Page 2 of 2 FirstFirst 12
Results 11 to 20 of 20

Thread: Having Problems with a few things

  1. #11
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    To access the Uninstall Manager you would do the following:

    1. Start HijackThis
    2. Click on the Config button
    3. Click on the Misc Tools button
    4. Click on the Open Uninstall Manager button.

    You will now be presented with a screen similar to the one below:



    5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  2. #12
    Junior Member
    Join Date
    Dec 2008
    Posts
    21

    Default

    ABBYY FineReader 5.0 Sprint Plus
    Adobe Flash Player Plugin
    Adobe Reader 7.0
    AIM 6
    AIM Toolbar
    AOL Search
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft Software Suite
    Audacity 1.2.6
    AVG Free 8.0
    BigFix
    Compatibility Pack for the 2007 Office system
    Digital Media Reader
    DKP Profiler
    DKP Profiler (C:\Program Files\DKP Profiler Uploader\)
    DKP Profiler (C:\Program Files\DKP Profiler Uploader\) #3
    Download Updater (AOL LLC)
    EPSON CardMonitor
    EPSON Copy Utility 3
    EPSON CX6600 Reference Guide
    EPSON PhotoStarter3.2
    EPSON Printer Software
    EPSON Scan
    EPSON Smart Panel
    Google Toolbar for Internet Explorer
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB926239)
    Hotfix for Windows XP (KB932716-v2)
    Hotfix for Windows XP (KB952287)
    Intel(R) Extreme Graphics 2 Driver
    Intel(R) PRO Network Adapters and Drivers
    iTunes
    J2SE Runtime Environment 5.0 Update 2
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Broadband Networking
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Digital Image Starter Edition 2006
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    Microsoft Money 2005
    Microsoft Office 2000 Professional
    Microsoft User-Mode Driver Framework Feature Pack 1.7
    Microsoft Visual C++ 2005 Redistributable
    Microsoft WinUsb 1.0
    Microsoft Works
    Mozilla Firefox (3.0.4)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 6 Service Pack 2 (KB954459)
    Napster
    Napster Burn Engine
    PokeGlobal
    PowerDVD
    QuickTime
    RealPlayer Basic
    Realtek AC'97 Audio
    ScanToWeb
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB939653)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB942615)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944338)
    Security Update for Windows XP (KB944533)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB947864)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB948881)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    SoftV92 Data Fax Modem with SmartCP
    Spybot - Search & Destroy
    Update for Windows XP (KB894391)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB908531)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB911280)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB942840)
    Update for Windows XP (KB946627)
    Update for Windows XP (KB951072-v2)
    Ventrilo Client
    Viewpoint Media Player
    Windows Backup Utility
    Windows Live installer
    Windows Live Messenger
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    World of Warcraft
    Xvid 1.1.3 final uninstall
    Zune
    Zune
    Zune Language Pack (ES)
    Zune Language Pack (FR)

  3. #13
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Open notepad and copy/paste the text in the codebox below into it:

    Code:
    Folder::
    c:\program files\LimeWire
    c:\documents and settings\Owner\Application Data\LimeWire
    Save this as "CFScript"

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.



    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  4. #14
    Junior Member
    Join Date
    Dec 2008
    Posts
    21

    Default

    K i did what you wanted.

    ComboFix:

