I seem to have been mysterious hit with this most annoying pig known as Torpig.
Did the safe mode thing, did the online scan.
Online scan found nothing.
Safe mode deleted it, but upon reboot it was back.
here's my SD report:
Part1
--- Search result list ---
Torpig: Temporary file (File, nothing done)
C:\WINDOWS\Temp\$_2341234.TMP
Torpig: Temporary file (File, nothing done)
C:\WINDOWS\Temp\$_2341233.TMP
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2007-07-03 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-05-23 advcheck.dll (1.5.3.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-01-02 Tools.dll (2.0.1.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-07-03 Includes\Cookies.sbi (*)
2007-05-30 Includes\Dialer.sbi (*)
2007-07-03 Includes\DialerC.sbi (*)
2007-06-20 Includes\Hijackers.sbi (*)
2007-07-03 Includes\HijackersC.sbi (*)
2007-06-27 Includes\Keyloggers.sbi (*)
2007-07-03 Includes\KeyloggersC.sbi (*)
2007-06-20 Includes\Malware.sbi (*)
2007-07-03 Includes\MalwareC.sbi (*)
2007-03-21 Includes\PUPS.sbi (*)
2007-07-03 Includes\PUPSC.sbi (*)
2007-07-03 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-07-03 Includes\SecurityC.sbi (*)
2007-06-20 Includes\Spybots.sbi (*)
2007-07-03 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2007-07-03 Includes\Trojans.sbi (*)
2007-07-03 Includes\TrojansC.sbi (*)
2007-06-06 Plugins\TCPIPAddress.dll
--- System information ---
Windows XP (Build: 2600) Service Pack 2
/ Windows XP / SP2: Windows XP Service Pack 2
/ Windows XP / SP3: Windows Installer 3.1 (KB893803)
/ XML Paper Specification Shared Components Pack 1.0: XML Paper Specification Shared Components Pack 1.0
--- Startup entries list ---
Located: HK_LM:Run, CAVRID
command: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
file: C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
size: 230928
MD5: fd7d8b5d4728859001c10644f30c06c6
Located: HK_LM:Run, cctray
command: "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
file: C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
size: 177680
MD5: cacc8671c3d62eb8dc145bb6cfb5738e
Located: HK_LM:Run, NeroFilterCheck
command: C:\WINDOWS\system32\NeroCheck.exe
file: C:\WINDOWS\system32\NeroCheck.exe
size: 155648
MD5: 3e4c03cefad8de135263236b61a49c90
Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
file: C:\WINDOWS\system32\RUNDLL32.EXE
size: 33280
MD5: da285490bbd8a1d0ce6623577d5ba1ff
Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
file: C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
size: 83608
MD5: 9c1c80bbf8e6044980890e2d2d91091c
Located: HK_CU:Run, MSMSGS
command: "C:\Program Files\Messenger\msmsgs.exe" /background
file: C:\Program Files\Messenger\msmsgs.exe
size: 1667584
MD5: b53343fe60a33ee765c2476d50d27b26
Located: Startup (common), Microsoft Office.lnk
command: C:\Program Files\Microsoft Office\Office\OSA9.EXE
file: C:\Program Files\Microsoft Office\Office\OSA9.EXE
size: 65588
MD5: 57cb86b1cdd77eb5138ba05d1f193463
Located: System.ini, crypt32chain
command: crypt32.dll
file: crypt32.dll
Located: System.ini, cryptnet
command: cryptnet.dll
file: cryptnet.dll
Located: System.ini, cscdll
command: cscdll.dll
file: cscdll.dll
Located: System.ini, PFW
command: UmxWnp.Dll
file: UmxWnp.Dll
Located: System.ini, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
Located: System.ini, Schedule
command: wlnotify.dll
file: wlnotify.dll
Located: System.ini, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
Located: System.ini, SensLogn
command: WlNotify.dll
file: WlNotify.dll
Located: System.ini, termsrv
command: wlnotify.dll
file: wlnotify.dll
Located: System.ini, wlballoon
command: wlnotify.dll
file: wlnotify.dll
--- Browser helper object list ---
{7E853D72-626A-48EC-A868-BA8D5E23E045} ()
BHO name:
CLSID name:
--- ActiveX list ---
Pebble Beach Golf by pogo (Pebble Beach Golf by pogo)
DPF name: Pebble Beach Golf by pogo
CLSID name:
Installer:
Codebase: http://game1.pogo.com/applet-8.0.3.20/pebble/pebble-en_US.cab
{3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class)
DPF name:
CLSID name: WebGameLoader Class
Installer: C:\WINDOWS\Downloaded Program Files\ReflexiveWebGameLoader.INF
Codebase: http://www.miniclip.com/games/ricochet-lost-worlds/en/ReflexiveWebGameLoader.cab
description:
classification: Confirmed as malware
known filename: ReflexiveWebGameLoader.dll
info link:
info source: Safer Networking Ltd.
