Page 5 of 6 FirstFirst 123456 LastLast
Results 41 to 50 of 53

Thread: Need help with Virtumonde and other problems

  1. #41
    Member
    Join Date
    Apr 2008
    Location
    Toronto
    Posts
    32

    Default

    Hi pskelley,

    I have followed your instructions. Does this mean I am clean now?!?

    Thanks,
    Gary

  2. #42
    Member
    Join Date
    Apr 2008
    Location
    Toronto
    Posts
    32

    Default

    Hi,

    I just ran a S&D search and it has detected smitfraud.c and microsoft.windowsSecurityCenter_disabled.


  3. #43
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    Make sure your version of Spybot is totally up to date and fully immunized.
    I am running version 1.5.2.20 Latest detection update: 2008-04-09

    If you are up to date, it may be a false positive, look here:
    http://forums.spybot.info/forumdisplay.php?f=16
    or post here for help from the Spybot experts:
    http://forums.spybot.info/forumdisplay.php?f=4
    (please be sure it is not you first, before you watse their time)

    Why does Spybot-S&D flag changes in the Windows Security Center?
    http://www.safer-networking.org/en/faq/46.html
    http://www.safer-networking.org/en/faq/index.html
    http://forums.spybot.info/showthread.php?t=250

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  4. #44
    Member
    Join Date
    Apr 2008
    Location
    Toronto
    Posts
    32

    Default

    Hi pskelly,

    I updated to use the same version and date as the one you mention. How do I determine if it is a false positive?

    Should I reenable teatimer?

    My Norton Antivirus is again turned off. How can I keep this turned on? I believe it was the trojan that turned this off but now it still keeps turning itself off. Do I have a problem still?

    I am wondering if you can give me advice on what firewall and antivirus program to use. Currently I am using norton protection suite for firewall and antivirus. I am using S&D for spyware but forgot originally to immunize which is how I got into this mess.

    Is AVG (the free version) better to use than nortons? Can you recommend a better firewall than nortons?

    By the way, what am I supposed to do now?

    Thanks again for all your help. Your volunteer work in helping others is very generous.

  5. #45
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    Yes, enable TeaTimer if you run it.

    In my post #40, I included links with information from experts that should answer all of your questions if you will take the time to review them. Once you have done that, if you still have questions, post them and I will do my best to give you answers.
    Is AVG (the free version) better to use than nortons? Can you recommend a better firewall than nortons?
    I run AVG Free myself, but I am not in the business of comparing programs, I personally offer only freeware. If you want comparisons, ask Google for help such as:
    http://www.google.com/search?hl=en&q...=Google+Search

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  6. #46
    Member
    Join Date
    Apr 2008
    Location
    Toronto
    Posts
    32

    Default

    Hi pskelly,

    I reenabled teatimer and also changed my firewall from Norton to on-line armour. I changed my AV program from Norton to Avira. Also I added spyware guard and spyware blaster.

    The results...

    I ran a full scan of Avira and it found 1 trojan called TR/Crpt.XPACK.Gen which I had it delete.

    I also ran another full S&D scan and it continues to find the smitfraud.c trojan.

    My computer worked well last night but today I am having difficulty connecting to my wireless. I am plugged in right now. I think maybe I denied some critical access needed by the computer to connect to the wireless router.

    Also when I went into the firewall settings if I look at the allowed hosts it is full of all the nasty websites you would never want to access, with full access allowed to those sites. I think something is disabling the protection still.

    Is there some kind of a new scan we can still run? I think I am still infected.

  7. #47
    Member
    Join Date
    Apr 2008
    Location
    Toronto
    Posts
    32

    Default

    Result of reboot and rescan of S&D today.

    DoubleClick tracking cookie
    FastClick tracking cookie
    HitBox tracking cookie
    HitsLink tracking cookie
    MediaPlex tracking cookie
    Microsoft.WindowsSecurityCenter_disabled
    Statcounter tracking cookie

    No more Smitfraud.C reported. Are these tracking cookies bad and if they are how can I prevent them?

    I just ran another Avira virus scan and it found the same Trojan as last time.