    ComboFix 08-12-09.03 - Owner 2008-12-10 15:16:00.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.904 [GMT -5:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Owner\Application Data\LimeWire
    c:\documents and settings\Owner\Application Data\LimeWire\414splashfree.png
    c:\documents and settings\Owner\Application Data\LimeWire\active.mojito
    c:\documents and settings\Owner\Application Data\LimeWire\certificate\limewire.keystore
    c:\documents and settings\Owner\Application Data\LimeWire\createtimes.cache
    c:\documents and settings\Owner\Application Data\LimeWire\downloads.dat
    c:\documents and settings\Owner\Application Data\LimeWire\fileurns.bak
    c:\documents and settings\Owner\Application Data\LimeWire\fileurns.cache
    c:\documents and settings\Owner\Application Data\LimeWire\filters.props
    c:\documents and settings\Owner\Application Data\LimeWire\gnutella.net
    c:\documents and settings\Owner\Application Data\LimeWire\installation.props
    c:\documents and settings\Owner\Application Data\LimeWire\library.dat
    c:\documents and settings\Owner\Application Data\LimeWire\limewire.props
    c:\documents and settings\Owner\Application Data\LimeWire\mojito.props
    c:\documents and settings\Owner\Application Data\LimeWire\passive.mojito
    c:\documents and settings\Owner\Application Data\LimeWire\promotion\promodb.backup
    c:\documents and settings\Owner\Application Data\LimeWire\promotion\promodb.data
    c:\documents and settings\Owner\Application Data\LimeWire\promotion\promodb.properties
    c:\documents and settings\Owner\Application Data\LimeWire\promotion\promodb.script
    c:\documents and settings\Owner\Application Data\LimeWire\questions.props
    c:\documents and settings\Owner\Application Data\LimeWire\responses.cache
    c:\documents and settings\Owner\Application Data\LimeWire\simpp.xml
    c:\documents and settings\Owner\Application Data\LimeWire\spam.dat
    c:\documents and settings\Owner\Application Data\LimeWire\tables.props
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme.lwtp
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\01_star.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\02_star.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\03_star.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\04_star.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\05_star.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\chat.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\forward_up.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\kill.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\kill_on.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\logo.png
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\notsearching.png
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\pause_up.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\play_dn.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\play_up.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\question.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\searching.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\splash.png
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\splashpro.png
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\stop_up.gif
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\theme.txt
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\version.txt
    c:\documents and settings\Owner\Application Data\LimeWire\themes\windows_theme\warning.gif
    c:\documents and settings\Owner\Application Data\LimeWire\ttree.cache
    c:\documents and settings\Owner\Application Data\LimeWire\ttrees.cache
    c:\documents and settings\Owner\Application Data\LimeWire\ttroot.cache
    c:\documents and settings\Owner\Application Data\LimeWire\version.xml
    c:\documents and settings\Owner\Application Data\LimeWire\versions.props
    c:\documents and settings\Owner\Application Data\LimeWire\xml\data\audio.sxml2
    c:\documents and settings\Owner\Application Data\LimeWire\xml\data\delete_me
    c:\documents and settings\Owner\Application Data\LimeWire\xml\data\image.sxml2
    c:\documents and settings\Owner\Application Data\LimeWire\xml\data\video.sxml2
    c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\application.gif
    c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\audio.gif
    c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\document.gif
    c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\image.gif
    c:\documents and settings\Owner\Application Data\LimeWire\xml\misc\video.gif
    c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\application.xsd
    c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\audio.xsd
    c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\document.xsd
    c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\image.xsd
    c:\documents and settings\Owner\Application Data\LimeWire\xml\schemas\video.xsd
    c:\program files\LimeWire
    c:\program files\LimeWire\Gwen Tennyson.jpg

    .
    ((((((((((((((((((((((((( Files Created from 2008-11-10 to 2008-12-10 )))))))))))))))))))))))))))))))
    .