Path: C:\WINDOWS\Downloaded Program Files\
Long name: ReflexiveWebGameLoader.dll
Short name: REFLEX~1.DLL
Date (created): 9/10/2004 2:52:42 PM
Date (last access): 7/3/2007 9:06:30 PM
Date (last write): 9/10/2004 2:52:42 PM
Filesize: 139264
Attributes: archive
MD5: 8FFB6E04EF5D6CA711D073C2FDFA79F5
CRC32: 5C9ED4AF
Version: 1.0.0.15
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0)
DPF name: Java Runtime Environment 1.5.0
CLSID name: Java Plug-in 1.5.0_11
Installer:
Codebase: http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
Path: C:\Program Files\Java\jre1.5.0_11\bin\
Long name: NPJPI150_11.dll
Short name: NPJPI1~1.DLL
Date (created): 12/15/2006 4:09:16 AM
Date (last access): 7/3/2007 9:19:38 PM
Date (last write): 12/15/2006 4:23:26 AM
Filesize: 75528
Attributes: archive
MD5: 3B3F6984DBF972DAFF1B7E9C44E2FE75
CRC32: 4BDE2041
Version: 5.0.110.3
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_01
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_01\bin\
Long name: npjpi160_01.dll
Short name: NPJPI1~1.DLL
Date (created): 3/14/2007 2:04:46 AM
Date (last access): 7/3/2007 9:19:40 PM
Date (last write): 3/14/2007 3:43:42 AM
Filesize: 132760
Attributes: archive
MD5: F112FB2FD2EF66D439799E3F834DF000
CRC32: D2B09219
Version: 6.0.0.6
--- Process list ---
PID: 0 ( 0) [System]
PID: 736 ( 4) \SystemRoot\System32\smss.exe
PID: 1048 ( 736) \??\C:\WINDOWS\system32\csrss.exe
PID: 1216 ( 736) \??\C:\WINDOWS\system32\winlogon.exe
PID: 1392 (1216) C:\WINDOWS\system32\services.exe
size: 108032
MD5: C6CE6EEC82F187615D1002BB3BB50ED4
PID: 1452 (1216) C:\WINDOWS\system32\lsass.exe
size: 13312
MD5: 84885F9B82F4D55C6146EBF6065D75D2
PID: 2020 (1392) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 444 (1392) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 780 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 964 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1408 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1856 (1392) C:\WINDOWS\system32\spoolsv.exe
size: 57856
MD5: 7435B108B935E42EA92CA94F59C8E717
PID: 2036 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
size: 813840
MD5: 239ACDD3FD129E70C350203B9D09CECF
PID: 176 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
size: 146192
MD5: 4DD0E27896136CB0F45D4F0058F6F9BA
PID: 604 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
size: 275976
MD5: 666F838179679ED17B2D607CEB88B122
PID: 648 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
size: 1035024
MD5: 3B65898B441B3FB500676255AE65A812
PID: 1692 (1392) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
size: 144960
MD5: C808BF6B4CC562A97034D850EB932CE9
PID: 1888 (1392) C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
size: 280080
MD5: 4CEBA70620BA3FE8C836E06AC20F469E
PID: 252 (1460) C:\WINDOWS\Explorer.EXE
size: 1032192
MD5: A0732187050030AE399B241436565E64
PID: 512 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1232 (1392) C:\WINDOWS\system32\nvsvc32.exe
size: 159810
MD5: 0FEBE37DB6650FAA5965C00545009D1D
PID: 748 (1392) C:\WINDOWS\system32\wdfmgr.exe
size: 38912
MD5: AB0A7CA90D9E3D6A193905DC1715DED0
PID: 960 (1536) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1100 ( 648) C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
size: 181776
MD5: 17B45B5418AA6F952B481BF140C0A22D
PID: 828 (1392) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
size: 243216
MD5: CFD5AEC00FBE544B442569E0ADD87150
PID: 272 (1392) C:\WINDOWS\System32\alg.exe
size: 44544
MD5: F1958FBF86D5C004CF19A5951A9514B7
PID: 3960 ( 252) C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
size: 177680
MD5: CACC8671C3D62EB8DC145BB6CFB5738E
PID: 3988 ( 252) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
size: 230928
MD5: FD7D8B5D4728859001C10644F30C06C6
