1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

ADW RELEVANT.A This one has got me stumped (HiJack This included)

Discussion in 'Windows - Virus and spyware problems' started by coolGray, Dec 21, 2007.

  1. coolGray

    coolGray Regular member

    Joined:
    Mar 5, 2006
    Messages:
    292
    Likes Received:
    0
    Trophy Points:
    26
    Ok, so my PC Cillin keeps picking up instances of ADW RELEVANT.A and i cant figure out how to fix it. Has anyone heard of this bug? its annoying.

    eckard's System Scanner v20070708.52
    Run by Gray Lane on 2007-12-21 at 19:58:45
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------



    -- HijackThis (run as Gray Lane.exe) -------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:58:46 PM, on 12/21/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Google\Gmail Notifier\gnotify.exe
    C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\ehome\RMSysTry.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\WINDOWS\ehome\RMSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\FirstClass\fcc32.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Gray Lane\Desktop\computer safety\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\GRAYLA~1.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061122
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061122
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
    O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    --
    End of file - 7270 bytes

    -- Files created between 2007-11-21 and 2007-12-21 -----------------------------

    2007-12-21 13:49:50 0 d-------- C:\Program Files\PeerGuardian2
    2007-12-20 22:47:34 0 d-------- C:\WINDOWS\LastGood
    2007-12-18 20:57:43 0 dr-h----- C:\Documents and Settings\Gray Lane\Recent
    2007-12-11 20:16:55 0 d-------- C:\Program Files\Ares
    2007-12-09 17:01:16 0 d-------- C:\Program Files\Linksys EasyLink Advisor
    2007-11-29 21:02:29 0 d-------- C:\Program Files\Microsoft IntelliPoint
    2007-11-29 17:57:54 0 d-------- C:\Documents and Settings\Gray Lane\Application Data\Kensington
    2007-11-29 16:28:49 1098 --a------ C:\WINDOWS\checkip.dat
    2007-11-29 16:24:20 1471 --a------ C:\WINDOWS\ipconfig.dat
    2007-11-23 17:50:15 2849886 --a------ C:\Documents and Settings\Gray Lane\Shared
    2007-11-21 00:43:49 0 d-------- C:\Documents and Settings\Gray Lane\Application Data\Flock
    2007-11-21 00:42:27 0 d-------- C:\Program Files\Flock


    -- Find3M Report ---------------------------------------------------------------

    2007-12-21 17:02:18 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2007-12-21 16:58:39 0 d-------- C:\Program Files\Norton Security Scan
    2007-12-06 09:42:36 0 d-------- C:\Program Files\Google
    2007-11-29 17:55:50 0 d--h----- C:\Program Files\InstallShield Installation Information
    2007-11-28 06:26:41 0 d-------- C:\Documents and Settings\Gray Lane\Application Data\uTorrent
    2007-11-26 17:44:03 0 d-------- C:\Program Files\CamStudio
    2007-11-25 18:45:48 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
    2007-11-15 17:39:50 335427 --a------ C:\WINDOWS\hpoins14.dat
    2007-11-15 17:22:00 0 d-------- C:\Program Files\HP
    2007-11-15 17:21:48 0 d-------- C:\Documents and Settings\Gray Lane\Application Data\HPAppData
    2007-11-15 17:19:41 0 d-------- C:\Program Files\Common Files\HP
    2007-11-15 17:19:13 0 d-------- C:\Program Files\Hewlett-Packard
    2007-11-15 17:18:54 0 d-------- C:\Program Files\Common Files\Hewlett-Packard
    2007-11-15 03:10:00 0 d-------- C:\Program Files\Wisdom-soft AutoScreenRecorder Free
    2007-11-09 23:44:55 0 d-------- C:\Documents and Settings\Gray Lane\Application Data\Orbit
    2007-11-09 21:53:54 0 d-------- C:\Program Files\iTunes
    2007-11-09 21:53:42 0 d-------- C:\Program Files\iPod
    2007-11-09 21:52:09 0 d-------- C:\Program Files\QuickTime
    2007-11-04 13:24:54 0 d-------- C:\Program Files\MSN Messenger


    -- Registry Dump ---------------------------------------------------------------

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {0347C33E-8762-4905-BF09-768834316C61} C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
    {053F9267-DC04-4294-A72C-58F732D338C0} C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    {5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    {CA6319C0-31B7-401E-A518-A07C3DB8F777} C:\Program Files\BAE\BAE.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "SigmatelSysTrayApp"="stsystra.exe"
    "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
    "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
    "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
    "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"
    "Picasa Media Detector"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"
    "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
    "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\""
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
    "OE_OEM"="\"C:\\Program Files\\Trend Micro\\Internet Security 12\\TMAS_OE\\TMAS_OEMon.exe\""
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
    "EasyLinkAdvisor"="\"C:\\Program Files\\Linksys EasyLink Advisor\\LinksysAgent.exe\" /startup"
    "ares"="\"C:\\Program Files\\Ares\\Ares.exe\" -h"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
    63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
    6d,73,73,74,79,6c,65,73,00
    "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
    73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
    Authentication Packages REG_MULTI_SZ msv1_0\0\0
    Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
    Notification Packages REG_MULTI_SZ scecli\0\0


