) - {46D632B3-A2FD-4292-8BC8-406605E68CD9} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {58C818B5-5945-43A6-B930-2B9439573660} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: (no name) - {BC29A227-F805-4193-976A-EE6E7C3F9860} - (no file)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: MEMonitor.lnk = C:\Program Files\V CAST Music Manager\MEMonitor.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA}: NameServer = 66.75.160.63,66.75.160.64
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: vkhowp.dll
O20 - Winlogon Notify: aptcp - C:\WINDOWS\java\aptcp.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: mllji - mllji.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: pmkji - C:\WINDOWS\system32\pmkji.dll (file missing)
O20 - Winlogon Notify: qoMdDvWN - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\Mabinogi\npkcmsvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)
Uninstall via add/remove programs:
ewido (it is outdated)
After that:
We will begin with ComboFix.
Please download ComboFix from one of these locations:
Link 1 (http://subs.geekstogo.com/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/whatnext.png
Click on Yes, to continue scanning for malware.
When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Ewido removed. ComboFix installed and run. Did not prompt for install of Recovery Console and log says it is missing; should I download this from Microsoft? ComboFix log as follows:
ComboFix 09-01-01.02 - Owner 2009-01-03 9:50:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.949.82.1033.18.503.184 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated)
FW: Norton AntiVirus *enabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Owner\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\Owner\LOCALS~1\Temp\tmp2.tmp
c:\documents and settings\All Users\Application Data\svhost.exe
c:\windows\Downloaded Program Files\setup.inf
c:\windows\IE4 Error Log.txt
c:\windows\setup.exe
c:\windows\system32\bcMlRXyb.ini
c:\windows\system32\bcMlRXyb.ini2
c:\windows\system32\mcrh.tmp
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSosvd.dat
.
((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.
2009-01-03 08:02 . 2009-01-03 08:02 120 --ahs---- c:\windows\system32\vyfaailx.ini
2008-12-27 16:57 . 2008-12-27 16:57 120 --ahs---- c:\windows\system32\yfhcpmca.ini
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 17:26 --------- d-----w c:\program files\Quicken
2009-01-03 17:25 --------- d-----w c:\documents and settings\Owner\Application Data\Move Networks
2009-01-03 17:24 --------- d-----w c:\program files\Winamp
2009-01-03 17:24 --------- d-----w c:\program files\MoodLogic
2009-01-03 16:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-28 00:53 --------- d-----w c:\documents and settings\Owner\Application Data\LimeWire
2008-12-27 07:35 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-27 07:33 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-24 23:39 --------- d-----w c:\documents and settings\Owner\Application Data\AdobeUM
2008-12-04 00:18 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-30 01:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-30 01:18 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-11-30 01:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-11-30 01:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-30 01:18 --------- d-----w c:\program files\Symantec
2008-11-30 00:50 --------- d-----w c:\program files\Norton AntiVirus
2008-11-30 00:43 --------- d-----w c:\program files\Windows Sidebar
2008-11-16 00:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2007-08-26 17:03 88 -csh--r c:\windows\system32\4FED58AFF0.sys
2007-06-24 05:11 56 -csh--r c:\windows\system32\F0AF58ED4F.sys
2007-08-26 17:03 4,182 -csha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2004-01-17 135168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-06 718704]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 c:\windows\system32\narrator.exe]
c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
MEMonitor.lnk - c:\program files\V CAST Music Manager\MEMonitor.exe [2007-12-25 951640]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-15 113664]
TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-04 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a--c--- 2003-11-15 21:00 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
--a------ 2002-08-20 10:29 40960 c:\windows\system32\ezSP_Px.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2005-09-20 09:32 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
--a------ 2003-03-31 04:00 44032 c:\windows\ime\imkr6_1\imekrmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-03 21:31 208952 c:\windows\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 08:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2003-03-31 04:00 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
--a------ 2008-02-06 22:49 718704 c:\program files\Norton AntiVirus\osCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-04-13 02:48 36975 c:\program files\Java\jre1.5.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Recovery]
--a--c--- 2003-04-19 21:08 28672 c:\windows\SONYSYS\VAIO Recovery\PartSeal.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-05-15 15:11 3644464 c:\program files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a--c--- 2003-05-23 10:43 88363 c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-01-25 149352]
R2 VAIO Entertainment File Import Service;VAIO Entertainment File Import Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe [2004-06-18 86098]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-04-30 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-29 99376]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNt.sys [2007-12-04 130816]
S3 Mkd2Usbf;Mkd2Usbf;c:\windows\system32\drivers\Mkd2Usbf.sys [2007-12-04 93440]
S3 VAIO Entertainment UPnP Client Adapter;VAIO Entertainment UPnP Client Adapter;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ca5f05a-0990-11dc-8d32-000f666e410f}]
\Shell\AutoRun\command - F:\setupSNK.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-12-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
2008-12-23 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]
2004-08-05 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-03 23:56]
.