PID: 2212 ( 252) C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
size: 83608
MD5: 9C1C80BBF8E6044980890E2D2D91091C
PID: 2988 ( 252) C:\Program Files\Messenger\msmsgs.exe
size: 1667584
MD5: B53343FE60A33EE765C2476D50D27B26
PID: 2992 (3960) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
size: 218640
MD5: 992CE2936AD7DFBD3325CF2BD91E0A6F
PID: 2260 (1392) C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
size: 214544
MD5: C75DAFBB829334AA29092DE10EC6ACBF
PID: 3628 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1708 ( 252) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 4393096
MD5: 09CA174A605B480318731E691DC98539
PID: 3280 ( 252) C:\Program Files\Maxthon\Maxthon.exe
size: 884224
MD5: 208B36A5567BB7140A1ABAEA32FB9F38
PID: 4 ( 0) System
--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 7/3/2007 9:29:57 PM
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.google.com/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
--- Winsock Layered Service Provider list ---
Protocol 0: CA ISafe LSP over [MSAFD Tcpip [TCP/IP]]
GUID: {EC5B19B8-1CED-4BE5-8D43-C29B23F7120E}
Filename: C:\WINDOWS\system32\VetRedir.dll
Protocol 1: CA ISafe LSP over [MSAFD Tcpip [UDP/IP]]
GUID: {EC5B19B8-1CED-4BE5-8D43-C29B23F7120E}
Filename: C:\WINDOWS\system32\VetRedir.dll
Protocol 2: CA ISafe LSP over [MSAFD Tcpip [RAW/IP]]
GUID: {EC5B19B8-1CED-4BE5-8D43-C29B23F7120E}
Filename: C:\WINDOWS\system32\VetRedir.dll
Protocol 8: CA ISafe LSP
GUID: {AE2578B4-F478-4313-9A3E-1B83F7A643DF}
Filename: C:\WINDOWS\system32\VetRedir.dll
Did the safe mode thing, did the online scan.
Online scan found nothing.
Safe mode deleted it, but upon reboot it was back.
here's my SD report:
Part1
--- Search result list ---
Torpig: Temporary file (File, nothing done)
C:\WINDOWS\Temp\$_2341234.TMP
Torpig: Temporary file (File, nothing done)
C:\WINDOWS\Temp\$_2341233.TMP
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2007-07-03 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-05-23 advcheck.dll (1.5.3.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-01-02 Tools.dll (2.0.1.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-07-03 Includes\Cookies.sbi (*)
2007-05-30 Includes\Dialer.sbi (*)
2007-07-03 Includes\DialerC.sbi (*)
2007-06-20 Includes\Hijackers.sbi (*)
2007-07-03 Includes\HijackersC.sbi (*)
2007-06-27 Includes\Keyloggers.sbi (*)
2007-07-03 Includes\KeyloggersC.sbi (*)
2007-06-20 Includes\Malware.sbi (*)
2007-07-03 Includes\MalwareC.sbi (*)
2007-03-21 Includes\PUPS.sbi (*)
2007-07-03 Includes\PUPSC.sbi (*)
2007-07-03 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-07-03 Includes\SecurityC.sbi (*)
2007-06-20 Includes\Spybots.sbi (*)
2007-07-03 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2007-07-03 Includes\Trojans.sbi (*)
2007-07-03 Includes\TrojansC.sbi (*)
2007-06-06 Plugins\TCPIPAddress.dll
--- System information ---
Windows XP (Build: 2600) Service Pack 2
/ Windows XP / SP2: Windows XP Service Pack 2
/ Windows XP / SP3: Windows Installer 3.1 (KB893803)
/ XML Paper Specification Shared Components Pack 1.0: XML Paper Specification Shared Components Pack 1.0
--- Startup entries list ---
Located: HK_LM:Run, CAVRID
command: "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
file: C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
size: 230928
MD5: fd7d8b5d4728859001c10644f30c06c6
Located: HK_LM:Run, cctray
command: "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
file: C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
size: 177680
MD5: cacc8671c3d62eb8dc145bb6cfb5738e
Located: HK_LM:Run, NeroFilterCheck
command: C:\WINDOWS\system32\NeroCheck.exe
file: C:\WINDOWS\system32\NeroCheck.exe
size: 155648
MD5: 3e4c03cefad8de135263236b61a49c90
Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
file: C:\WINDOWS\system32\RUNDLL32.EXE
size: 33280
MD5: da285490bbd8a1d0ce6623577d5ba1ff
Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
file: C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
size: 83608
MD5: 9c1c80bbf8e6044980890e2d2d91091c
Located: HK_CU:Run, MSMSGS
command: "C:\Program Files\Messenger\msmsgs.exe" /background
file: C:\Program Files\Messenger\msmsgs.exe
size: 1667584
MD5: b53343fe60a33ee765c2476d50d27b26
Located: Startup (common), Microsoft Office.lnk
command: C:\Program Files\Microsoft Office\Office\OSA9.EXE
file: C:\Program Files\Microsoft Office\Office\OSA9.EXE
size: 65588
MD5: 57cb86b1cdd77eb5138ba05d1f193463
Located: System.ini, crypt32chain
command: crypt32.dll
file: crypt32.dll
Located: System.ini, cryptnet
command: cryptnet.dll
file: cryptnet.dll
Located: System.ini, cscdll
command: cscdll.dll
file: cscdll.dll
Located: System.ini, PFW
command: UmxWnp.Dll
file: UmxWnp.Dll
Located: System.ini, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
Located: System.ini, Schedule
command: wlnotify.dll
file: wlnotify.dll
Located: System.ini, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
Located: System.ini, SensLogn
command: WlNotify.dll
file: WlNotify.dll
Located: System.ini, termsrv
command: wlnotify.dll
file: wlnotify.dll
Located: System.ini, wlballoon
command: wlnotify.dll
file: wlnotify.dll
--- Browser helper object list ---
{7E853D72-626A-48EC-A868-BA8D5E23E045} ()
BHO name:
CLSID name:
--- ActiveX list ---
Pebble Beach Golf by pogo (Pebble Beach Golf by pogo)
DPF name: Pebble Beach Golf by pogo
CLSID name:
Installer:
Codebase: http://game1.pogo.com/applet-8.0.3.20/pebble/pebble-en_US.cab
{3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class)
DPF name:
CLSID name: WebGameLoader Class
Installer: C:\WINDOWS\Downloaded Program Files\ReflexiveWebGameLoader.INF
Codebase: http://www.miniclip.com/games/ricochet-lost-worlds/en/ReflexiveWebGameLoader.cab
description:
classification: Confirmed as malware
known filename: ReflexiveWebGameLoader.dll
info link:
info source: Safer Networking Ltd.
Path: C:\WINDOWS\Downloaded Program Files\
Long name: ReflexiveWebGameLoader.dll
Short name: REFLEX~1.DLL
Date (created): 9/10/2004 2:52:42 PM
Date (last access): 7/3/2007 9:06:30 PM
Date (last write): 9/10/2004 2:52:42 PM
Filesize: 139264
Attributes: archive
MD5: 8FFB6E04EF5D6CA711D073C2FDFA79F5
CRC32: 5C9ED4AF
Version: 1.0.0.15
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0)
DPF name: Java Runtime Environment 1.5.0
CLSID name: Java Plug-in 1.5.0_11
Installer:
Codebase: http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
Path: C:\Program Files\Java\jre1.5.0_11\bin\
Long name: NPJPI150_11.dll
Short name: NPJPI1~1.DLL
Date (created): 12/15/2006 4:09:16 AM
Date (last access): 7/3/2007 9:19:38 PM
Date (last write): 12/15/2006 4:23:26 AM
Filesize: 75528
Attributes: archive
MD5: 3B3F6984DBF972DAFF1B7E9C44E2FE75
CRC32: 4BDE2041
Version: 5.0.110.3
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_01
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_01\bin\
Long name: npjpi160_01.dll
Short name: NPJPI1~1.DLL
Date (created): 3/14/2007 2:04:46 AM
Date (last access): 7/3/2007 9:19:40 PM
Date (last write): 3/14/2007 3:43:42 AM
Filesize: 132760
Attributes: archive
MD5: F112FB2FD2EF66D439799E3F834DF000
CRC32: D2B09219
Version: 6.0.0.6
--- Process list ---
PID: 0 ( 0) [System]
PID: 736 ( 4) \SystemRoot\System32\smss.exe
PID: 1048 ( 736) \??\C:\WINDOWS\system32\csrss.exe
PID: 1216 ( 736) \??\C:\WINDOWS\system32\winlogon.exe
PID: 1392 (1216) C:\WINDOWS\system32\services.exe
size: 108032
MD5: C6CE6EEC82F187615D1002BB3BB50ED4
PID: 1452 (1216) C:\WINDOWS\system32\lsass.exe
size: 13312
MD5: 84885F9B82F4D55C6146EBF6065D75D2
PID: 2020 (1392) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 444 (1392) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 780 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 964 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1408 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1856 (1392) C:\WINDOWS\system32\spoolsv.exe
size: 57856
MD5: 7435B108B935E42EA92CA94F59C8E717
PID: 2036 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
size: 813840
MD5: 239ACDD3FD129E70C350203B9D09CECF
PID: 176 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
size: 146192
MD5: 4DD0E27896136CB0F45D4F0058F6F9BA
PID: 604 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
size: 275976
MD5: 666F838179679ED17B2D607CEB88B122
PID: 648 (1392) C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
size: 1035024
MD5: 3B65898B441B3FB500676255AE65A812
PID: 1692 (1392) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
size: 144960
MD5: C808BF6B4CC562A97034D850EB932CE9
PID: 1888 (1392) C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
size: 280080
MD5: 4CEBA70620BA3FE8C836E06AC20F469E
PID: 252 (1460) C:\WINDOWS\Explorer.EXE
size: 1032192
MD5: A0732187050030AE399B241436565E64
PID: 512 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1232 (1392) C:\WINDOWS\system32\nvsvc32.exe
size: 159810
MD5: 0FEBE37DB6650FAA5965C00545009D1D
PID: 748 (1392) C:\WINDOWS\system32\wdfmgr.exe
size: 38912
MD5: AB0A7CA90D9E3D6A193905DC1715DED0
PID: 960 (1536) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1100 ( 648) C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
size: 181776
MD5: 17B45B5418AA6F952B481BF140C0A22D
PID: 828 (1392) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
size: 243216
MD5: CFD5AEC00FBE544B442569E0ADD87150
PID: 272 (1392) C:\WINDOWS\System32\alg.exe
size: 44544
MD5: F1958FBF86D5C004CF19A5951A9514B7
PID: 3960 ( 252) C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
size: 177680
MD5: CACC8671C3D62EB8DC145BB6CFB5738E
PID: 3988 ( 252) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
size: 230928
MD5: FD7D8B5D4728859001C10644F30C06C6
PID: 2212 ( 252) C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
size: 83608
MD5: 9C1C80BBF8E6044980890E2D2D91091C
PID: 2988 ( 252) C:\Program Files\Messenger\msmsgs.exe
size: 1667584
MD5: B53343FE60A33EE765C2476D50D27B26
PID: 2992 (3960) C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
size: 218640
MD5: 992CE2936AD7DFBD3325CF2BD91E0A6F
PID: 2260 (1392) C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
size: 214544
MD5: C75DAFBB829334AA29092DE10EC6ACBF
PID: 3628 (1392) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 8F078AE4ED187AAABC0A305146DE6716
PID: 1708 ( 252) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 4393096
MD5: 09CA174A605B480318731E691DC98539
PID: 3280 ( 252) C:\Program Files\Maxthon\Maxthon.exe
size: 884224
MD5: 208B36A5567BB7140A1ABAEA32FB9F38
PID: 4 ( 0) System
--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 7/3/2007 9:29:57 PM
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.google.com/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
--- Winsock Layered Service Provider list ---
Protocol 0: CA ISafe LSP over [MSAFD Tcpip [TCP/IP]]
GUID: {EC5B19B8-1CED-4BE5-8D43-C29B23F7120E}
Filename: C:\WINDOWS\system32\VetRedir.dll
Protocol 1: CA ISafe LSP over [MSAFD Tcpip [UDP/IP]]
GUID: {EC5B19B8-1CED-4BE5-8D43-C29B23F7120E}
Filename: C:\WINDOWS\system32\VetRedir.dll
Protocol 2: CA ISafe LSP over [MSAFD Tcpip [RAW/IP]]
GUID: {EC5B19B8-1CED-4BE5-8D43-C29B23F7120E}
Filename: C:\WINDOWS\system32\VetRedir.dll
Protocol 8: CA ISafe LSP
GUID: {AE2578B4-F478-4313-9A3E-1B83F7A643DF}
Filename: C:\WINDOWS\system32\VetRedir.dll