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk"
    "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
    "location"="Common Startup"
    "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
    "item"="Adobe Reader Speed Launch"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
    "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Google Updater.lnk"
    "backup"="C:\\WINDOWS\\pss\\Google Updater.lnkCommon Startup"
    "location"="Common Startup"
    "command"="C:\\PROGRA~1\\Google\\GOOGLE~4\\GOOGLE~1.EXE -systray -startup"
    "item"="Google Updater"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="aim6"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="WLTRAY"
    "hkey"="HKLM"
    "command"="C:\\WINDOWS\\system32\\WLTRAY.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="quickset"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellHelp]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="DellHelp"
    "hkey"="HKLM"
    "command"="C:\\Dell\\DellHelp\\DellHelp.exe /c"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="ehtray"
    "hkey"="HKLM"
    "command"="C:\\WINDOWS\\ehome\\ehtray.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="ezprint"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Lexmark 3400 Series\\ezprint.exe\""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="fm3032"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Lexmark Fax Solutions\\fm3032.exe\" /s"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="iTunesHelper"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="netWaiting"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\NetWaiting\\netWaiting.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="msmsgs"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="pccguide"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Trend Micro\\Internet Security 12\\pccguide.exe\""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="qttask"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="SDTrayApp"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Spyware Doctor\\SDTrayApp.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    "item"="GoogleToolbarNotifier"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "wltrysvc"=dword:00000002
    "SQLAgent$MICROSOFTSMLBIZ"=dword:00000003
    "ose"=dword:00000003
    "MSSQLServerADHelper"=dword:00000003
    "MSSQL$MICROSOFTSMLBIZ"=dword:00000002
    "MDM"=dword:00000002
    "iPod Service"=dword:00000003
    "Ati HotKey Poller"=dword:00000002
    "Apple Mobile Device"=dword:00000002

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
    HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
    LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService REG_MULTI_SZ DnsCache\0\0
    DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
    rpcss REG_MULTI_SZ RpcSs\0\0
    imgsvc REG_MULTI_SZ StiSvc\0\0
    termsvcs REG_MULTI_SZ TermService\0\0
    QWAVE REG_MULTI_SZ QWAVE\0\0
    WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12\0Net Driver HPZ12\0\0
    hpdevmgmt REG_MULTI_SZ hpqcxs08\0hpqddsvc\0\0


    [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
    Shell\AutoRun\command E:\setup.exe
    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_ERASERUTILDRVI4


    -- End of Deckard's System Scanner: finished at 2007-12-21 at 19:59:25 ---------
     
  2. QuikDraw

    QuikDraw Regular member

    Joined:
    Sep 29, 2007
    Messages:
    827
    Likes Received:
    0
    Trophy Points:
    26
    Here's two entries in your report which can be removed.
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    ADW RELEVANT.A
    Adware.RelevantKnowledge
    C:\WINDOWS\system32\swreg.exe
    Generic Malware
     
  3. coolGray

    coolGray Regular member

    Joined:
    Mar 5, 2006
    Messages:
    292
    Likes Received:
    0
    Trophy Points:
    26
    Ok, thank you very much for the response. Is there a specific method i should use to delete this items?

    I'm sorry, i a bit of an amateur.
     
  4. QuikDraw

    QuikDraw Regular member

    Joined:
    Sep 29, 2007
    Messages:
    827
    Likes Received:
    0
    Trophy Points:
    26
    Run HijackThis! Click "Scan." Place checks next to the following entries.

    O4 - Global Startup: Digital Line Detect.lnk = ?

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

    click, Fix Checked.

    Your using IE6, try IE7, much better, it's a tab browser! Here's the link. http://www.microsoft.com/windows/products/winfamily/ie/default.mspx

    Next, we'll work at removing this:

    ADW RELEVANT.A
    Adware.RelevantKnowledge
    C:\WINDOWS\system32\swreg.exe
    Generic Malware

    Download SuperAntiSpyware Free Home Edition. Open Program>Select Scan Your Computer>Perform Complete Scan. After the scan has completed. Make sure all items are checked for removal. See if this is in the list. C:\WINDOWS\system32\swreg.exe
    Click Next, and the program will fix the selected items. Reboot the computer and see if the infection is gone.
     
    Last edited: Dec 23, 2007
  5. coolGray

    coolGray Regular member

    Joined:
    Mar 5, 2006
    Messages:
    292
    Likes Received:
    0
    Trophy Points:
    26
    Thanks for the reply!

    I think i got rid of the bug last night. See, i thought i had but i hadnt turned off system restore so it kept popping up anyway. I turned it off and i think that its gone for good.

    Thank you for helping me with Hijack this, how ever trend micro is my antivirus so idk if i want to delete that entry?

    Im running the anti-spyware proggy right now, ill post back if anything happens. Thank you for helping me!
     
  6. QuikDraw

    QuikDraw Regular member

    Joined:
    Sep 29, 2007
    Messages:
    827
    Likes Received:
    0
    Trophy Points:
    26
    LOL Glad you were able solve your problem.

    Merry Christmas!
     
  7. coolGray

    coolGray Regular member

    Joined:
    Mar 5, 2006
    Messages:
    292
    Likes Received:
    0
    Trophy Points:
    26
    yea, you too!
     

Share This Page