    2008-12-07 15:24 . 2008-12-08 22:22 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-12-06 23:55 . 2008-12-06 23:55 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
    2008-12-06 23:55 . 2008-12-06 23:55 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
    2008-12-06 23:55 . 2008-12-06 23:55 10,520 --a------ c:\windows\system32\avgrsstx.dll
    2008-12-06 23:54 . 2008-12-10 06:46 <DIR> d-------- c:\windows\system32\drivers\Avg
    2008-12-06 23:54 . 2008-12-06 23:54 <DIR> d-------- c:\program files\AVG
    2008-12-06 23:54 . 2008-12-06 23:54 <DIR> d-------- c:\documents and settings\Owner\Application Data\AVGTOOLBAR
    2008-12-06 23:54 . 2008-12-06 23:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
    2008-12-02 22:23 . 2008-12-02 22:23 321 --a------ c:\windows\wininit.ini
    2008-12-01 18:04 . 2008-12-01 18:04 268 --ah----- C:\sqmdata09.sqm
    2008-12-01 18:04 . 2008-12-01 18:04 244 --ah----- C:\sqmnoopt09.sqm
    2008-12-01 15:12 . 2008-12-01 15:12 268 --ah----- C:\sqmdata08.sqm
    2008-12-01 15:12 . 2008-12-01 15:12 244 --ah----- C:\sqmnoopt08.sqm
    2008-11-30 15:54 . 2008-11-30 15:54 268 --ah----- C:\sqmdata07.sqm
    2008-11-30 15:54 . 2008-11-30 15:54 244 --ah----- C:\sqmnoopt07.sqm
    2008-11-30 01:39 . 2008-11-30 01:39 268 --ah----- C:\sqmdata06.sqm
    2008-11-30 01:39 . 2008-11-30 01:39 244 --ah----- C:\sqmnoopt06.sqm
    2008-11-29 08:45 . 2008-11-29 08:45 268 --ah----- C:\sqmdata05.sqm
    2008-11-29 08:45 . 2008-11-29 08:45 244 --ah----- C:\sqmnoopt05.sqm
    2008-11-29 00:06 . 2008-11-29 00:06 <DIR> d-------- c:\program files\Spybot - Search & Destroy
    2008-11-29 00:06 . 2008-11-29 00:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2008-11-28 23:51 . 2008-11-28 23:51 <DIR> d-------- c:\program files\Trend Micro
    2008-11-28 22:44 . 2008-11-29 01:48 <DIR> d-------- c:\documents and settings\Owner\.housecall6.6
    2008-11-28 12:43 . 2008-11-28 12:43 268 --ah----- C:\sqmdata04.sqm
    2008-11-28 12:43 . 2008-11-28 12:43 244 --ah----- C:\sqmnoopt04.sqm
    2008-11-27 15:34 . 2008-11-27 15:35 <DIR> d-------- c:\program files\Xvid
    2008-11-27 15:34 . 2008-04-27 10:33 765,952 --a------ c:\windows\system32\xvidcore.dll
    2008-11-27 15:34 . 2008-04-27 10:35 180,224 --a------ c:\windows\system32\xvidvfw.dll
    2008-11-27 15:34 . 2007-06-28 18:55 77,824 --a------ c:\windows\system32\xvid.ax
    2008-11-27 15:20 . 2008-11-27 15:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\CyberLink
    2008-11-26 18:11 . 2008-11-26 18:11 268 --ah----- C:\sqmdata03.sqm
    2008-11-26 18:11 . 2008-11-26 18:11 244 --ah----- C:\sqmnoopt03.sqm
    2008-11-26 06:19 . 2008-11-26 06:19 268 --ah----- C:\sqmdata02.sqm
    2008-11-26 06:19 . 2008-11-26 06:19 244 --ah----- C:\sqmnoopt02.sqm
    2008-11-25 15:02 . 2008-11-25 15:02 268 --ah----- C:\sqmdata01.sqm
    2008-11-25 15:02 . 2008-11-25 15:02 244 --ah----- C:\sqmnoopt01.sqm
    2008-11-25 06:19 . 2008-11-25 06:19 268 --ah----- C:\sqmdata00.sqm
    2008-11-25 06:19 . 2008-11-25 06:19 244 --ah----- C:\sqmnoopt00.sqm
    2008-11-22 16:43 . 2008-11-22 16:43 <DIR> d-------- c:\program files\Common Files\Software Update Utility
    2008-11-22 16:43 . 2008-11-29 00:21 <DIR> d-------- c:\program files\AIM Toolbar
    2008-11-22 16:43 . 2008-11-22 16:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\AIM Toolbar
    2008-11-22 16:43 . 2008-11-22 16:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\acccore
    2008-11-22 16:42 . 2008-11-22 16:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\AOL Downloads