  8. #48
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    Microsoft.WindowsSecurityCenter_disabled <<< this was covered in a post, I willl post the information again:
    Why does Spybot-S&D flag changes in the Windows Security Center?
    http://www.safer-networking.org/en/faq/46.html
    http://www.safer-networking.org/en/faq/index.html
    http://forums.spybot.info/showthread.php?t=250

    Ask any Spybot questions in the Spybot forum:
    http://forums.spybot.info/forumdisplay.php?f=4

    This information will help you control tracking cookies:
    http://www.mvps.org/winhelp2002/cookies.htm
    http://www.microsoft.com/windows/ie/...cy/config.mspx

    Post log of what Avira virus scan is showing you along with a new HJT log.
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  9. #49
    Member
    Join Date
    Apr 2008
    Location
    Toronto
    Posts
    32

    Default

    AntiVir PersonalEdition Classic
    Report file date: Sunday, April 13, 2008 12:03

    Scanning for 1198942 virus strains and unwanted programs.

    Licensed to: Avira AntiVir PersonalEdition Classic
    Serial number: 0000149996-ADJIE-0001
    Platform: Windows XP
    Windows version: (Service Pack 2) [5.1.2600]
    Username: SYSTEM
    Computer name: HOME-8095EC165C

    Version information:
    BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00
    AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 18:16:29
    AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 17:23:51
    LUKE.DLL : 7.0.5.3 147496 Bytes 8/14/2007 20:32:47
    LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 17:35:20
    ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 19:27:15
    ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 05:17:35
    ANTIVIR2.VDF : 7.0.3.156 795136 Bytes 4/11/2008 05:17:35
    ANTIVIR3.VDF : 7.0.3.158 61952 Bytes 4/11/2008 05:17:35
    AVEWIN32.DLL : 7.6.0.85 3461632 Bytes 4/13/2008 05:17:36
    AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 15:36:26
    AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 12:39:17
    AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 18:16:24
    AVPACK32.DLL : 7.6.0.3 360488 Bytes 4/13/2008 05:17:36
    AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 12:17:06
    AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 17:26:33
    AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 12:10:18
    NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 16:09:42
    RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 17:38:13
    RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 17:50:37
    SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 14:37:21

    Configuration settings for the scan:
    Jobname..........................: Complete system scan
    Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
    Logging..........................: low
    Primary action...................: interactive
    Secondary action.................: ignore
    Scan master boot sector..........: off
    Scan boot sector.................: on
    Boot sectors.....................: C:,
    Scan memory......................: on
    Process scan.....................: on
    Scan registry....................: on
    Search for rootkits..............: off
    Scan all files...................: Intelligent file selection
    Scan archives....................: on
    Recursion depth..................: 20
    Smart extensions.................: on
    Macro heuristic..................: on
    File heuristic...................: medium

