Mgrs.exe, alg.exe and a sad infected laptop

Chopin · Jul 6, 2007

Hi, finally my keyboard is working again, so im going to do this as quick as I can. What happened is the usual .exe file that isnt what you think it is. So since last sunday popups have come when im not online, keyboard went bay bay yesterday and the computer is much slower.
Here is my HJT Log.
Logfile of HijackThis v1.99.1
Scan saved at 19:58:33, on 05.07.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
C:\Programfiler\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\Fellesfiler\Teleca Shared\CapabilityManager.exe
C:\Programfiler\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\TEMP\winF0.tmp.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\Fellesfiler\Teleca Shared\Generic.exe
C:\Programfiler\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe
C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe
C:\Programfiler\NetLimiter 2 Lite\NLClient.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Winamp\winamp.exe
C:\Programfiler\MSN Messenger\usnsvc.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\osk.exe
C:\WINDOWS\system32\MSSWCHX.EXE
C:\Programfiler\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [RaidTool] C:\Programfiler\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" /c
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\winF0.tmp.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\gerelojb.dll",forkonce
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programfiler\Fellesfiler\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Scotty · Jul 6, 2007

Hi! Welcome to the Safer-networking forum.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please be patient as my posts to you have to be checked before I reply, so they make take longer.

Before we begin. Could you rename HijackThis.exe to something like scanner.exe and post a new log please?

Chopin · Jul 6, 2007

Hi Scotty

Here is the new Log. After an update, avast actually found mrgs.exe.. I guess thats a good thing, but its not fixed yet i think. Mgrs is just a part of the problem right?

Logfile of HijackThis v1.99.1
Scan saved at 20:44:56, on 06.07.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Alwil Software\Avast4\ashServ.exe
C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
C:\Programfiler\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\QuickTime\qttask.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\TEMP\win9B.tmp.exe
C:\Programfiler\Fellesfiler\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\Internet Explorer\IEXPLORE.EXE
C:\Programfiler\Fellesfiler\Teleca Shared\Generic.exe
C:\Programfiler\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe
C:\Programfiler\NetLimiter 2 Lite\NLClient.exe
C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\Programfiler\Hijackthis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\sgbdqmra.dll
O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\system32\opnnmlk.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9FA0FD9A-4C9D-4B94-9782-703FD50FC929} - C:\WINDOWS\system32\vtuts.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [RaidTool] C:\Programfiler\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" /c
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\win9B.tmp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\ibuytknd.dll",forkonce
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programfiler\Fellesfiler\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: opnnmlk - C:\WINDOWS\SYSTEM32\opnnmlk.dll
O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzwr32 - C:\WINDOWS\SYSTEM32\winzwr32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Scotty · Jul 6, 2007

Hi Chopin

Download and Run ComboFix

Download this file from either of the two below listed places :

Here
or
Here
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Chopin · Jul 6, 2007

"Erik" - 2007-07-06 23:05:47 - ComboFix 07-07-04.4 - Service Pack 2

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ibuytknd.dll
C:\WINDOWS\system32\oaoyiacw.dll
C:\WINDOWS\system32\sgbdqmra.dll
C:\WINDOWS\system32\ddcyxwx.dll
C:\WINDOWS\system32\hggfeca.dll
C:\WINDOWS\system32\hggghhh.dll
C:\WINDOWS\system32\wvuvssq.dll
C:\WINDOWS\system32\xxyxwwt.dll
C:\WINDOWS\system32\yayawtu.dll
C:\WINDOWS\system32\winzwr32.dll
C:\WINDOWS\system32\dnktyubi.ini
C:\WINDOWS\system32\stutv.bak1
C:\WINDOWS\system32\stutv.bak2
C:\WINDOWS\system32\stutv.ini
C:\WINDOWS\system32\stutv.ini2
C:\WINDOWS\system32\stutv.tmp
C:\WINDOWS\system32\stutv.bak1
C:\WINDOWS\system32\stutv.bak2
C:\WINDOWS\system32\stutv.ini
C:\WINDOWS\system32\stutv.ini2
C:\WINDOWS\system32\stutv.tmp
C:\WINDOWS\system32\vtuts.dll
C:\WINDOWS\system32\opnnmlk.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Programfiler\racle~1
C:\Programfiler\wnsxs~1
C:\WINDOWS\installer\8836b.msi
C:\WINDOWS\wr.txt

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_ASC3550U
-------\LEGACY_DOMAINSERVICE
-------\RpcApi

((((((((((((((((((((((((( Files Created from 2007-06-06 to 2007-07-06 )))))))))))))))))))))))))))))))

2007-07-06 23:07 12,288 --a------ C:\WINDOWS\system32\syswin.exe
2007-07-06 23:04 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-06 18:33 4,672 --a------ C:\WINDOWS\system32\tkbxbric.exe
2007-07-03 22:57 <DIR> d-------- C:\WINDOWS\system32\nb-no
2007-07-02 21:01 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-07-02 20:38 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 20:36 <DIR> d-------- C:\Programfiler\PCPitstop
2007-07-02 20:36 <DIR> d-------- C:\Programfiler\Fellesfiler\Scanner
2007-07-01 19:28 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-07-01 19:28 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-01 19:28 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-01 19:28 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-07-01 19:28 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-01 19:28 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-01 19:28 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-01 19:23 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-07-01 19:23 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-07-01 19:23 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-07-01 18:57 8,340 --a------ C:\dnsbak.reg
2007-07-01 17:26 <DIR> d-------- C:\Programfiler\NoAdware5.0
2007-07-01 16:06 682,232 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-07-01 14:51 <DIR> d-------- C:\Programfiler\Alwil Software
2007-07-01 14:37 <DIR> d-------- C:\WINDOWS\system32\Panda Software
2007-07-01 14:19 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-01 14:13 56,320 --a------ C:\DOCUME~1\ALLUSE~1\PROGRA~1\jazatcpk.exe
2007-07-01 14:06 25,244 --a------ C:\WINDOWS\system32\drivers\aspi32.sys
2007-07-01 14:06 <DIR> d-------- C:\Programfiler\Easy CD Clone
2007-07-01 14:03 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2007-07-01 14:03 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-07-01 14:03 16,990 --a------ C:\WINDOWS\DIIUnin.dat
2007-07-01 13:42 <DIR> d-------- C:\Programfiler\Diablo II
2007-06-15 01:00 <DIR> d-------- C:\DOCUME~1\Erik\PROGRA~1\Apple Computer
2007-06-06 12:31 <DIR> d-------- C:\Programfiler\DivX