    2008-11-11 19:16 . 2008-11-11 19:16 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
    2008-11-10 18:43 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
    2008-11-10 18:43 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
    2008-11-10 18:43 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-10 01:23 --------- d-----w c:\program files\World of Warcraft
    2008-12-08 20:15 --------- d-----w c:\program files\Incomplete
    2008-11-29 05:21 --------- d-----w c:\program files\Google
    2008-11-22 21:43 --------- d-----w c:\program files\AIM6
    2008-11-22 21:43 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
    2008-11-10 02:00 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
    2008-11-10 02:00 --------- d-----w c:\program files\Windows Live
    2008-11-10 01:57 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
    2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-14 18:44 --------- d-----w c:\documents and settings\All Users\Application Data\Blizzard
    2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
    2008-09-12 22:48 245,664 ----a-w c:\windows\system32\ZuneWlanCfgSvc.exe
    2008-09-12 22:46 61,856 ----a-w c:\windows\system32\ZuneBusEnum.exe
    2008-09-12 22:32 73,216 ----a-w c:\windows\system32\ZuneUsbTransport.dll
    2008-09-12 22:32 57,344 ----a-w c:\windows\system32\ZuneRegUtil.dll
    2008-09-12 22:32 310,272 ----a-w c:\windows\system32\ZuneNetProxy.dll
    2008-09-12 22:32 18,944 ----a-w c:\windows\system32\ZuneTcp2Udp.dll
    2008-09-12 22:32 145,920 ----a-w c:\windows\system32\ZuneMTPZ.dll
    2008-09-12 22:32 12,800 ----a-w c:\windows\system32\ZunePTDNS.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
    "Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-03-15 966656]
    "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
    "Auto EPSON Stylus CX6600 Series on BASEMENT"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE" [2004-02-29 98304]
    "Auto EPSON Stylus CX6600 Series on BASEMENT (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE" [2004-02-29 98304]
    "Auto Auto EPSON Stylus CX6600 Series on YOUR-28180281E2 on BASEMENT"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE" [2004-02-29 98304]
    "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-06 1261336]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    BigFix.lnk - c:\program files\BigFix\BigFix.exe [2007-11-23 1742384]
    Install Pending Files.LNK - c:\program files\SIFXINST\SIFXINST.EXE [2007-11-23 729088]
    Microsoft Broadband Networking.lnk - c:\windows\Installer\{2C84BB95-1DB9-4AC4-8750-F979BBCDD859}\_18be6784.exe [2007-11-23 25214]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"=
    "c:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=
    "c:\\Program Files\\Microsoft Broadband Networking\\MSBNUtil.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
    "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-06 97928]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-06 875288]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-06 231704]
    R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-06 76040]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-12-09 24652]
    R3 MSFT43XX;Microsoft Wireless Notebook Adapter Driver;c:\windows\system32\DRIVERS\mn720-50.sys [2003-07-18 254208]
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-05 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
    .
    - - - - ORPHANS REMOVED - - - -