- - - - ORPHANS REMOVED - - - -
BHO-{1A8BCB48-B49E-4732-8CFC-574956ED237F} - (no file)
BHO-{46D632B3-A2FD-4292-8BC8-406605E68CD9} - (no file)
BHO-{58C818B5-5945-43A6-B930-2B9439573660} - (no file)
BHO-{BC29A227-F805-4193-976A-EE6E7C3F9860} - (no file)
HKLM-Run-54f6d7b1 - c:\windows\system32\xliaafyv.dll
Notify-aptcp - c:\windows\java\aptcp.dll
Notify-pmkji - c:\windows\system32\pmkji.dll
Notify-mllji - mllji.dll
Notify-NavLogon - (no file)
Notify-qoMdDvWN - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
TCP: {B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA} = 66.75.160.63,66.75.160.64
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 09:57:05
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-01-03 10:01:59
ComboFix-quarantined-files.txt 2009-01-03 18:01:56
Pre-Run: 126,746,628,096 bytes free
Post-Run: 126,824,960,000 bytes free
208 --- E O F --- 2008-12-18 08:12:26
To access the Uninstall Manager you would do the following:
1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
You will now be presented with a screen similar to the one below:
http://img.bleepingcomputer.com/tutorials/hijackthis/uninstall-man.jpg
5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.
PC seems back to normal; much faster and no more pop-up security alerts and Internet Explorer ads.
HijackThis Uninstall List as follows:
Adobe Flash Player ActiveX
Adobe Photoshop 7.0
Adobe Reader 6.0.1
Agere Systems AC'97 Modem
AhnLab MyKeyDefense 2.0
AhnLab Smart Update i
AppCore
Apple Software Update
ArcSoft PhotoImpression 4
Ask Toolbar
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Audacity 1.2.6
Camera Driver
Canon CanoScan Toolbox 4.0
Canon i350
Canon iP2600 series
Canon iP2600 series User Registration
Canon Utilities Easy-PhotoPrint
ccCommon
CleanUp!
Click to DVD 2.0 Menu Data
Click to DVD 2.0.02
Compact Wireless-G USB Adapter
Component Framework
DivX Codec
DivX Converter
DivX Player
DivX Web Player
D-Link VGA Webcam
Drag'n Drop CD+DVD
DVgate Plus
Easy-WebPrint
ERUNT 1.1j
FlashFXP v3
Google Toolbar for Internet Explorer
HijackThis 1.99.1
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
InterVideo WinDVD 5 for VAIO
iTunes
J2SE Runtime Environment 5.0 Update 3
Java 2 Runtime Environment, SE v1.4.2_01
Lernout & Hauspie TruVoice American English TTS Engine
LiveUpdate (Symantec Corporation)
LiveUpdate (Symantec Corporation)
Memory Stick Formatter
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Works 7.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML4 Parser
Netscape (7.02)
Netscape Internet Service Setup
Norton AntiVirus
Norton AntiVirus (Symantec Corporation)
Norton AntiVirus Help
Norton Protection Center
OpenMG Limited Patch 3.4-03-12-16-01
OpenMG Secure Module 3.4.00
Pen Tablet
PictureGear Studio 2.0
QuickTime
RGSS-RTP Standard
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
SonicStage 2.0.02
Sony Certificate PCH
Sony Video Shared Library
SPBBC 32bit
Spybot - Search & Destroy
Symantec Real Time Storage Protection Component
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
V CAST Music Manager
VAIO Entertainment Platform
VAIO Help and Support
VAIO Media 3.0
VAIO Media Integrated Server 3.0
VAIO Media Redistribution 3.0
VAIO Registration
VAIO SLIT Pattern Wallpaper
VAIO SLIT-C Screen Saver
VAIO Survey Standalone
VAIO System Information
VAIO Update 2
VeohTV BETA
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar
Welcome to VAIO life
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Media Player 9 Hotfix [See KB885492 for more information]
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
Wireless-G PCI Adapter
Uninstall via add/remove programs:
Ask Toolbar
After that install recovery console according to link I gave you, re-run combofix and post back a fresh combofix log, please.
Ran ComboFix again, but the prompts shown in your post for Microsoft Windows Recovery Console do not appear. I get a YES/NO prompt saying I understand the program should be used only with qualified assistance and accept full responsibility for use of the program, and then it goes right into a scan of the system after I select YES.
Latest ComboFix log as follows:
ComboFix 09-01-02.01 - Owner 2009-01-03 10:53:09.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.949.82.1033.18.503.139 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated)
FW: Norton AntiVirus *enabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.
2009-01-03 08:02 . 2009-01-03 08:02 120 --ahs---- c:\windows\system32\vyfaailx.ini
2008-12-27 16:57 . 2008-12-27 16:57 120 --ahs---- c:\windows\system32\yfhcpmca.ini
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 17:26 --------- d-----w c:\program files\Quicken
2009-01-03 17:25 --------- d-----w c:\documents and settings\Owner\Application Data\Move Networks
2009-01-03 17:24 --------- d-----w c:\program files\Winamp
2009-01-03 17:24 --------- d-----w c:\program files\MoodLogic
2009-01-03 16:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-28 00:53 --------- d-----w c:\documents and settings\Owner\Application Data\LimeWire
2008-12-27 07:35 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-27 07:33 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-24 23:39 --------- d-----w c:\documents and settings\Owner\Application Data\AdobeUM
2008-12-04 00:18 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-30 01:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-30 01:18 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-11-30 01:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-11-30 01:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-30 01:18 --------- d-----w c:\program files\Symantec
2008-11-30 00:50 --------- d-----w c:\program files\Norton AntiVirus
2008-11-30 00:43 --------- d-----w c:\program files\Windows Sidebar
2008-11-16 00:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2007-08-26 17:03 88 -csh--r c:\windows\system32\4FED58AFF0.sys
2007-06-24 05:11 56 -csh--r c:\windows\system32\F0AF58ED4F.sys
2007-08-26 17:03 4,182 -csha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2004-01-17 135168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-06 718704]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 c:\windows\system32\narrator.exe]
c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
MEMonitor.lnk - c:\program files\V CAST Music Manager\MEMonitor.exe [2007-12-25 951640]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-15 113664]
TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-04 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a--c--- 2003-11-15 21:00 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
--a------ 2002-08-20 10:29 40960 c:\windows\system32\ezSP_Px.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2005-09-20 09:32 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
--a------ 2003-03-31 04:00 44032 c:\windows\ime\imkr6_1\imekrmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-03 21:31 208952 c:\windows\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 08:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2003-03-31 04:00 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
--a------ 2008-02-06 22:49 718704 c:\program files\Norton AntiVirus\osCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-04-13 02:48 36975 c:\program files\Java\jre1.5.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Recovery]
--a--c--- 2003-04-19 21:08 28672 c:\windows\SONYSYS\VAIO Recovery\PartSeal.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-05-15 15:11 3644464 c:\program files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a--c--- 2003-05-23 10:43 88363 c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-29 99376]
R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R4 VAIO Entertainment File Import Service;VAIO Entertainment File Import Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe [2004-06-18 86098]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-04-30 24652]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [2007-12-04 130816]
S3 Mkd2Usbf;Mkd2Usbf;c:\windows\system32\drivers\Mkd2UsbF.sys [2007-12-04 93440]
S3 VAIO Entertainment UPnP Client Adapter;VAIO Entertainment UPnP Client Adapter;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM --> c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ca5f05a-0990-11dc-8d32-000f666e410f}]
\Shell\AutoRun\command - F:\setupSNK.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-12-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
2008-12-23 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]
2004-08-05 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-03 23:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
TCP: {B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA} = 66.75.160.63,66.75.160.64
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 10:57:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-01-03 10:59:39
ComboFix-quarantined-files.txt 2009-01-03 18:58:45
ComboFix2.txt 2009-01-03 18:02:00
Pre-Run: 126,808,035,328 bytes free
Post-Run: 126,795,284,480 bytes free
184 --- E O F --- 2008-12-18 08:12:26
Yes but I meant this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
There are instructions for manual installation of combofix :)
Please follow them and post back a fresh combofix log afterwards.
Think I've got it now! New ComboFix log:
ComboFix 09-01-02.01 - Owner 2009-01-03 11:27:55.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.949.82.1033.18.503.131 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated)
FW: Norton AntiVirus *enabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.
2009-01-03 08:02 . 2009-01-03 08:02 120 --ahs---- c:\windows\system32\vyfaailx.ini
2008-12-27 16:57 . 2008-12-27 16:57 120 --ahs---- c:\windows\system32\yfhcpmca.ini
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 17:26 --------- d-----w c:\program files\Quicken
2009-01-03 17:25 --------- d-----w c:\documents and settings\Owner\Application Data\Move Networks
2009-01-03 17:24 --------- d-----w c:\program files\Winamp
2009-01-03 17:24 --------- d-----w c:\program files\MoodLogic
2009-01-03 16:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-28 00:53 --------- d-----w c:\documents and settings\Owner\Application Data\LimeWire
2008-12-27 07:35 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-27 07:33 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-24 23:39 --------- d-----w c:\documents and settings\Owner\Application Data\AdobeUM
2008-12-04 00:18 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-30 01:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-30 01:18 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-11-30 01:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-11-30 01:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-30 01:18 --------- d-----w c:\program files\Symantec
2008-11-30 00:50 --------- d-----w c:\program files\Norton AntiVirus
2008-11-30 00:43 --------- d-----w c:\program files\Windows Sidebar
2008-11-16 00:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2007-08-26 17:03 88 -csh--r c:\windows\system32\4FED58AFF0.sys
2007-06-24 05:11 56 -csh--r c:\windows\system32\F0AF58ED4F.sys
2007-08-26 17:03 4,182 -csha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2004-01-17 135168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-06 718704]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 c:\windows\system32\narrator.exe]
c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
MEMonitor.lnk - c:\program files\V CAST Music Manager\MEMonitor.exe [2007-12-25 951640]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-15 113664]
TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-04 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a--c--- 2003-11-15 21:00 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
--a------ 2002-08-20 10:29 40960 c:\windows\system32\ezSP_Px.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2005-09-20 09:32 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
--a------ 2003-03-31 04:00 44032 c:\windows\ime\imkr6_1\imekrmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-03 21:31 208952 c:\windows\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 08:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2003-03-31 04:00 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
--a------ 2008-02-06 22:49 718704 c:\program files\Norton AntiVirus\osCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-04-13 02:48 36975 c:\program files\Java\jre1.5.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Recovery]
--a--c--- 2003-04-19 21:08 28672 c:\windows\SONYSYS\VAIO Recovery\PartSeal.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-05-15 15:11 3644464 c:\program files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a--c--- 2003-05-23 10:43 88363 c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-29 99376]
R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R4 VAIO Entertainment File Import Service;VAIO Entertainment File Import Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe [2004-06-18 86098]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-04-30 24652]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [2007-12-04 130816]
S3 Mkd2Usbf;Mkd2Usbf;c:\windows\system32\drivers\Mkd2UsbF.sys [2007-12-04 93440]
S3 VAIO Entertainment UPnP Client Adapter;VAIO Entertainment UPnP Client Adapter;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM --> c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ca5f05a-0990-11dc-8d32-000f666e410f}]
\Shell\AutoRun\command - F:\setupSNK.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-12-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
2008-12-23 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]
2004-08-05 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-03 23:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
TCP: {B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA} = 66.75.160.63,66.75.160.64
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 11:29:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-01-03 11:33:45
ComboFix-quarantined-files.txt 2009-01-03 19:33:14
ComboFix2.txt 2009-01-03 18:59:40
ComboFix3.txt 2009-01-03 18:02:00
Pre-Run: 126,746,808,320 bytes free
Post-Run: 126,738,620,416 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
192 --- E O F --- 2008-12-18 08:12:26
Think I've got it now...
ComboFix 09-01-02.01 - Owner 2009-01-03 11:27:55.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.949.82.1033.18.503.131 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated)
FW: Norton AntiVirus *enabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.
2009-01-03 08:02 . 2009-01-03 08:02 120 --ahs---- c:\windows\system32\vyfaailx.ini
2008-12-27 16:57 . 2008-12-27 16:57 120 --ahs---- c:\windows\system32\yfhcpmca.ini
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 17:26 --------- d-----w c:\program files\Quicken
2009-01-03 17:25 --------- d-----w c:\documents and settings\Owner\Application Data\Move Networks
2009-01-03 17:24 --------- d-----w c:\program files\Winamp
2009-01-03 17:24 --------- d-----w c:\program files\MoodLogic
2009-01-03 16:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-28 00:53 --------- d-----w c:\documents and settings\Owner\Application Data\LimeWire
2008-12-27 07:35 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-27 07:33 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-24 23:39 --------- d-----w c:\documents and settings\Owner\Application Data\AdobeUM
2008-12-04 00:18 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-30 01:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-30 01:18 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-11-30 01:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-11-30 01:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-30 01:18 --------- d-----w c:\program files\Symantec
2008-11-30 00:50 --------- d-----w c:\program files\Norton AntiVirus
2008-11-30 00:43 --------- d-----w c:\program files\Windows Sidebar
2008-11-16 00:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2007-08-26 17:03 88 -csh--r c:\windows\system32\4FED58AFF0.sys
2007-06-24 05:11 56 -csh--r c:\windows\system32\F0AF58ED4F.sys
2007-08-26 17:03 4,182 -csha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2004-01-17 135168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-06 718704]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 c:\windows\system32\narrator.exe]
c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
MEMonitor.lnk - c:\program files\V CAST Music Manager\MEMonitor.exe [2007-12-25 951640]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-15 113664]
TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-04 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a--c--- 2003-11-15 21:00 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
--a------ 2002-08-20 10:29 40960 c:\windows\system32\ezSP_Px.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2005-09-20 09:32 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
--a------ 2003-03-31 04:00 44032 c:\windows\ime\imkr6_1\imekrmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-03 21:31 208952 c:\windows\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 08:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2003-03-31 04:00 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
--a------ 2008-02-06 22:49 718704 c:\program files\Norton AntiVirus\osCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-04-13 02:48 36975 c:\program files\Java\jre1.5.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Recovery]
--a--c--- 2003-04-19 21:08 28672 c:\windows\SONYSYS\VAIO Recovery\PartSeal.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-05-15 15:11 3644464 c:\program files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a--c--- 2003-05-23 10:43 88363 c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-29 99376]
R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R4 VAIO Entertainment File Import Service;VAIO Entertainment File Import Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe [2004-06-18 86098]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-04-30 24652]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [2007-12-04 130816]
S3 Mkd2Usbf;Mkd2Usbf;c:\windows\system32\drivers\Mkd2UsbF.sys [2007-12-04 93440]
S3 VAIO Entertainment UPnP Client Adapter;VAIO Entertainment UPnP Client Adapter;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM --> c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ca5f05a-0990-11dc-8d32-000f666e410f}]
\Shell\AutoRun\command - F:\setupSNK.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-12-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
2008-12-23 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]
2004-08-05 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-03 23:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
TCP: {B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA} = 66.75.160.63,66.75.160.64
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 11:29:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-01-03 11:33:45
ComboFix-quarantined-files.txt 2009-01-03 19:33:14
ComboFix2.txt 2009-01-03 18:59:40
ComboFix3.txt 2009-01-03 18:02:00
Pre-Run: 126,746,808,320 bytes free
Post-Run: 126,738,620,416 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
192 --- E O F --- 2008-12-18 08:12:26
Yes :)
Open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\system32\vyfaailx.ini
c:\windows\system32\yfhcpmca.ini
Folder::
c:\documents and settings\Owner\Application Data\LimeWire
Save this as "CFScript"
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
ComboFix Log:
ComboFix 09-01-02.01 - Owner 2009-01-03 11:51:43.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.949.82.1033.18.503.155 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Updated)
FW: Norton AntiVirus *enabled*
* Created a new restore point
FILE ::
c:\windows\system32\vyfaailx.ini
c:\windows\system32\yfhcpmca.ini
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Owner\Application Data\LimeWire
c:\documents and settings\Owner\Application Data\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
c:\documents and settings\Owner\Application Data\LimeWire\412splashfree.png
c:\documents and settings\Owner\Application Data\LimeWire\414splashfree.png
c:\documents and settings\Owner\Application Data\LimeWire\active.mojito
c:\documents and settings\Owner\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Owner\Application Data\LimeWire\data.ser
c:\documents and settings\Owner\Application Data\LimeWire\fileurns.bak
c:\documents and settings\Owner\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Owner\Application Data\LimeWire\filters.props
c:\documents and settings\Owner\Application Data\LimeWire\gnutella.net
c:\documents and settings\Owner\Application Data\LimeWire\installation.props
c:\documents and settings\Owner\Application Data\LimeWire\library.dat
c:\documents and settings\Owner\Application Data\LimeWire\limewire.props
c:\documents and settings\Owner\Application Data\LimeWire\mojito.props
c:\documents and settings\Owner\Application Data\LimeWire\pub1.key
c:\documents and settings\Owner\Application Data\LimeWire\public.key
c:\documents and settings\Owner\Application Data\LimeWire\questions.props
c:\documents and settings\Owner\Application Data\LimeWire\responses.cache
c:\documents and settings\Owner\Application Data\LimeWire\secureMessage.key
c:\documents and settings\Owner\Application Data\LimeWire\simpp.xml
c:\documents and settings\Owner\Application Data\LimeWire\spam.dat
c:\documents and settings\Owner\Application Data\LimeWire\tables.props
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme.lwtp
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\01_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\02_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\03_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\04_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\05_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\chat.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\dir_closed.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\dir_open.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\forward_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\forward_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\kill.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\kill_on.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\lime.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\logo.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\notsearching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\pause_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\pause_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\play_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\play_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\question.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\rewind_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\rewind_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\searching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\splash.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\splashpro.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\stop_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\stop_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\theme.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\version.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\black_theme\warning.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme.lwtp
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\01_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\02_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\03_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\04_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\05_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\chat.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\dir_closed.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\dir_open.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\forward_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\forward_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\kill.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\logo.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\notsearching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\pause_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\pause_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\play_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\play_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\question.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\rewind_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\rewind_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\search.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\searching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\splash.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\splashpro.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\stop_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\stop_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\theme.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\classic_theme\warning.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme.lwtp
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\01_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\02_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\03_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\04_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\05_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\chat.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\dir_closed.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\dir_open.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\forward_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\forward_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\kill.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\kill_on.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\lime.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\logo.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\notsearching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\pause_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\pause_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\play_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\play_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\question.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\rewind_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\rewind_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\searching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\splash.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\splashpro.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\stop_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\stop_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\theme.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\version.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\limewire_theme\warning.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme.lwtp
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\01_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\02_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\03_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\04_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\05_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\chat.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\forward_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\forward_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\kill.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\kill_on.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\logo.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\name.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\notsearching.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\pause_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\pause_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\play_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\play_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\question.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\rewind_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\rewind_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\searching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\splash.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\splashpro.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\stop_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\stop_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\theme.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\other_theme\warning.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\splash.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\splashpro.png
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\version.txt
c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\Owner\Application Data\LimeWire\ttree.cache
c:\documents and settings\Owner\Application Data\LimeWire\ttrees.cache
c:\documents and settings\Owner\Application Data\LimeWire\ttroot.cache
c:\documents and settings\Owner\Application Data\LimeWire\update.xml
c:\documents and settings\Owner\Application Data\LimeWire\version.key
c:\documents and settings\Owner\Application Data\LimeWire\version.xml
c:\documents and settings\Owner\Application Data\LimeWire\xml\data\application.sxml
c:\documents and settings\Owner\Application Data\LimeWire\xml\data\audio.sxml
c:\documents and settings\Owner\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\video.xsd
c:\windows\system32\vyfaailx.ini
c:\windows\system32\yfhcpmca.ini
.
((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-12-26 22:14 . 2008-12-26 22:14 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 17:26 --------- d-----w c:\program files\Quicken
2009-01-03 17:25 --------- d-----w c:\documents and settings\Owner\Application Data\Move Networks
2009-01-03 17:24 --------- d-----w c:\program files\Winamp
2009-01-03 17:24 --------- d-----w c:\program files\MoodLogic
2009-01-03 16:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-27 07:35 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-27 07:33 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-24 23:39 --------- d-----w c:\documents and settings\Owner\Application Data\AdobeUM
2008-12-04 00:18 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-30 01:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-30 01:18 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-11-30 01:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-11-30 01:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-30 01:18 --------- d-----w c:\program files\Symantec
2008-11-30 00:50 --------- d-----w c:\program files\Norton AntiVirus
2008-11-30 00:43 --------- d-----w c:\program files\Windows Sidebar
2008-11-16 00:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2007-08-26 17:03 88 -csh--r c:\windows\system32\4FED58AFF0.sys
2007-06-24 05:11 56 -csh--r c:\windows\system32\F0AF58ED4F.sys
2007-08-26 17:03 4,182 -csha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2004-01-17 135168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-06 718704]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 c:\windows\system32\narrator.exe]
c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
MEMonitor.lnk - c:\program files\V CAST Music Manager\MEMonitor.exe [2007-12-25 951640]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-15 113664]
TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-04 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a--c--- 2003-11-15 21:00 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
--a------ 2002-08-20 10:29 40960 c:\windows\system32\ezSP_Px.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2005-09-20 09:32 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
--a------ 2003-03-31 04:00 44032 c:\windows\ime\imkr6_1\imekrmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-03 21:31 208952 c:\windows\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 08:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2003-03-31 04:00 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
--a------ 2008-02-06 22:49 718704 c:\program files\Norton AntiVirus\osCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2003-03-31 04:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-04-13 02:48 36975 c:\program files\Java\jre1.5.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Recovery]
--a--c--- 2003-04-19 21:08 28672 c:\windows\SONYSYS\VAIO Recovery\PartSeal.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-05-15 15:11 3644464 c:\program files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a--c--- 2003-05-23 10:43 88363 c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-29 99376]
R4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R4 VAIO Entertainment File Import Service;VAIO Entertainment File Import Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe [2004-06-18 86098]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-04-30 24652]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [2007-12-04 130816]
S3 Mkd2Usbf;Mkd2Usbf;c:\windows\system32\drivers\Mkd2UsbF.sys [2007-12-04 93440]
S3 VAIO Entertainment UPnP Client Adapter;VAIO Entertainment UPnP Client Adapter;c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM --> c:\program files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe -RunBySCM [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ca5f05a-0990-11dc-8d32-000f666e410f}]
\Shell\AutoRun\command - F:\setupSNK.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-12-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
2008-12-23 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]
2004-08-05 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-03 23:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
TCP: {B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA} = 66.75.160.63,66.75.160.64
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 11:54:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-01-03 11:56:44
ComboFix-quarantined-files.txt 2009-01-03 19:56:12
ComboFix2.txt 2009-01-03 19:33:46
ComboFix3.txt 2009-01-03 18:59:40
ComboFix4.txt 2009-01-03 18:02:00
Pre-Run: 126,734,622,720 bytes free
Post-Run: 126,715,277,312 bytes free
380 --- E O F --- 2008-12-18 08:12:26
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select ''Run as administrator'' to perform this scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.
If you need a tutorial, see here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif)
Kapersky log:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, January 4, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, January 04, 2009 15:43:32
Records in database: 1558856
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
Scan statistics:
Files scanned: 95623
Threat name: 11
Infected objects: 353
Suspicious objects: 0
Duration of the scan: 02:29:57
File name / Threat name / Threats count
C:\Documents and Settings\Owner\Incomplete\T-5745425-madobe nite.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.a 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\003C6171.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\00A177F9.tmp Infected: P2P-Worm.Win32.VB.dw 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\00A83A0D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\02051A4F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\02293698.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\02B40A6F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\02D0628F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\03144B7A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\03627A90.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\03E03789.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\04BF5AD2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\04E556DD.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0513199F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\05790FA7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\05DF05AF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\06457BB6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\06AB71BE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\06D32C04.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\06F91E14.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\071167C5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\075D336D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\08AA3FE3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0A7C5D0A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0B2B4D2B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0C223E7D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0CD02E9E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0CF17531.htm Infected: Exploit.HTML.Mht 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E090FFC.htm Infected: Exploit.HTML.Mht 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E7D0569.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F321FF9.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F8B6F21.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\10A3559E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\11D537B5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\12A223C4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\13EA1117.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\178A2C8C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\182D6797.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\184A330E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\19D21E63.dll Infected: Trojan-Downloader.Win32.ConHook.l 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\19D5485F.dll Infected: Trojan-Downloader.Win32.ConHook.r 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1A4164F3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1A560370.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1AD564C7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1B012F86.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1B047391.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1B082207.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1B69649B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1BB363B2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1BC92D3C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1BFD646F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1C33119D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1C7865AC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1C9907A4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D0741F7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D6673B3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E325FC2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1EB62567.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1EEF423C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1F3405F1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1F5047DA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1F866E1D.dll Infected: Trojan-Downloader.Win32.ConHook.l 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1FCA37E1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\200431DF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\215C0C17.dll Infected: Trojan-Downloader.Win32.ConHook.l 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\21671ECC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\22093D59.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\22F00921.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2473279F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24A761DA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\26101438.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\26916B85.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\26F7618C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\278B60FE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\27DB5842.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\281F60D2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\288770C8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\28CC347C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29486789.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C21BC1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2A473780.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2A7445EF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2AF57DD8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2B6C771E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2BC169E7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2C3B7A39.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2C5521ED.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2F1D3B5B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2F627F0F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2FA742C4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\307F5D71.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\314A0C50.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\32881D8B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\32EE1392.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3354099A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\33F4713C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\34044CD3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\340B747B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\342075A9.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\34ED61B8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\34F34134.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\35B94DC7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\35CA5DB4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\35F2112C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\368539D6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\36C714C0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\384C5C00.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\38646ECA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\38B469E6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\38F92D9B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\39745BA8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\39C14F0B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3B1E2F4D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3BB64DE0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3BCC1F6D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3CEC40F3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3D4C6D7A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3DBE099F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3E18598A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3E217102.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3EEB60E2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3F3B59F0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3FBE6F05.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\401727AF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\405F434B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\407D1DB7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\414909C6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\42E261E4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\437D135B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\447E314E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44A02F15.htm Infected: Exploit.HTML.Mht 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4566047F.htm Infected: Exploit.HTML.Mht 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\45E9439C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\469833BD.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48932AC2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48DC2979.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\49421F81.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\496C6A6E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\499B7571.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\49E25089.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4ADB779F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4AE12081.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4B416DA6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4C0D59B5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4C8555FB.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4CB9542B.htm Infected: Exploit.HTML.Mht 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4CD945C5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D1955CF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DAC55A3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4E5A238E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4EDE6060.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4F68551E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4FDD3058.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4FFC54F2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\508C3C6A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50D1001F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50DC0050.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\511643D3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\52BF5546.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\55395187.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\55DA614A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56935AE8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56D129A5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\57684AB1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\579E15B4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\57AD0E66.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\57F2521A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\586A01C3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\58A7525E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\593B5232.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59DF2741.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5A6251DA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B8A5181.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C9B4786.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5ED05FDE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5EE91CDE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5F122416.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5F8549E3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\60C90D85.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\60FF793D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\612F038D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\61957995.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\61CE4FC6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\61FC6F9C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\631543B0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63186DAC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\631B17A8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\631E41A5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63226BA1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6325159E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63283F9A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\632B6996.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\632E51B3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6335678C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63391188.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\633C3B84.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\635C5F60.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6360095D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63633359.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\636A0752.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\636D314F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63730547.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63845735.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63870132.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\639447BA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63AE7907.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63B12303.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63B54CFF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63B876FC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63BB20F8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63BE4AF5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63C274F1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63C51EED.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63C848EA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63CB72E6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63CF1CE3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63D246DF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63D570DC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63D91AD8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63DF6ED1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63E218CD.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63EC16C2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63EF40BF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63F36ABB.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63F614B8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63F93EB4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\63FA3DC2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\640012AD.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64005D37.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64033CA9.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\640666A6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\640A10A2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\640D3A9E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6410649B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64130E97.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64173894.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\641A6290.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\641D0C8C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64203689.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64246085.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64270A82.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64415A65.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64440461.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\644B585A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\644E0257.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64512C53.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6455564F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6458004C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\645B2A48.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\646B7C36.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\646F2633.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6472502F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64757A2B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\647C4E24.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\647F7821.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6482221D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64864C19.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64897616.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\648C2012.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\649C7200.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64A01BFD.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64A345F9.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64AA19F2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64AD43EE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64B06DEB.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64B317E7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64C629D1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64C713D2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64CA3DCE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64CD67CA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64D111C7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64D43BC3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64D765C0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64DB0FBC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64DE39B8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64E40DB1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64E837AE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64EB61AA.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64EE0BA6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\64F135A3.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\65020791.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\650C0586.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6515037B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\65192D78.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\651C5774.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\651F0171.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\65222B6D.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\65265569.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\652C1FD8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\658029B2.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\659315E0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\65F90BE8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\66327612.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\670D45E5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\67A13AD8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\681F4B39.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\685750EC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\68640EEE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\69C74F85.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6A63214E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6A904D08.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6AC71F7C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6B11116F.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6BF3537C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6CC03F8C.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6D0E0459.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6D8C2B9B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6EBE0DB1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6F2403B9.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6F401D35.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6F8A79C0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\6FF16FC8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\70154FD4.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\712F41A7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\72186A20.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7241012E.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\72753948.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\72A32F53.dll Infected: Trojan-Downloader.Win32.Small.bpk 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\73740940.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\742E5655.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\74624A1B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\74735938.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\75DD25BE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\76727928.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\768B15DF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\76B2496B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\773A0600.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\77840F7B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\78507B8A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\78976641.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\78B67192.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\78D74BC1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\791C0F75.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\79E853A8.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\79FB247B.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7A4F49B0.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7B812BC7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7B9A27F6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7BAC778F.sys Infected: Trojan.Win32.Agent.ny 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7BAF218C.exe Infected: Trojan.Win32.Agent.ny 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7C4D17D6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7C6D58F7.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7D1903E5.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7DC504E1.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7E6B78E6.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7EDF72DF.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7F02589A.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7F6A48DE.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7FB25A08.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7FF71DBD.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\7FF949EC.dll Infected: Trojan-Spy.Win32.Agent.kg 1
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\svhost.exe.vir Infected: Trojan-Downloader.Win32.Agent.ayru 1
The selected area was scanned.
HijackThis log:
Logfile of HijackThis v1.99.1
Scan saved at 12:35:25 PM, on 1/4/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Nexon\Mabinogi\npkcmsvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Program Files\V CAST Music Manager\MEMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Owner\Desktop\KimHoJo.exe
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.history.last_page_visited", "http://sony.aol.com/");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.2");
user_pref("intl.charsetmenu.browser.cache", "ISO-8859-1");
user_pref("intl.charsetmenu.mailview.cache", "ISO-8859-1");
user_pref("ldap_2.prefs_migrated", true);
user_pref("ldap_2.servers.history.filename", "history.mab");
user_pref("ldap_2.servers.history.replication.lastChangeNumber", 0);
user_pref("ldap_2.servers.pab.filename", "abook.mab");
user_pref("ldap_2.servers.pab.replication.lastChangeNumber", 0);
user_pref("mail.account.account1.identities", "id1");
user_pref("mail.account.account1.server", "server1");
user_pref("mail.account.account2.server", "server2")
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: MEMonitor.lnk = C:\Program Files\V CAST Music Manager\MEMonitor.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA}: NameServer = 66.75.160.63,66.75.160.64
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\Mabinogi\npkcmsvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)
Uninstall via add/remove programs:
Ask Toolbar
Delete these:
C:\Documents and Settings\Owner\Incomplete\T-5745425-madobe nite.mp3
C:\Program Files\AskPBar
Empty these folders:
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\
C:\Qoobox\Quarantine
Empty Recycle Bin.
Reboot, post back a fresh HijackThis log and tell me if you have any issues left?
No more problems; finally have clean Kaspersky and Spybot scans. Thank you so much for all your help!
Final HijackThis scan:
Logfile of HijackThis v1.99.1
Scan saved at 6:15:03 AM, on 1/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Nexon\Mabinogi\npkcmsvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Program Files\V CAST Music Manager\MEMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Owner\Desktop\KimHoJo.exe
N3 - Netscape 7: # Mozilla User Preferences
// This is a generated file!
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.history.last_page_visited", "http://sony.aol.com/");
user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
user_pref("browser.startup.homepage_override.mstone", "rv:1.0.2");
user_pref("intl.charsetmenu.browser.cache", "ISO-8859-1");
user_pref("intl.charsetmenu.mailview.cache", "ISO-8859-1");
user_pref("ldap_2.prefs_migrated", true);
user_pref("ldap_2.servers.history.filename", "history.mab");
user_pref("ldap_2.servers.history.replication.lastChangeNumber", 0);
user_pref("ldap_2.servers.pab.filename", "abook.mab");
user_pref("ldap_2.servers.pab.replication.lastChangeNumber", 0);
user_pref("mail.account.account1.identities", "id1");
user_pref("mail.account.account1.server", "server1");
user_pref("mail.account.account2.server", "server2")
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL (file missing)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: MEMonitor.lnk = C:\Program Files\V CAST Music Manager\MEMonitor.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B026CEFE-D0A4-47E2-BE2C-28A02CDC36AA}: NameServer = 66.75.160.63,66.75.160.64
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\Mabinogi\npkcmsvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)
Great :)
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /u in the runbox and click OK
Next we remove all used tools.
Please download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to desktop.
Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and re-enable system restore here:
Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)
Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software and keep your other programs up-to-date Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
Malwarebytes' Anti-Malware Setup Guide (http://www.bfccomputers.com/forum/index.php?showtopic=1644)
Malwarebytes' Anti-Malware Scanning Guide (http://www.bfccomputers.com/forum/index.php?showtopic=1645)
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
Here are some additional utilities that will enhance your safety
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer. See also a hosts file tutorial here (http://malwareremoval.com/forum/viewtopic.php?t=22187)
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://forums.spybot.info/showthread.php?t=279)
Happy surfing and stay clean! :bigthumb:
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than four days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.