    Start of the scan: Sunday, April 13, 2008 12:03

    The scan of running processes will be started
    Scan process 'avscan.exe' - '1' Module(s) have been scanned
    Scan process 'avscan.exe' - '1' Module(s) have been scanned
    Scan process 'avcenter.exe' - '1' Module(s) have been scanned
    Scan process 'firefox.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'SpybotSD.exe' - '1' Module(s) have been scanned
    Scan process 'YPCSER~1.EXE' - '1' Module(s) have been scanned
    Scan process 'sgbhp.exe' - '1' Module(s) have been scanned
    Scan process 'sgmain.exe' - '1' Module(s) have been scanned
    Scan process 'DLG.exe' - '1' Module(s) have been scanned
    Scan process 'SSDK02.exe' - '1' Module(s) have been scanned
    Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
    Scan process 'YahooMessenger.exe' - '1' Module(s) have been scanned
    Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
    Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
    Scan process 'ycommon.exe' - '1' Module(s) have been scanned
    Scan process 'RogersAgent.exe' - '1' Module(s) have been scanned
    Scan process 'avgnt.exe' - '1' Module(s) have been scanned
    Scan process 'oaui.exe' - '0' Module(s) have been scanned
    Scan process 'ApntEx.exe' - '1' Module(s) have been scanned
    Scan process 'hidfind.exe' - '1' Module(s) have been scanned
    Scan process 'jusched.exe' - '1' Module(s) have been scanned
    Scan process 'ypc.exe' - '1' Module(s) have been scanned
    Scan process 'yop.exe' - '1' Module(s) have been scanned
    Scan process 'WLTRAY.EXE' - '1' Module(s) have been scanned
    Scan process 'quickset.exe' - '1' Module(s) have been scanned
    Scan process 'Apoint.exe' - '1' Module(s) have been scanned
    Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
    Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
    Scan process 'alg.exe' - '1' Module(s) have been scanned
    Scan process 'explorer.exe' - '1' Module(s) have been scanned
    Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
    Scan process 'NicConfigSvc.exe' - '1' Module(s) have been scanned
    Scan process 'MDM.EXE' - '1' Module(s) have been scanned
    Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
    Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
    Scan process 'BAsfIpM.exe' - '1' Module(s) have been scanned
    Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
    Scan process 'sched.exe' - '1' Module(s) have been scanned
    Scan process 'avguard.exe' - '1' Module(s) have been scanned
    Scan process 'scardsvr.exe' - '1' Module(s) have been scanned
    Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
    Scan process 'oasrv.exe' - '0' Module(s) have been scanned
    Scan process 'BCMWLTRY.EXE' - '1' Module(s) have been scanned
    Scan process 'WLTRYSVC.EXE' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'lsass.exe' - '1' Module(s) have been scanned
    Scan process 'services.exe' - '1' Module(s) have been scanned
    Scan process 'winlogon.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'smss.exe' - '1' Module(s) have been scanned
    54 processes with 54 modules were scanned

    Start scanning boot sectors:
    Boot sector 'C:\'
    [NOTE] No virus was found!

    Starting to scan the registry.
    The registry was scanned ( '39' files ).


    Starting the file scan:

    Begin scan in 'C:\'
    C:\pagefile.sys
    [WARNING] The file could not be opened!
    C:\System Volume Information\_restore{17913FD4-45AD-4887-AA5D-26A9E19EBD19}\RP4\A0000605.exe
    [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
    [INFO] The file was deleted!


    End of the scan: Sunday, April 13, 2008 12:46
    Used time: 43:06 min

    The scan has been canceled!

    3428 Scanning directories
    174618 Files were scanned
    1 viruses and/or unwanted programs were found
    0 Files were classified as suspicious:
    1 files were deleted
    0 files were repaired
    0 files were moved to quarantine
    0 files were renamed
    1 Files cannot be scanned
    174617 Files not concerned
    845 Archives were scanned
    1 Warnings
    11 Notes

  10. #50
    Member
    Join Date
    Apr 2008
    Location
    Toronto
    Posts
    32

    Default

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:06:23 AM, on 4/14/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\Program Files\Tall Emu\Online Armor\oasrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\SCardSvr.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\basfipm.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\WLTRAY.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Tall Emu\Online Armor\oaui.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Rogers\SelfHealing\rogersagent.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\YPCSER~1.EXE
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\Garyrunningdude.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rogers.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rogers.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: (no name) - {6D35C75F-7BAF-4B9D-8BF1-DCCC655BF6CF} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {A98D0065-7326-41B5-B8D9-C5B692CDB82F} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
    O2 - BHO: (no name) - {B87DB383-2A35-40A6-89E3-09F694B14884} - (no file)
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [bascstray] BascsTray.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [RogersAgent] c:\Program Files\Rogers\SelfHealing\rogersagent.exe
    O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
    O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\RunOnce: [SpybotDeletingB2474] command /c del "C:\WINDOWS\system32\cbXQiHBU.dll_old"
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1206583687759
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL/...ws-i586-jc.cab
    O20 - Winlogon Notify: geBuUlLE - C:\WINDOWS\
    O21 - SSODL: VolumeRam - {205e4f97-849e-4a84-98eb-c1c1ac0c5bdc} - (no file)
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Broadcom ASF IP monitoring service v6.0.1 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 10630 bytes

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •