Please help!!!! been 2 weeks-malaware? [Archive]

View Full Version : Please help!!!! been 2 weeks-malaware?

cuc1_2000

2009-12-29, 00:10

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 4:08:22 PM, on 12/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Utopia\Angel\Angel.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O3 - Toolbar: FrostWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [IMBooster] C:\Program Files\Iminent\IMBooster\IMBooster.exe /warmup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKUS\S-1-5-21-725345543-1275210071-682003330-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-725345543-1275210071-682003330-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - S-1-5-18 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'SYSTEM')
O4 - .DEFAULT Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxpt146YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/SmileyCentralInitialSetup1.0.1.1.cab
O16 - DPF: {395E58B9-090C-461A-8F27-087D1C727945} (Web Conferencing) - http://eicc.epopcentral.com/joinie.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v63/bjattack/bja.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200588336218
O16 - DPF: {64CD313F-F079-4D93-959F-4D28B5519449} (Jeopardy Control) - http://www.worldwinner.com/games/v56/jeopardy/jeopardy.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinner.com/games/v67/swapit/swapit.cab
O16 - DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} (MysteryPI Control) - http://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v49/familyfeud/familyfeud.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 8169 bytes
========================
http://forums.spybot.info/showthread.php?t=54175

peku006

2009-12-29, 21:49

Hello and :welcome: to Safer Networking

My name is peku006 and I will be helping you to remove any infection(s) that you may have.
I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

Please observe these rules while we work:

If you don't know or understand something please don't hesitate to ask
Please DO NOT run any other tools or scans whilst I am helping you.
It is important that you reply to this thread. Do not start a new topic.
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
Absence of symptoms does not mean that everything is clear.

try to respond a little faster this time :D:

1 - download and run RSIT

Download random's system information tool (RSIT) by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)

2 - Status Check
Please reply with

the logs from RSIT (log.txt ,info.txt)

Thanks peku006

cuc1_2000

2009-12-30, 00:16

I HAD TO RUN IT 2 TIMES INTERNET GOT UNPLUGGED..ONLY 1 FILE 2ND TIME
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2009-12-29 16:12:06
Microsoft Windows XP Professional Service Pack 3
System drive C: has 24 GB (63%) free of 38 GB
Total RAM: 255 MB (12% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:12:28 PM, on 12/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\Utopia\Angel\Angel.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O3 - Toolbar: FrostWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [IMBooster] C:\Program Files\Iminent\IMBooster\IMBooster.exe /warmup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxpt146YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/SmileyCentralInitialSetup1.0.1.1.cab
O16 - DPF: {395E58B9-090C-461A-8F27-087D1C727945} (Web Conferencing) - http://eicc.epopcentral.com/joinie.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v63/bjattack/bja.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200588336218
O16 - DPF: {64CD313F-F079-4D93-959F-4D28B5519449} (Jeopardy Control) - http://www.worldwinner.com/games/v56/jeopardy/jeopardy.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinner.com/games/v67/swapit/swapit.cab
O16 - DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} (MysteryPI Control) - http://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v49/familyfeud/familyfeud.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 7526 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll [2009-10-28 392560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL [2009-10-01 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
FrostWire Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-11-18 1196936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-22 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-11-22 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll [2009-10-28 392560]
{D4027C7F-154A-4066-A1AD-4243D8127440} - FrostWire Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-11-18 1196936]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-04 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-22 149280]
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2009-02-23 111856]
"IMBooster"=C:\Program Files\Iminent\IMBooster\IMBooster.exe /warmup []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"msnmsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-09-04 6856704]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"Utopia Angel"=C:\Utopia\Angel\Angel.exe [2009-12-28 3671552]
"Search Protection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2009-02-23 111856]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\FrostWire\FrostWire.exe"="C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
shell\AutoRun\command - E:\LaunchU3.exe -a