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-06 18:33:57 -------- d-----w C:\DOCUME~1\Erik\PROGRA~1\uTorrent
2007-07-03 20:46:19 5,888 ----a-w C:\DOCUME~1\Erik\PROGRA~1\wklnhst.dat
2007-07-01 12:13:22 -------- d-----w C:\Programfiler\Winamp
2007-06-14 22:47:48 -------- d-----w C:\DOCUME~1\Erik\PROGRA~1\AdobeUM
2007-06-06 10:31:14 1,286 ----a-w C:\WINDOWS\mozver.dat
2007-06-05 16:20:13 -------- d-----w C:\Programfiler\QuickTime
2007-06-05 16:19:31 -------- d-----w C:\Programfiler\Apple Software Update
2007-06-05 08:47:46 -------- d-----w C:\DOCUME~1\Erik\PROGRA~1\Locktime
2007-06-05 08:19:06 -------- d-----w C:\Programfiler\NetLimiter 2 Lite
2007-06-05 07:59:58 0 ----a-w C:\WINDOWS\nsreg.dat
2007-06-05 06:45:43 -------- d-----w C:\Programfiler\MSN Messenger
2007-05-30 15:02:12 -------- d-----w C:\DOCUME~1\Erik\PROGRA~1\Real
2007-05-30 14:51:51 -------- d-----w C:\Programfiler\Fellesfiler\xing shared
2007-05-30 14:51:48 -------- d-----w C:\Programfiler\Fellesfiler\Real
2007-05-30 14:51:33 -------- d-----w C:\Programfiler\Real
2007-05-29 21:45:10 -------- d-----w C:\DOCUME~1\Erik\PROGRA~1\Leadertech
2007-05-29 19:05:47 -------- d--h--w C:\Programfiler\InstallShield Installation Information
2007-05-25 14:36:27 -------- d-----w C:\Programfiler\Windows Media Connect 2
2007-05-16 15:19:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-09 19:11:29 94,636 ----a-w C:\WINDOWS\dropcpyr.dll
2007-05-07 15:08:56 -------- d-----w C:\Programfiler\Disc2Phone
2007-05-07 15:07:00 60,714 ----a-w C:\WINDOWS\system32\perfc014.dat
2007-05-07 15:07:00 385,330 ----a-w C:\WINDOWS\system32\perfh014.dat
2007-05-07 15:04:16 -------- d-----w C:\DOCUME~1\Erik\PROGRA~1\Teleca
2007-05-07 15:03:35 -------- d-----w C:\Programfiler\Fellesfiler\Teleca Shared
2007-05-07 15:03:20 -------- d-----w C:\Programfiler\Sony Ericsson
2007-05-07 15:01:04 97,056 ----a-w C:\WINDOWS\system32\drivers\W700mdm.sys
2007-05-07 15:01:04 9,264 ----a-w C:\WINDOWS\system32\drivers\W700mdfl.sys
2007-05-07 15:01:04 88,560 ----a-w C:\WINDOWS\system32\drivers\W700mgmt.sys
2007-05-07 15:01:04 86,368 ----a-w C:\WINDOWS\system32\drivers\W700obex.sys
2007-05-07 15:01:04 6,208 ----a-w C:\WINDOWS\system32\drivers\W700cmnt.sys
2007-05-07 15:01:04 6,208 ----a-w C:\WINDOWS\system32\drivers\W700cm.sys
2007-05-05 17:08:45 73,728 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-04-25 14:23:31 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-04-20 09:59:59 59,752 ----a-w C:\DOCUME~1\Erik\PROGRA~1\GDIPFONTCACHEV1.DAT
2007-04-20 09:39:29 340 ----a-w C:\WINDOWS\system32\lsprst7.dll
2007-04-18 16:15:14 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-18 07:13:01 73 ----a-w C:\WINDOWS\system32\ssprs.dll
2007-04-18 07:13:01 1,025 ----a-w C:\WINDOWS\system32\sysprs7.dll
2007-04-18 07:12:25 1,024 ----a-w C:\WINDOWS\system32\clauth2.dll
2007-04-18 07:12:25 1,024 ----a-w C:\WINDOWS\system32\clauth1.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 --a------ C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 C:\WINDOWS\system32\HdAShCut.exe]
"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.5.0\bin\jusched.exe" [2007-03-30 12:48]
"RaidTool"="C:\Programfiler\VIA\RAID\raid_tool.exe" [2005-02-25 13:26]
"nwiz"="nwiz.exe" []
"SoundMan"="SOUNDMAN.EXE" [2005-03-10 09:46 C:\WINDOWS\SoundMan.exe]
"Alcmtr"="ALCMTR.EXE" []
"SynTPLpr"="C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe" [2005-03-18 15:35]
"SynTPEnh"="C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe" [2005-03-18 15:34]
"InstantOn"="C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" [2005-05-11 17:28]
"Adobe Photo Downloader"="C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"Sony Ericsson PC Suite"="C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"Resume copy"="copyfstq.exe" []
"WinampAgent"="C:\Programfiler\Winamp\winampa.exe" []
"TkBellExe"="C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" [2007-05-30 16:51]
"QuickTime Task"="C:\Programfiler\QuickTime\qttask.exe" [2007-04-27 09:41]
"Adobe Reader Speed Launcher"="C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"MsnMsgr"="C:\Programfiler\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start-meny^Programmer^Oppstart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jazatcpk.exe]
C:\Documents and Settings\All Users\Programdata\jazatcpk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SC2]
C:\WINDOWS\system32\scchk32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]
mgrs.exe

Contents of the 'Scheduled Tasks' folder
2007-06-15 07:48:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-06 23:09:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-06 23:10:58 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-06 23:10

--- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 23:15:36, on 06.07.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
C:\Programfiler\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe
C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\NetLimiter 2 Lite\NLClient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
C:\Programfiler\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\QuickTime\qttask.exe
C:\Programfiler\Fellesfiler\Teleca Shared\CapabilityManager.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\Fellesfiler\Teleca Shared\Generic.exe
C:\Programfiler\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\Programfiler\Hijackthis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [RaidTool] C:\Programfiler\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" /c
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programfiler\Fellesfiler\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Scotty · Jul 7, 2007

Hello Chopin

Backup Your Registry with ERUNT

Please use the following link and scroll down to ERUNT and download it.
Here
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Please do this:

Copy the contents of the Code Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
and Save it on the desktop

Code:

REGEDIT4 

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jazatcpk.exe]  

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SC2]  

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]

Make sure there are NO blank lines before REGEDIT4

Then double-click on the fix.reg file, and when it prompts to merge say yes.

Reboot into SAFE MODE

By pressing the F8 key right when Windows starts, usually right after you hear your computer
beep when you reboot it (some versions of windows will display 'Starting Windows' with a grey progress bar)
you will be brought to a menu where you can choose to boot into safe mode.

If it does not work on the first try, reboot and try again, as you have to be quick when you press it.

I have found that during boot up, right after the computer displays the equipment , memory, etc
installed on your computer, if you start lightly tapping the F8 key, the system will usually display the menu.

To enable the viewing of Hidden files follow these steps:

Close all programs so that you are at your desktop.
Double-click on the My Computer icon (or click Start, then select My Computer)
Select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and shutdown My Computer.
Now your computer is configured to show all hidden files.

Delete a bad file
Use Explorer to navigate to and delete the following file.

Files:
C:\WINDOWS\system32\syswin.exe

Then reboot back into Normal Mode.

Download AVG Anti-Spyware.

Install AVG Anti-Spyware.
Launch AVG by double-clicking on the icon.
The program will now open to the main screen.
You will need to update AVG to the latest definition files.
- At the top of the main screen click Update.
  - Then in the Manual Update section, click on Start Update.
The update will start and a progress bar will show the updates being installed.
When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.
AVG manual updates

Run a scan with AVG.

Click on Scanner
- Click on the Settings tab, and set the following settings.
  - How to act
    - Click on Recommended actions, and set to Quarantine.
  - How to scan
    - Check all options.
  - Possibly unwanted software.
    - Check all options.
  - Reports
    - Check Automatically generate report after every scan.
    - Uncheck Only if threats were found.
  - What to scan
    - Check Scan every file.
- Click on the Scan tab.
  - Click on Complete System Scan and the scan will begin.
  - When the scan has finished
    - Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
    - At the bottom of the window click on the Apply all Actions button.

Note: Don't save the report before you hit the Apply action button.

Close AVG Anti-Spyware.

AVG will save a report in the following location C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

Post back with the AVG log and a new HJT log.

Chopin · Jul 7, 2007

I did a avg scan. It found about 172 harmfull items that I quarenteened. That high number is probably because it found some allready quarenteened stuff from avast!. The first scan didnt make a report tho. That is really not supposed to happen is it? There is no report in the folder. c/programfiler/grisoft/reports and its not showing up in the reports tab in the program either.

Well, here's the new hjt anyway.. Im doing a new scan now to try to get a new report

Logfile of HijackThis v1.99.1
Scan saved at 13:22:49, on 07.07.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
C:\Programfiler\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
C:\Programfiler\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programfiler\Fellesfiler\Teleca Shared\CapabilityManager.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe
C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe
C:\Programfiler\NetLimiter 2 Lite\NLClient.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Fellesfiler\Teleca Shared\Generic.exe
C:\Programfiler\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\MSN Messenger\usnsvc.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programfiler\WinRAR\WinRAR.exe
C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Programfiler\VideoLAN\VLC\vlc.exe
C:\WINDOWS\hh.exe
C:\Programfiler\Hijackthis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [RaidTool] C:\Programfiler\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" /c
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programfiler\Fellesfiler\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Scotty · Jul 7, 2007

Hi Chopin

Did you set the settings as described in my previous post?

As for the rest, did you dothe registry fix and delete that file?

Try again with the AVG report. If it doesnt work let me know.

Scotty · Jul 10, 2007

hi chopin

Are you still needing help here?

Chopin · Jul 10, 2007

Sorry for being absent, just lots of work and finally getting avg on track.. actually had to reinstall it. Heres the report..

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 20:31:44 10.07.2007

+ Scan result:

:mozilla.769:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.451:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.452:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.453:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.454:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.455:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.456:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.457:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.458:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.502:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.514:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.537:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.554:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.690:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.691:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.720:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.159:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.160:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.738:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Addcontrol : Cleaned.
:mozilla.565:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.566:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.567:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.182:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.184:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.10:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.11:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.7:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.8:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.9:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.306:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.765:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.773:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Castup : Cleaned.
:mozilla.357:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
:mozilla.239:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.6:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.211:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.511:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.358:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.534:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.464:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.465:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.785:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.786:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.17:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.18:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
C:\Documents and Settings\Erik\Cookies\erik@search.live[1].txt -> TrackingCookie.Live : Cleaned.
:mozilla.337:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.338:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.59:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.766:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Msn : Cleaned.
:mozilla.767:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Msn : Cleaned.
:mozilla.768:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Msn : Cleaned.
:mozilla.200:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.201:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.325:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.326:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.327:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.130:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.568:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.569:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.570:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.571:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.704:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.705:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.706:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.707:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.708:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.709:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.710:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.724:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.670:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.222:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.223:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.224:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.225:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.365:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.376:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.377:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.378:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.379:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.380:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.381:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.382:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.383:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.384:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.693:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.694:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.695:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.696:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.546:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.275:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.276:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.16:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.171:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.172:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.173:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.174:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.69:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.70:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.74:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.75:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.76:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.328:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.329:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.636:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.647:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.283:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.284:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.217:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.545:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.101:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.102:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.103:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.104:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.105:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.106:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.107:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.108:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.109:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.652:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.658:C:\Documents and Settings\Erik\Programdata\Mozilla\Firefox\Profiles\87q04wql.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

::Report end

Chopin · Jul 10, 2007

and

Logfile of HijackThis v1.99.1
Scan saved at 20:38:53, on 10.07.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
C:\Programfiler\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe
C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe
C:\Programfiler\NetLimiter 2 Lite\NLClient.exe
C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe
C:\Programfiler\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\QuickTime\qttask.exe
C:\Programfiler\Fellesfiler\Teleca Shared\CapabilityManager.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Fellesfiler\Teleca Shared\Generic.exe
C:\Programfiler\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Programfiler\MSN Messenger\usnsvc.exe
C:\Programfiles\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programfiles\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\Programfiler\Hijackthis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [RaidTool] C:\Programfiler\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programfiler\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programfiles\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programfiler\Fellesfiler\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programfiler\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programfiles\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programfiler\NetLimiter 2 Lite\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Scotty · Jul 10, 2007

Hello Chopin

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u2, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
and reenable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
5. Next press the Apply button and then the OK to exit the Internet Properties page.
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
You should also scan your computer with this program on a regular basis just as you would an antivirus software.

A tutorial on installing & using this product can be found here:

Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
Install Ad-Aware - Download and install Ad-Aware.
You should also scan your computer with this program on a regular basis
just as you would an antivirus software in conjunction with Spybot.

A tutorial on installing & using this product can be found here:

Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

Using IE-SPYAD to help block unwanted sites and activities
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

tashi · Jul 17, 2007

Glad we could help, as the problem appears to be resolved this topic has been archived.

If you need it re-opened, please send me a private message (pm), and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.

Thank you Mac70.

Mgrs.exe, alg.exe and a sad infected laptop

Chopin

New member

Scotty

New member

Chopin

New member

Scotty

New member

Chopin

New member

Scotty

New member

Chopin

New member

Scotty

New member

Scotty

New member

Chopin

New member

Chopin

New member

Scotty

New member

tashi

Member of Team Spybot