Wbg2009
2009-08-19, 20:02
Hello
My SS&D keeps detecting Win32.TDSS.rtk and is unable to permanently remove it. I run on Windows Vista, and my antivirus (Sophos) has not detected it. I have read your "Please Read This First" page, have backed up my registry using ERUNT, and have not attempted any fixes other than SS&D standard fix option. I am posting the HJT log as required. Thanks a lot for your help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:57:00 PM, on 8/19/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.npr.org"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5Cmozilla.org%5CSeaMonkey%5Csearchplugins%5Cgoogle.src"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingA235] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3627] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3122] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1099] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2302] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8389] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8546] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5355] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9089] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5770] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7625] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8547] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2104] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8842] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2597] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1912] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2802] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6702] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3805] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8115] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA546] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2921] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7950] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC512] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA868] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2448] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA767] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC98] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1330] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6395] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2135] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC255] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7537] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9867] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5162] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3513] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7640] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8781] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1135] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5710] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Dave\Program Files\DNA\btdna.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1243] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7001] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1975] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7575] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8492] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3088] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7480] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4059] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4508] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8508] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5006] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4801] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2219] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5591] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4690] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD518] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1548] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6057] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7124] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6971] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8282] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7333] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6273] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9842] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4999] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4313] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7466] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3797] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7836] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3424] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4410] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3872] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB773] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3563] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7277] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1153] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3483] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1966] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9885] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5080] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CB7A4F3-9A18-4BFA-828B-D5AD2EDD9B90}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.68,85.255.112.66
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9ce82663cbd3a) (gupdate1c9ce82663cbd3a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 19108 bytes
Just an update--and hopefully a good one. Originally I had to rename the Spybot execute file to get it to run. After reading a few sites, I had booted my computer in safe mode with networking, reinstalled spybot, and continued to scan. The Win32. TDSS.rtk kept showing up time after time.
I realized that I had never rebooted the computer after the scan/removal, so I tried that. Booting in normal mode, the system did a scan due to perceived errors. (I could not read fast enough to see exactly what the errors) When the system finished its scan/repair and booted to the desktop, I ran spybot again. this time, NO trace of the Win32. tDSS.rtk (I scanned 3 times). So..maybe I am free and clear. I have posted my latest HJT log below.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:25:07 PM, on 8/19/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Users\Dave\Program Files\DNA\btdna.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.npr.org"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5Cmozilla.org%5CSeaMonkey%5Csearchplugins%5Cgoogle.src"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Dave\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CB7A4F3-9A18-4BFA-828B-D5AD2EDD9B90}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9ce82663cbd3a) (gupdate1c9ce82663cbd3a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 10413 bytes
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)
My SS&D keeps detecting Win32.TDSS.rtk and is unable to permanently remove it. I run on Windows Vista, and my antivirus (Sophos) has not detected it. I have read your "Please Read This First" page, have backed up my registry using ERUNT, and have not attempted any fixes other than SS&D standard fix option. I am posting the HJT log as required. Thanks a lot for your help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:57:00 PM, on 8/19/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.npr.org"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5Cmozilla.org%5CSeaMonkey%5Csearchplugins%5Cgoogle.src"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingA235] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3627] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3122] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1099] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2302] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8389] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8546] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5355] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9089] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5770] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7625] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8547] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2104] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8842] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2597] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1912] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2802] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6702] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3805] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8115] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA546] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2921] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7950] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC512] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA868] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2448] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA767] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC98] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1330] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6395] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2135] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC255] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7537] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9867] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5162] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3513] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7640] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8781] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1135] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5710] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Dave\Program Files\DNA\btdna.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1243] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7001] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1975] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7575] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8492] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3088] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7480] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4059] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4508] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8508] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5006] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4801] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2219] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5591] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4690] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD518] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1548] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6057] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7124] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6971] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8282] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7333] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6273] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9842] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4999] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4313] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7466] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3797] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7836] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3424] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4410] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3872] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingB773] command.com /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3563] cmd.exe /c del "C:\Windows\System32\drivers\ESQULnpnbwifmixptxhpfpiipcpocpfxvqixt.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7277] command.com /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1153] cmd.exe /c del "C:\Windows\System32\ESQULcopqjsbsucxqtcsrvrigpwcfristicrx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3483] command.com /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1966] cmd.exe /c del "C:\Windows\System32\ESQULtikejiisxkeumtcdfyyteqdqvrbkxpku.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9885] command.com /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5080] cmd.exe /c del "C:\Windows\System32\ESQULzxspectrum"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CB7A4F3-9A18-4BFA-828B-D5AD2EDD9B90}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.68,85.255.112.66
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9ce82663cbd3a) (gupdate1c9ce82663cbd3a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 19108 bytes
Just an update--and hopefully a good one. Originally I had to rename the Spybot execute file to get it to run. After reading a few sites, I had booted my computer in safe mode with networking, reinstalled spybot, and continued to scan. The Win32. TDSS.rtk kept showing up time after time.
I realized that I had never rebooted the computer after the scan/removal, so I tried that. Booting in normal mode, the system did a scan due to perceived errors. (I could not read fast enough to see exactly what the errors) When the system finished its scan/repair and booted to the desktop, I ran spybot again. this time, NO trace of the Win32. tDSS.rtk (I scanned 3 times). So..maybe I am free and clear. I have posted my latest HJT log below.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:25:07 PM, on 8/19/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Users\Dave\Program Files\DNA\btdna.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.npr.org"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5Cmozilla.org%5CSeaMonkey%5Csearchplugins%5Cgoogle.src"); (C:\Documents and Settings\DAVE\Application Data\Mozilla\Profiles\default\38zfk1t0.slt\prefs.js)
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Dave\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CB7A4F3-9A18-4BFA-828B-D5AD2EDD9B90}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9ce82663cbd3a) (gupdate1c9ce82663cbd3a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 10413 bytes
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)