======List of files/folders created in the last 3 months======

2009-12-29 16:06:28 ----D---- C:\Program Files\trend micro
2009-12-29 16:05:47 ----D---- C:\rsit
2009-12-26 14:25:47 ----SHD---- C:\Config.Msi
2009-12-19 00:24:06 ----D---- C:\Program Files\Y!Supra
2009-12-16 21:18:09 ----D---- C:\Program Files\Iminent
2009-12-16 16:39:31 ----D---- C:\Program Files\TrendMicro
2009-12-16 16:28:16 ----D---- C:\WINDOWS\ERDNT
2009-12-16 16:19:04 ----D---- C:\Program Files\ERUNT
2009-12-16 15:53:34 ----D---- C:\Program Files\Ask.com
2009-12-16 15:50:15 ----D---- C:\Program Files\FrostWire
2009-12-10 14:29:31 ----D---- C:\Documents and Settings\Administrator\Application Data\Mozilla
2009-12-10 14:28:03 ----D---- C:\Program Files\Mozilla Firefox
2009-12-09 22:55:37 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2009-12-09 22:54:35 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2009-12-09 22:52:29 ----HDC---- C:\WINDOWS\$NtUninstallKB976325$
2009-12-09 22:50:20 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2009-12-09 22:46:39 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2009-12-09 22:45:53 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2009-12-04 11:28:54 ----AD---- C:\Program Files\MSN Messenger
2009-12-04 11:06:23 ----D---- C:\Program Files\MyWebSearch
2009-12-04 11:05:57 ----D---- C:\Program Files\FunWebProducts
2009-11-27 17:52:34 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL
2009-11-27 17:52:32 ----D---- C:\Program Files\Symantec
2009-11-27 17:52:32 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-11-27 17:46:02 ----D---- C:\Program Files\Windows Sidebar
2009-11-27 17:45:41 ----D---- C:\Program Files\Norton Internet Security
2009-11-27 17:41:46 ----D---- C:\Documents and Settings\All Users\Application Data\Norton
2009-11-27 17:35:44 ----D---- C:\Program Files\NortonInstaller
2009-11-27 17:35:44 ----D---- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2009-11-25 19:39:22 ----D---- C:\Documents and Settings\Administrator\Application Data\Yahoo!
2009-11-25 19:38:05 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
2009-11-25 19:35:35 ----D---- C:\Program Files\Yahoo!
2009-11-25 18:57:25 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2009-11-25 18:56:54 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2009-11-25 16:32:11 ----D---- C:\Utopia
2009-11-23 12:35:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-11-23 12:35:46 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-11-23 12:35:32 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-11-22 19:53:49 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-11-22 19:53:48 ----A---- C:\WINDOWS\system32\javaws.exe
2009-11-22 19:53:48 ----A---- C:\WINDOWS\system32\javaw.exe
2009-11-22 19:53:47 ----A---- C:\WINDOWS\system32\java.exe
2009-11-22 19:36:49 ----D---- C:\WINDOWS\Prefetch
2009-11-22 18:58:34 ----HDC---- C:\WINDOWS\$NtUninstallKB976749$
2009-11-22 18:58:23 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2009-11-22 18:58:11 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-11-22 18:57:59 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-11-22 18:57:33 ----HDC---- C:\WINDOWS\$NtUninstallKB974455$
2009-11-22 18:57:21 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-11-22 18:57:07 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-11-22 18:56:53 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-11-22 18:56:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-11-22 18:56:26 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-11-22 18:56:14 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-11-22 18:56:03 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-11-22 18:55:51 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-11-22 18:55:37 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2009-11-22 18:55:17 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-11-22 18:55:05 