    URLSearchHooks-HookURL - (no file)
    URLSearchHooks-Rank - (no file)


    .
    ------- Supplementary Scan -------
    .
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\n9bom4h6.default\
    FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_02\bin\NPJava11.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_02\bin\NPJava12.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_02\bin\NPJava13.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_02\bin\NPJava14.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_02\bin\NPJava32.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
    FF -: plugin - c:\program files\Java\jre1.5.0_02\bin\NPOJI610.dll
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdnu.dll
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
    FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-10 15:17:51
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(892)
    c:\windows\system32\avgrsstx.dll

    - - - - - - - > 'lsass.exe'(1000)
    c:\windows\system32\avgrsstx.dll
    .
    Completion time: 2008-12-10 15:19:03
    ComboFix-quarantined-files.txt 2008-12-10 20:18:51
    ComboFix2.txt 2008-12-10 01:14:56

    Pre-Run: 42,485,387,264 bytes free
    Post-Run: 42,471,493,632 bytes free

    267 --- E O F --- 2008-11-14 08:01:34




    HijackThis:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:22:13 PM, on 12/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE
    C:\Program Files\Zune\ZuneLauncher.exe
    C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\AIM6\aim6.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\BigFix\BigFix.exe
    C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\Hazard.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [Auto EPSON Stylus CX6600 Series on BASEMENT] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE /P43 "Auto EPSON Stylus CX6600 Series on BASEMENT" /O17 "\\BASEMENT\hazard" /M "Stylus CX6600"
    O4 - HKLM\..\Run: [Auto EPSON Stylus CX6600 Series on BASEMENT (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE /P52 "Auto EPSON Stylus CX6600 Series on BASEMENT (Copy 1)" /O23 "\\BASEMENT\EPSON_Stylus" /M "Stylus CX6600"
    O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX6600 Series on YOUR-28180281E2 on BASEMENT] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE /P67 "Auto Auto EPSON Stylus CX6600 Series on YOUR-28180281E2 on BASEMENT" /O23 "\\BASEMENT\Auto_EPSON_S" /M "Stylus CX6600"
    O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
    O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
    O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 5223 bytes

  5. #15
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Please go to Kaspersky website and perform an online antivirus scan.

    Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select ''Run as administrator'' to perform this scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    9. Please post this log in your next reply along with a fresh HijackThis log.


    If you need a tutorial, see here
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  6. #16
    Junior Member
    Join Date
    Dec 2008
    Posts
    21

    Default

    It won't let me, im online and it says "Starting Java applet has failed! Please go online to use this program." any ideas?

  7. #17
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Have you tried using another browser?
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  8. #18
    Junior Member
    Join Date
    Dec 2008
    Posts
    21

    Default

    It wasn't my browser but thank you.

    Kaspersky:

    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Thursday, December 11, 2008
    Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Wednesday, December 10, 2008 22:20:53
    Records in database: 1450451
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\

    Scan statistics:
    Files scanned: 58450
    Threat name: 4
    Infected objects: 12
    Suspicious objects: 0
    Duration of the scan: 02:31:34


    File name / Threat name / Threats count
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-502064fb-2698d07b.zip Infected: Exploit.Java.Gimsh.b 1
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-51fad18-34722810.zip Infected: Exploit.Java.Gimsh.a 1
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b13a7e7-5489f44a.zip Infected: Exploit.Java.Gimsh.b 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\aaenyfna.dll.vir Infected: Trojan.Win32.Monder.abke 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\faxktj.dll.vir Infected: Trojan.Win32.Monder.abke 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\jkcfttea.dll.vir Infected: Trojan.Win32.Monder.abke 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\lguwlk.dll.vir Infected: Trojan.Win32.Monder.abke 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ljhuas.dll.vir Infected: Trojan.Win32.Monder.abke 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\vylzew.dll.vir Infected: Trojan.Win32.Monder.abke 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wjiokdmy.dll.vir Infected: Trojan.Win32.Monder.abke 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wqpndnel.dll.vir Infected: Trojan.Win32.Monder.abke 1
    D:\i386\Apps\App03130\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1

    The selected area was scanned.



    HijackThis:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:11:40 AM, on 12/11/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE
    C:\Program Files\Zune\ZuneLauncher.exe
    C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\AIM6\aim6.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\BigFix\BigFix.exe
    C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\Hazard.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [Auto EPSON Stylus CX6600 Series on BASEMENT] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE /P43 "Auto EPSON Stylus CX6600 Series on BASEMENT" /O17 "\\BASEMENT\hazard" /M "Stylus CX6600"
    O4 - HKLM\..\Run: [Auto EPSON Stylus CX6600 Series on BASEMENT (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE /P52 "Auto EPSON Stylus CX6600 Series on BASEMENT (Copy 1)" /O23 "\\BASEMENT\EPSON_Stylus" /M "Stylus CX6600"
    O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX6600 Series on YOUR-28180281E2 on BASEMENT] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9EA.EXE /P67 "Auto Auto EPSON Stylus CX6600 Series on YOUR-28180281E2 on BASEMENT" /O23 "\\BASEMENT\Auto_EPSON_S" /M "Stylus CX6600"
    O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
    O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
    O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 5275 bytes

  9. #19
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Empty these folders:

    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache
    C:\Qoobox\Quarantine

    Empty Recycle Bin.

    Still problems?
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  10. #20
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

    Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

    If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •