C:\WINDOWS\system32\drivers\acpi32.sys gett this error when i start up the girlfriends laptop Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:46:37, on 23/12/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\pctspk.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\htpatch.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\StkASv2K.exe C:\WINDOWS\System32\khooker.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe O4 - HKCU\..\Run: [Kathriona Connolly] C:\Documents and Settings\Kathriona Connolly\Kathriona Connolly.exe /i O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000046.000000b5 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM') O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user') O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.iqon.ie O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpqdktp/downloads/sysinfo.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.carzone.ie/my/aurigma/ImageUploader4.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe -- End of file - 8391 bytes thanks and merry xmas
Hi 07anto07, Hack, Hack, Hack. Your girlfriends computer has its cup running over with malware and Trojans. Start like this and we’ll see just how much of it we can remove on the first trip… Download Malwarebytes' Anti-Malware to your desktop. Double-click mbam-setup.exe and follow the prompts to install the program. • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. • If an update is found, it will download and install the latest version. • Once the program has loaded, select Perform full scan, then click Scan. • When the scan is complete, click OK, then Show Results to view the results. • Make sure that everything is checked, and click Remove Selected. <-- Don't forget this. • When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt • Please post the MBAM Log and a fresh HJT Log in your next reply. If you are unable to download or update MBAM in Normal Mode then use Safe Mode with Networking: Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and before the Windows icon appears press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode with Networking" and complete the above instructions. 2OG
happy new year Malwarebytes' Anti-Malware 1.31 Database version: 1590 Windows 5.1.2600 Service Pack 3 02/01/2009 00:09:08 mbam-log-2009-01-02 (00-09-07).txt Scan type: Full Scan (C:\|) Objects scanned: 151591 Time elapsed: 1 hour(s), 37 minute(s), 26 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore{4A432446-4116-4BED-86F7-8BE6BF31E469}\RP445\A0111772.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{4A432446-4116-4BED-86F7-8BE6BF31E469}\RP447\A0112790.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:12:00, on 02/01/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\htpatch.exe C:\WINDOWS\System32\khooker.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\StkASv2K.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Kathriona Connolly] C:\Documents and Settings\Kathriona Connolly\Kathriona Connolly.exe /i O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000046.000000b5 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM') O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user') O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.iqon.ie O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpqdktp/downloads/sysinfo.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.carzone.ie/my/aurigma/ImageUploader4.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe -- End of file - 8440 bytes
07anto07, That got a little of it, let’s see if we can get some more…… Please download and install SUPERAntiSpyware Free • Double-click SUPERAntiSypware.exe and use the default settings for installation. • An icon will be created on your desktop. Double-click that icon to launch the program. • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.) • Under the "Configuration and Preferences", click the Preferences... button. • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked. • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked): o Close browsers before scanning. o Scan for tracking cookies. o Terminate memory threats before quarantining. • Click the "Close" button to leave the control center screen and exit the program. • Do not run a scan just yet. Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and before the Windows icon appears press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". Scan with SUPERAntiSpyware as follows: • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer. • On the left, make sure you check C:\Fixed Drive. • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next". • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". • Make sure everything has a checkmark next to it and click "Next". • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. • If asked if you want to reboot, click "Yes" and reboot normally. • To retrieve the removal information after reboot, launch SUPERAntispyware again. o Click Preferences, then click the Statistics/Logs tab. o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. o Please copy and paste the Scan Log results in your next reply. • Click Close to exit the program. Reboot to Normal Mode Please post the SUPERAntiSpyware Log and a fresh HijackThis log in your next reply. 2OG
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:50:18, on 04/01/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\StkASv2K.exe C:\WINDOWS\htpatch.exe C:\WINDOWS\System32\khooker.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Kathriona Connolly] C:\Documents and Settings\Kathriona Connolly\Kathriona Connolly.exe /i O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000046.000000b5 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM') O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user') O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.iqon.ie O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpqdktp/downloads/sysinfo.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.carzone.ie/my/aurigma/ImageUploader4.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe -- End of file - 8174 bytes SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 01/02/2009 at 10:06 PM Application Version : 4.24.1004 Core Rules Database Version : 3693 Trace Rules Database Version: 1669 Scan type : Complete Scan Total Scan Time : 02:01:16 Memory items scanned : 179 Memory threats detected : 0 Registry items scanned : 7154 Registry threats detected : 0 File items scanned : 27246 File threats detected : 145 Adware.Tracking Cookie C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.bittorrent[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@mediaplex[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@tribalfusion[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@specificclick[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@serving-sys[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.adlabmedia[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@122.2o7[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@lenovo.112.2o7[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adviva[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@eyewonder[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@indextools[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@videoegg.adbureau[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@richmedia.yahoo[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@pcstats[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@overture[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@indexstats[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ad2.eurobb[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ad2.pl.mediainter[3].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@watchmyclicks[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@server.iad.liveperson[3].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ehg-upcchellomedia.hitbox[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@partypoker[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@chitika[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@optimize.indieclick[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@zedo[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@atdmt[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@bluestreak[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ehg-hibernian.hitbox[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@tracker.elektronik[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.intelli-tracker[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adtech[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@statse.webtrendslive[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.ookla[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@int.sitestat[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adrevolver[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adstats.cdfreaks[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ehg-systemax.hitbox[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@fastclick[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ad.adocean[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@stats.gamestop[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@statcounter[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@media.adrevolver[3].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@server.iad.liveperson[4].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ad1.clickhype[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ad.yieldmanager[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@counter.hitslink[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.pointroll[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@gostats[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@e-2dj6wclyuoazogo.stats.esomniture[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.addesktop[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@yadro[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.techguy[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.digital-digest[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@e-2dj6wclysldpgao.stats.esomniture[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@msnportal.112.2o7[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adinterax[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@imrworldwide[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.eircom[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@revsci[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ad2.pl.mediainter[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.pcstats[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.lucidmedia[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@everyclick[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adbrite[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@questionmarket[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@2o7[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@xiti[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@atwola[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@clicktorrent[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adopt.euroclick[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@advertising[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adv.gamerzhut[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@doubleclick[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@bs.serving-sys[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@microsoftwindows.112.2o7[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@kontera[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@paypal.112.2o7[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@toplist[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@media.adrevolver[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@tacoda[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@insightexpressai[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ehg-foxmovies.hitbox[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@apmebf[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@tradedoubler[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@valueclick[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.etracker[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ie-stat.bmmetrix[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@247realmedia[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.contextual.ad-flow[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www6.addfreestats[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.clicksor[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@internetworldstats[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@metacafe.122.2o7[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@b5media[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@media6degrees[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@weborama[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.adap[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.googleadservices[5].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@112.2o7[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@data.coremetrics[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.monster[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.googleadservices[10].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@quick-scanner[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@sourcetracker.co[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@stats.paypal[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.internetworldstats[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@collective-media[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@hotlog[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@partyaccount[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@tracking.summitmedia.co[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@trackmon.itor[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ehg-rodale.hitbox[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.eircom[3].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@uk.sitestat[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adserver.adtechus[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@dynamic.media.adrevolver[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@hitbox[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@profiles.hitslink[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adserver.adreactor[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ehg-nokiafin.hitbox[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@linksynergy[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@adserver.easyad[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@e-2dj6wbloskdpccp.stats.esomniture[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ufindus[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ads.nebuadserving[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@server.iad.liveperson[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@server.lon.liveperson[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@e-2dj6wdk4whd5efp.stats.esomniture[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.googleadservices[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@ehg-autotrader.hitbox[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@hearstdigital.122.2o7[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@maxis.112.2o7[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@secure.partyaccount[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@bannersng.yell[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@casalemedia[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@server.lon.liveperson[3].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.googleadservices[4].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@aib.112.2o7[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@videofreeforonline[1].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.googleadservices[2].txt C:\Documents and Settings\Kathriona Connolly\Cookies\kathriona_connolly@www.googleadservices[3].txt Trojan.WinAntiSpyware/WinAntiVirus 2006 C:\DOCUMENTS AND SETTINGS\KATHRIONA CONNOLLY\LOCAL SETTINGS\TEMP\~WA6PSETUP.EXE Unclassified.Unknown Origin/System C:\NEWDRV\ESBFIX\4MTCSB.EXE Rootkit.Agent/Gen-I386SI C:\SYSTEM VOLUME INFORMATION\_RESTORE{4A432446-4116-4BED-86F7-8BE6BF31E469}\RP453\A0119797.SYS Trace.Known Threat Sources C:\Documents and Settings\Kathriona Connolly\Local Settings\Temporary Internet Files\Content.IE5\2CK34V3W\of_zango_728x90_08_britney[1].swf
07anto07, There are still a couple of nasty signs in your log. I had rather use a program to remove them than try to dig them out manually. 1. Download Combo fix from one of these locations. * IMPORTANT !!! Place combofix.exe on your Desktop http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://subs.geekstogo.com/ComboFix.exe 2. Click start > run and Copy and Paste this in exactly, using the picture below for reference, then click OK. 3. Combo will begin to run DO NOTHING while this is happening. • It will kill a few processes and disconnect you from the internet. • If by chance it stops prematurely you can re-establish your internet connection by restarting your computer. • This needs to be done so the program can work most efficiently for you. Do not attempt to use the internet or anything else while it's doing its job for you. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. If when it's completed you can not get on the internet just reboot the computer Post the log from comboFix for me located in c:\comboFix.txt Also a fresh HJT Log.. 2OG
ComboFix 09-01-05.02 - Kathriona Connolly 2009-01-05 20:51:15.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.353.1033.18.223.65 [GMT 0:00] Running from: c:\documents and settings\Kathriona Connolly\desktop\combofix.exe Command switches used :: /killall AV: avast! antivirus 4.7.1098 [VPS 090105-0] *On-access scanning enabled* (Updated) * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\stera.log c:\windows\Sysvxd.exe . ((((((((((((((((((((((((( Files Created from 2008-12-05 to 2009-01-05 ))))))))))))))))))))))))))))))) . 2009-01-02 19:37 . 2009-01-02 19:37 <DIR> d-------- c:\program files\SUPERAntiSpyware 2009-01-02 19:37 . 2009-01-02 19:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-01-02 19:36 . 2009-01-02 19:36 <DIR> d-------- c:\documents and settings\Kathriona Connolly\Application Data\SUPERAntiSpyware.com 2009-01-02 00:09 . 2009-01-02 00:09 61,440 --a------ c:\windows\system32\drivers\aowjxuc.sys 2009-01-01 22:29 . 2009-01-01 22:29 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-01 22:29 . 2009-01-01 22:29 <DIR> d-------- c:\documents and settings\Kathriona Connolly\Application Data\Malwarebytes 2009-01-01 22:29 . 2009-01-01 22:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-01 22:29 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-01 22:29 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-12-24 02:12 . 2008-12-24 02:12 296 --a------ c:\windows\system32\MRT.INI 2008-12-23 23:45 . 2008-12-23 23:45 <DIR> d-------- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 28980-02-04 05:32 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\InterTrust 28980-02-04 05:32 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\CyberLink 28980-02-04 05:32 --------- d-----w c:\program files\Synaptics 28980-02-04 05:32 --------- d-----w c:\program files\SiSLan 28980-02-04 05:32 --------- d-----w c:\program files\SiS Compatible VGA V2.14a 28980-02-04 05:32 --------- d-----w c:\program files\CyberLink 28980-02-04 05:32 --------- d-----w c:\documents and settings\Kathriona Connolly\Application Data\InterTrust 28980-02-04 05:32 --------- d-----w c:\documents and settings\Kathriona Connolly\Application Data\CyberLink 28980-02-04 05:32 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink 2009-01-05 18:13 --------- d-----w c:\documents and settings\Kathriona Connolly\Application Data\skypePM 2009-01-02 23:00 --------- d-----w c:\program files\Common Files\Ahead 2009-01-02 22:53 --------- d-----w c:\program files\Panasonic 2009-01-02 22:52 --------- d-----w c:\program files\Winamp 2009-01-02 22:52 --------- d-----w c:\documents and settings\Kathriona Connolly\Application Data\Panasonic 2009-01-02 22:33 10,646 ----a-w c:\documents and settings\Kathriona