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-11-22 18:54:53 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-11-22 18:54:37 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-11-22 18:54:07 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-11-22 18:53:55 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-11-22 18:53:44 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2009-11-22 18:53:15 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-11-22 18:53:03 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-11-22 18:52:51 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-11-22 18:52:38 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-11-22 18:52:26 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-11-22 18:52:14 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-11-22 18:52:02 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-11-22 18:51:50 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-11-22 18:51:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-11-22 18:51:26 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-11-22 18:50:36 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-11-22 18:49:49 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-11-22 18:49:37 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-11-22 18:49:23 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-11-22 18:49:06 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-11-22 18:48:40 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-11-22 18:47:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-11-22 18:46:34 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-11-22 18:45:47 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-11-22 18:45:16 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-11-22 18:44:57 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-11-22 18:44:30 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-11-22 18:35:47 ----D---- C:\WINDOWS\system32\scripting
2009-11-22 18:35:46 ----D---- C:\WINDOWS\l2schemas
2009-11-22 18:35:45 ----D---- C:\WINDOWS\system32\en
2009-11-22 18:35:44 ----D---- C:\WINDOWS\system32\bits
2009-11-22 18:23:28 ----D---- C:\WINDOWS\network diagnostic
2009-11-22 18:14:59 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-11-16 12:03:19 ----HDC---- C:\WINDOWS\$NtUninstallKB961118_0$
2009-11-16 11:55:46 ----HDC---- C:\WINDOWS\$NtUninstallKB925720$
2009-11-14 14:27:36 ----D---- C:\WINDOWS\system32\XPSViewer
2009-11-14 14:27:27 ----D---- C:\Program Files\MSBuild
2009-11-14 14:27:23 ----D---- C:\WINDOWS\system32\en-US
2009-11-14 14:27:08 ----D---- C:\Program Files\Reference Assemblies
2009-11-14 14:25:25 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-11-14 14:25:24 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-11-14 14:25:23 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-11-14 14:25:04 ----D---- C:\31f8bd5e37bdbd5bdf83
2009-11-14 14:15:45 ----D---- C:\Program Files\MSXML 6.0
2009-11-14 01:48:38 ----HDC---- C:\WINDOWS\$NtUninstallKB976749_0$
2009-11-13 00:12:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2009-11-13 00:11:51 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2009-11-13 00:11:39 ----HDC---- C:\WINDOWS\$NtUninstallKB959426_0$
2009-11-13 00:11:29 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2009-11-13 00:11:20 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2009-11-13 00:11:09 ----HDC---- C:\WINDOWS\$NtUninstallKB960859_0$
2009-11-13 00:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB974455_0$
2009-11-13 00:09:47 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-11-13 00:08:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2009-11-13 00:08:27 ----HDC---- C:\WINDOWS\$NtUninstallKB969059_0$
2009-11-13 00:07:09 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2_0$
2009-11-13 00:06:59 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2009-11-13 00:06:49 ----HDC---- C:\WINDOWS\$NtUninstallKB971657_0$
2009-11-13 00:06:38 ----HDC---- C:\WINDOWS\$NtUninstallKB971557_0$
2009-11-13 00:06:24 ----HDC---- C:\WINDOWS\$NtUninstallKB960225_0$
2009-11-13 00:05:37 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_0$
2009-11-13 00:05:27 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2009-11-13 00:04:27 ----HDC---- C:\WINDOWS\$NtUninstallKB956572_0$
2009-11-13 00:04:08 ----HDC---- C:\WINDOWS\$NtUninstallKB956844_0$
2009-11-13 00:03:58 ----HDC---- C:\WINDOWS\$NtUninstallKB961501_0$
2009-11-13 00:03:50 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-11-13 00:03:39 ----HDC---- C:\WINDOWS\$NtUninstallKB971633_0$
2009-11-13 00:03:28 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-11-13 00:03:21 ----HDC---- C:\WINDOWS\$NtUninstallKB973869_0$
2009-11-13 00:03:12 ----HDC---- C:\WINDOWS\$NtUninstallKB975025_0$
2009-11-13 00:02:47 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2009-11-13 00:02:32 ----HDC---- C:\WINDOWS\$NtUninstallKB952004_0$
2009-11-13 00:02:13 ----HDC---- C:\WINDOWS\$NtUninstallKB974571_0$
2009-11-13 00:01:11 ----HDC---- C:\WINDOWS\$NtUninstallKB973507_0$
2009-11-13 00:00:40 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2009-11-13 00:00:31 ----HDC---- C:\WINDOWS\$NtUninstallKB957097_0$
2009-11-13 00:00:21 ----HDC---- C:\WINDOWS\$NtUninstallKB958687_0$
2009-11-13 00:00:12 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2009-11-12 23:59:57 ----HDC---- C:\WINDOWS\$NtUninstallKB973354_0$
2009-11-12 23:59:36 ----HDC---- C:\WINDOWS\$NtUninstallKB967715_0$
2009-11-12 23:59:19 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2009-11-12 23:58:32 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
2009-11-12 23:58:15 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-11-12 23:57:03 ----HDC---- C:\WINDOWS\$NtUninstallKB971486_0$
2009-11-12 23:56:25 ----D---- C:\WINDOWS\ServicePackFiles
2009-11-12 23:56:23 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$
2009-11-12 23:56:13 ----HDC---- C:\WINDOWS\$NtUninstallKB973815_0$
2009-11-12 23:56:05 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-11-12 23:55:45 ----HDC---- C:\WINDOWS\$NtUninstallKB971032$
2009-11-12 23:55:33 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2009-11-12 23:55:21 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2009-11-12 23:55:12 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2009-11-12 23:54:50 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-11-12 23:54:36 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-11-12 23:53:49 ----HDC---- C:\WINDOWS\$NtUninstallKB923561_0$
2009-11-12 23:53:15 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-11-12 23:53:08 ----HDC---- C:\WINDOWS\$NtUninstallKB975467_0$
2009-11-12 23:52:39 ----HDC---- C:\WINDOWS\$NtUninstallKB968389_0$
2009-11-12 20:37:35 ----D---- C:\Documents and Settings\Administrator\Application Data\FrostWire
2009-11-12 17:32:58 ----HDC---- C:\WINDOWS\$NtUninstallKB970238_0$
2009-11-12 12:32:44 ----HDC---- C:\WINDOWS\$NtUninstallKB969947_0$
2009-11-12 01:40:42 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-11-12 01:29:08 ----A---- C:\WINDOWS\system32\muweb.dll
2009-11-12 01:29:07 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-11-12 01:29:07 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-11-12 00:10:21 ----D---- C:\Program Files\PokerStars
2009-11-11 22:15:58 ----D---- C:\Documents and Settings\Administrator\Application Data\Sun
2009-11-11 21:37:02 ----RSD---- C:\WINDOWS\assembly
2009-11-11 21:35:12 ----D---- C:\WINDOWS\Microsoft.NET
2009-11-11 21:32:42 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2009-11-11 21:31:58 ----HDC---- C:\WINDOWS\$NtUninstallKB954708$
2009-11-11 21:30:56 ----HDC---- C:\WINDOWS\$NtUninstallWIC$
2009-11-11 21:20:52 ----D---- C:\Program Files\Common Files\Windows Live
2009-11-11 20:40:55 ----D---- C:\Program Files\AVG

======List of files/folders modified in the last 3 months======

2009-12-29 16:06:28 ----RD---- C:\Program Files
2009-12-29 16:04:53 ----D---- C:\WINDOWS\Temp
2009-12-29 14:01:01 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-12-29 09:09:51 ----D---- C:\WINDOWS\system32\ias
2009-12-29 09:07:43 ----SHD---- C:\System Volume Information
2009-12-28 17:47:22 ----D---- C:\WINDOWS\system32
2009-12-26 14:31:16 ----SHD---- C:\WINDOWS\Installer
2009-12-26 14:27:27 ----D---- C:\WINDOWS\WinSxS
2009-12-16 16:39:39 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2009-12-16 16:28:16 ----D---- C:\WINDOWS
2009-12-16 15:56:29 ----SD---- C:\WINDOWS\Tasks
2009-12-10 00:07:24 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-09 22:56:05 ----HD---- C:\WINDOWS\inf
2009-12-09 22:55:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-09 22:55:42 ----D---- C:\WINDOWS\system32\drivers
2009-12-09 22:55:03 ----A---- C:\WINDOWS\imsins.BAK
2009-12-09 22:50:00 ----HD---- C:\WINDOWS\$hf_mig$
2009-12-09 22:49:35 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-12-09 22:21:02 ----D---- C:\WINDOWS\system32\CatRoot2
2009-12-04 11:06:03 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-12-04 10:57:40 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-12-04 10:57:13 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-12-01 14:06:19 ----A---- C:\WINDOWS\system32\MRT.exe
2009-11-27 18:19:44 ----D---- C:\Documents and Settings
2009-11-27 17:52:32 ----D---- C:\Program Files\Common Files
2009-11-22 19:52:48 ----D---- C:\Program Files\Java
2009-11-22 19:39:16 ----A---- C:\WINDOWS\OEWABLog.txt
2009-11-22 19:36:53 ----A---- C:\WINDOWS\setuplog.txt
2009-11-22 19:36:17 ----D---- C:\WINDOWS\system32\wbem
2009-11-22 19:36:17 ----D---- C:\WINDOWS\system32\Setup
2009-11-22 19:36:17 ----D---- C:\WINDOWS\AppPatch
2009-11-22 19:36:15 ----RSD---- C:\WINDOWS\Fonts
2009-11-22 18:58:54 ----D---- C:\WINDOWS\system32\CatRoot
2009-11-22 18:56:28 ----D---- C:\Program Files\Outlook Express
2009-11-22 18:50:01 ----D---- C:\WINDOWS\security
2009-11-22 18:45:01 ----D---- C:\Program Files\Messenger
2009-11-22 18:36:20 ----D---- C:\WINDOWS\system32\inetsrv
2009-11-22 18:36:19 ----D---- C:\WINDOWS\ime
2009-11-22 18:36:19 ----D---- C:\WINDOWS\Help
2009-11-22 18:35:49 ----D---- C:\WINDOWS\system32\usmt
2009-11-22 18:35:47 ----D---- C:\Program Files\Internet Explorer
2009-11-22 18:35:44 ----D---- C:\WINDOWS\PeerNet
2009-11-22 18:35:44 ----D---- C:\Program Files\Movie Maker
2009-11-22 18:28:12 ----D---- C:\WINDOWS\system32\Restore
2009-11-22 18:28:12 ----D---- C:\WINDOWS\system32\npp
2009-11-22 18:28:12 ----D---- C:\WINDOWS\mui
2009-11-22 18:28:07 ----D---- C:\WINDOWS\msagent
2009-11-22 18:28:04 ----D---- C:\WINDOWS\srchasst
2009-11-22 18:28:00 ----D---- C:\Program Files\NetMeeting
2009-11-22 18:27:56 ----D---- C:\WINDOWS\system32\Com
2009-11-22 18:27:50 ----D---- C:\Program Files\Windows Media Player
2009-11-22 18:27:49 ----D---- C:\Program Files\Windows NT
2009-11-22 18:27:41 ----D---- C:\Program Files\Common Files\System
2009-11-22 18:26:57 ----D---- C:\WINDOWS\system32\oobe
2009-11-22 18:26:53 ----D---- C:\WINDOWS\system
2009-11-22 18:20:03 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-11-22 18:14:44 ----D---- C:\WINDOWS\ehome
2009-11-14 14:26:41 ----D---- C:\WINDOWS\system32\spool
2009-11-14 14:20:13 ----D---- C:\WINDOWS\system32\mui
2009-11-13 16:25:52 ----D---- C:\Program Files\Microsoft Works
2009-11-13 11:39:01 ----D---- C:\WINDOWS\Debug
2009-11-12 01:26:04 ----A---- C:\WINDOWS\win.ini
2009-11-11 21:32:47 ----D---- C:\WINDOWS\system32\DirectX
2009-10-29 13:08:22 ----A---- C:\WINDOWS\system32\mshtml.dll
2009-10-28 23:38:23 ----A---- C:\WINDOWS\system32\wininet.dll
2009-10-28 23:38:22 ----A---- C:\WINDOWS\system32\urlmon.dll
2009-10-28 23:38:22 ----A---- C:\WINDOWS\system32\shdocvw.dll
2009-10-28 09:07:15 ----N---- C:\WINDOWS\system32\tzchange.exe
2009-10-20 23:38:36 ----A---- C:\WINDOWS\system32\strmfilt.dll
2009-10-20 23:38:36 ----A---- C:\WINDOWS\system32\httpapi.dll
2009-10-13 04:30:16 ----A---- C:\WINDOWS\system32\oakley.dll
2009-10-12 07:38:19 ----A---- C:\WINDOWS\system32\rastls.dll
2009-10-12 07:38:18 ----A---- C:\WINDOWS\system32\raschap.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;BHDrvx86; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx86.sys []
R1 ccHP;Symantec Hash Provider; C:\WINDOWS\system32\drivers\NIS\1101000.013\ccHPx86.sys [2009-10-20 501888]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 FsVga;FsVga; C:\WINDOWS\system32\DRIVERS\fsvga.sys [2004-08-04 12160]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 SRTSP;Symantec Real Time Storage Protection; C:\WINDOWS\system32\drivers\NIS\1101000.013\SRTSP.SYS [2009-10-08 325168]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\WINDOWS\system32\drivers\NIS\1101000.013\SRTSPX.SYS [2009-10-08 43696]
R1 SymIRON;Symantec Iron Driver; C:\WINDOWS\system32\drivers\NIS\1101000.013\Ironx86.SYS [2009-10-08 114736]
R1 SYMTDI;Symantec Network Dispatch Driver; C:\WINDOWS\system32\drivers\NIS\1101000.013\SYMTDI.SYS [2009-10-14 361520]
R3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IDSxpx86;IDSxpx86; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20091217.002\IDSxpx86.sys []
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 NAVENG;NAVENG; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091229.009\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091229.009\NAVEX15.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HCF_MSFT;HCF_MSFT; C:\WINDOWS\system32\DRIVERS\HCF_MSFT.sys [2001-08-17 907456]
S3 LVcKap;Logitech AEC Driver; C:\WINDOWS\system32\DRIVERS\LVcKap.sys []
S3 LVMVDrv;Logitech Machine Vision Engine Loader; C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys []
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\LVUSBSta.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 pepifilter;Volume Adapter; C:\WINDOWS\system32\DRIVERS\lv302af.sys []
S3 PID_PEPI;Logitech QuickCam IM(PID_PEPI); C:\WINDOWS\system32\DRIVERS\LV302V32.SYS []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-22 153376]
R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe [2009-10-20 126392]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
S2 LVSrvLauncher;LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [2007-10-19 141848]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

peku006

2009-12-30, 10:16

Hi cuc1_2000

what kind of malware problems you have ?

1 - Download and Run Malwarebytes' Anti-Malware

Please save any items you were working on... close any open programs. You may be asked to reboot your machine.
Please download Malwarebytes Anti-Malware (http://www.malwarebytes.org/mbam-download.php) and save it to your desktop. If needed...Tutorial w/screenshots (http://thespykiller.co.uk/index.php/topic,5946.0.html)
Alternate download sites available here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) or here (http://www.besttechie.net/tools/mbam-setup.exe).
Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Then click Finish.MBAM will automatically start and you will be asked to update the program before performing a scan.
If an update is found, the program will automatically update itself.
Press the OK button to close that box and continue.
Problems downloading the updates? Manually download them from here (http://malwarebytes.gt500.org/mbam-rules.exe) and double-click on "mbam-rules.exe" to install.
On the Scanner tab:
Make sure the "Perform full scan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
Click on the Show Results button to see a list of any malware that was found.
Check all items except items in the C:\System Volume Information folder... then click on Remove Selected.
We will take care of the System Volume Information items later.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

2 - Status Check
Please reply with

the Malwarebytes' Anti-Malware Log

Thanks peku006

cuc1_2000

2009-12-31, 00:05

I am having mass slow down browser problems...exe file popups etc..most of what it found were in the system ones u said remove later..thanks for all this.
Malwarebytes' Anti-Malware 1.42
Database version: 3456
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

12/30/2009 4:01:54 PM
mbam-log-2009-12-30 (16-01-54).txt

Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 173295
Time elapsed: 1 hour(s), 46 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 26
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 8
Files Infected: 64

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034338.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034356.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034330.scr (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034341.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034345.SCR (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034346.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034348.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034352.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034353.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034355.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034357.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034358.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034359.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034360.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034362.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034363.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034364.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034365.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034366.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034367.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034368.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034369.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034376.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034377.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034378.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034379.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP239\A0034380.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP240\A0034398.dll (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP247\A0035485.DLL (Adware.FunWeb) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036821.scr (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036823.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036826.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036830.SCR (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036831.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036832.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036836.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036837.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036839.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036841.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036842.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036843.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036844.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036846.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036847.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036848.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036849.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036850.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036851.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036852.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036853.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036854.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036863.dll (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036865.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036866.EXE (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036867.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036868.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036822.dll (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP258\A0036840.DLL (Adware.MyWebSearch) -> Not selected for removal.
C:\System Volume Information\_restore{A784E3F6-6344-47A9-A99E-3A89A7209700}\RP259\A0036896.dll (Adware.MyWebSearch) -> Not selected for removal.
C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\cd1c34ce-8c22-4f5a-8522-e013622e513e.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

peku006

2009-12-31, 09:09

Hi cuc1_2000

Yeah,you have lot of "crap" in your System Retore files,we clean it later

1 - Clean temp files

Please download TFC (http://oldtimer.geekstogo.com/TFC.exe) to your desktop
Save any unsaved work. TFC will close all open application windows.
Double-click TFC.exe to run the program.
If prompted, click Yes to reboot.

NOTE: Save your work.TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

2 - Eset online scannner

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Please go here (http://www.eset.com/onlinescan/) then click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS1.gif
Select the option YES, I accept the Terms of Use then click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS2.gif
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Now click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS3.gif
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS4.gif
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

3 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

4 - Status Check
Please reply with

1. the Eset online scannner report
2. a fresh HijackThis log

Thanks peku006

cuc1_2000

2009-12-31, 18:23

For some reason it didnt give me a log for the scan..it said 0 threats found though. I couldnt find it even by searching. it took 1.5 hrs to run, do i need to do it again?
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:18:03 AM, on 12/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Utopia\Angel\Angel.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O3 - Toolbar: FrostWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [IMBooster] C:\Program Files\Iminent\IMBooster\IMBooster.exe /warmup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {395E58B9-090C-461A-8F27-087D1C727945} (Web Conferencing) - http://eicc.epopcentral.com/joinie.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v63/bjattack/bja.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200588336218
O16 - DPF: {64CD313F-F079-4D93-959F-4D28B5519449} (Jeopardy Control) - http://www.worldwinner.com/games/v56/jeopardy/jeopardy.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinner.com/games/v67/swapit/swapit.cab
O16 - DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} (MysteryPI Control) - http://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v49/familyfeud/familyfeud.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 7445 bytes

peku006

2009-12-31, 20:21

Hi cuc1_2000

do i need to do it again?

it is not necessary because "0 threats found"

1 - Remove bad HijackThis entries

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application.

Security Check
Please download Security Check (http://screen317.spywareinfoforum.org/SecurityCheck.exe) ... by screen317. Save it to your desktop.
Alternate download site: Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)
Double click the SecurityCheck.exe icon to begin.
Press the Space Bar when you see the "press any key to continue..." message.
A Notepad results file will open automatically called checkup.txt
Save "checkup.txt" to your desktop. (This output file is NOT automatically saved!)
Please copy/paste the entire contents of the checkup.txt file into your next reply.

How's the computer running now? Any problems?

Thanks peku006

cuc1_2000

2009-12-31, 22:17

Hasn't changed alot. the non responsive prgms, lag, spiking cpu usage for no reason, takes forever just to load browser..didnt used to be like this and only had it a few months..thanks again.
Results of screen317's Security Check version 0.99.1
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
ESET Online Scanner v3
Norton Internet Security
Antivirus up to date! (On Access scanning disabled!)
``````````````````````````````
Anti-malware/Other Utilities Check:
HijackThis 2.0.2
Java(TM) 6 Update 17
Java(TM) 6 Update 3
Out of date Java installed!
Adobe Flash Player 10
``````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
``````````````````````````````
DNS Vulnerability Check:
Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)

`````````End of Log```````````

peku006

2010-01-01, 00:44

Hi cuc1_2000

all logs are ok, computer is clean ,your problem seems to be that you have too little RAM to properly run Windows XP
255 MB is very low for Win Xp with SP3

System Still Slow?
You may wish to try StartupLite. (http://www.malwarebytes.org/startuplite.php) Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve preformance.
If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware (http://www.bleepingcomputer.com/forums/index.php?showtopic=87058&view=findpost&p=487112)

post back if it helped.

Thanks peku006

cuc1_2000

2010-01-01, 01:14

So what about the 60+ or so malaware problems the initial scan found in my stuff u said we would clean later????

peku006

2010-01-01, 01:23

Hi

So what about the 60+ or so malaware problems the initial scan found in my stuff u said we would clean later????
were supposed to do it later ...we can do it now

Your log now appears to be clean.........

To remove all of the tools we used and the files and folders they created do the following:

Delete Security Check from your desktop.

Download OTC (http://oldtimer.geekstogo.com/OTC.exe) by Old Timer and save it to your Desktop.

Double-click OTC.exe
Click the CleanUp! button
Select Yes when the Begin cleanup Process? Prompt appears
If you are prompted to Reboot during the cleanup, select Yes
The tool will delete itself once it finishes, if not delete it by yourself

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

MBAM can be uninstalled via control panel add/remove but it may be a useful tool to keep ......Malwarebytes' Anti-Malware Scanning Guide (http://www.lognrock.com/forum/index.php?showtopic=6913).

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP
This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
This will remove all restore points except the new one you just created.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Here are some things that I think are worth having a look at if you don't already know a bout them:.

Spybot Search and Destroy
Download it from here (http://www.safer-networking.org/en/mirrors/index.html). Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here (http://www.bleepingcomputer.com/tutorials/tutorial43.html)

SpyWare Blaster
Download it from here (http://www.javacoolsoftware.com/spywareblaster.html)
Find here the tutorial on how to use Spyware Blaster here (http://www.bleepingcomputer.com/tutorials/tutorial49.html)

WinPatrol
Download it from here (http://www.winpatrol.com/download.html)
Here you can find information about how WinPatrol works here (http://www.winpatrol.com/features.html)

FireTrust SiteHound
You can find information and download it from here (http://www.firetrust.com/en/products/sitehound)

MVPS Hosts File from here (http://mvps.org/winhelp2002/hosts.htm)
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Please check out Tony Klein's article "How did I get infected in the first place?" (http://forums.spybot.info/showthread.php?t=279)

Read some information here (http://users.telenet.be/bluepatchy/miekiemoes/prevention.html) how to prevent Malware.

Happy safe surfing! :bigthumb:

peku006

peku006

2010-01-06, 15:49

As this issue appears to be resolved, this topic is now closed

We are pleased to have been some help in getting you clean.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read :
Your donation helps improving Spybot-S&D! (http://www.safer-networking.org/en/donate/index.html)