Connolly\Application Data\wklnhst.dat 2009-01-02 19:35 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-25 16:47 --------- d-----w c:\documents and settings\Kathriona Connolly\Application Data\Skype 2008-12-24 02:12 30,080 ----a-w c:\windows\system32\drivers\Winns04.sys 2008-12-03 01:30 96,384 ----a-w c:\windows\system32\drivers\sptddrv1.sys 2008-11-21 20:28 --------- d-----w c:\documents and settings\Kathriona Connolly\Application Data\mIRC 2008-11-21 20:27 --------- d-----w c:\program files\mIRC 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll 2004-03-22 14:02 27,776 ----a-w c:\documents and settings\Kathriona Connolly\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-08-12 21741864] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "<NO NAME>"="c:\program files\Internet Explorer\iexplore.exe" [2008-10-15 633632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HTpatch"="c:\windows\htpatch.exe" [2002-12-19 28672] "SiS KHooker"="c:\windows\System32\khooker.exe" [2002-09-24 290816] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-02-03 114688] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-02-03 630784] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 79224] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664] "PCTVOICE"="pctspk.exe" [2002-03-08 c:\windows\system32\pctspk.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Kathriona Connolly\Start Menu\Programs\Startup\ PowerReg Scheduler.exe [2004-01-19 225280] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-08-09 1179648] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664] HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= 3ivxVfWCodec.dll "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0stera [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESB] --------- 2002-06-10 15:17 282624 c:\windows\system32\ESB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-06-28 08:14 270648 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2006-06-15 12:36 229376 c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] --a------ 2006-06-27 16:21 1449984 c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTEGPRS] --a------ 2003-05-27 18:49 1056768 c:\program files\Common Files\RTE\RTEGPRS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 15:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UStorag] --a------ 2004-09-15 10:07 372828 c:\program files\Belkin U-Storage Tools2.96\UStorage.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 18:49 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Invision\\mirc.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 SiSide1;SiSide1;c:\windows\system32\drivers\siside.sys [2003-12-19 4096] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024] S3 autorun;autorun;C:\huadio.tmp [2003-12-19 5311] S3 NetWlan5;Symbol Based 802.11b Wireless LAN Card Driver;c:\windows\system32\drivers\NetWlan5.sys [2005-02-10 132695] S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408] S4 acpi32;acpi32;\??\c:\windows\system32\drivers\acpi32.sys --> c:\windows\system32\drivers\acpi32.sys [?] S4 ksi32sk;ksi32sk;\??\c:\windows\system32\drivers\ksi32sk.sys --> c:\windows\system32\drivers\ksi32sk.sys [?] --- Other Services/Drivers In Memory --- *Deregistered* - ALG *Deregistered* - aswUpdSv *Deregistered* - AudioSrv *Deregistered* - avast! Antivirus *Deregistered* - avast! Mail Scanner *Deregistered* - avast! Web Scanner *Deregistered* - BITS *Deregistered* - BlueSoleil Hid Service *Deregistered* - Browser *Deregistered* - Creative Service for CDROM Access *Deregistered* - CryptSvc *Deregistered* - DcomLaunch *Deregistered* - Dhcp *Deregistered* - Dnscache *Deregistered* - ERSvc *Deregistered* - EventSystem *Deregistered* - FastUserSwitchingCompatibility *Deregistered* - helpsvc *Deregistered* - ImapiService *Deregistered* - Irmon *Deregistered* - lanmanserver *Deregistered* - lanmanworkstation *Deregistered* - LmHosts *Deregistered* - MSIServer *Deregistered* - Netman *Deregistered* - Nla *Deregistered* - Pml Driver HPZ12 *Deregistered* - PolicyAgent *Deregistered* - ProtectedStorage *Deregistered* - RasMan *Deregistered* - RpcSs *Deregistered* - SamSs *Deregistered* - Schedule *Deregistered* - seclogon *Deregistered* - SENS *Deregistered* - SharedAccess *Deregistered* - ShellHWDetection *Deregistered* - Spooler *Deregistered* - srservice *Deregistered* - SSDPSRV *Deregistered* - stisvc *Deregistered* - StkASSrv *Deregistered* - swenum *Deregistered* - sym_hi *Deregistered* - sym_u3 *Deregistered* - symc810 *Deregistered* - symc8xx *Deregistered* - TapiSrv *Deregistered* - Tcpip *Deregistered* - TermDD *Deregistered* - TermService *Deregistered* - Themes *Deregistered* - TosIde *Deregistered* - Tpkd *Deregistered* - TrkWks *Deregistered* - ultra *Deregistered* - UMWdf *Deregistered* - Update *Deregistered* - VcommMgr *Deregistered* - VgaSave *Deregistered* - viaagp *Deregistered* - ViaIde *Deregistered* - Vmodem *Deregistered* - VolSnap *Deregistered* - Vpctcom *Deregistered* - Vvoice *Deregistered* - W32Time *Deregistered* - Wanarp *Deregistered* - WebClient *Deregistered* - winmgmt *Deregistered* - WS2IFSL *Deregistered* - wscsvc *Deregistered* - wuauserv *Deregistered* - WZCSVC . Contents of the 'Scheduled Tasks' folder 2008-11-08 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Kathriona Connolly - c:\documents and settings\Kathriona Connolly\Kathriona Connolly.exe Notify-WgaLogon - (no file) SafeBoot-Winns04.sys MSConfigStartUp-BearShare - c:\program files\BearShare\BearShare.exe MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe MSConfigStartUp-NeroFilterCheck - c:\windows\System32\NeroCheck.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://home.eircom.net/ IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-05 21:09:55 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\??????Z????`??Z???Z`??Z???????????????Z???Z???Z???Z$??????Z???????????????Z???????????Z???w????(????3?w???w?????4?w ??w???Z:???????d???r??Z1??Z???Zd??????Z?-?Z????f??w8h?Z\2?Z?1?Zhtinst.INI?Z?u?Z????d????????F? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\autorun] "ImagePath"="\??\c:\huadio.tmp" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(728) c:\program files\SUPERAntiSpyware\SASWINLO.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe c:\windows\system32\CTSVCCDA.EXE c:\windows\system32\HPZipm12.exe c:\windows\system32\StkASv2K.exe c:\windows\system32\wdfmgr.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\wscntfy.exe c:\program files\HP\Digital Imaging\bin\hpqgalry.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\program files\Java\jre1.5.0_06\bin\jucheck.exe . ************************************************************************** . Completion time: 2009-01-05 21:26:42 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-05 21:26:31 Pre-Run: 9,010,798,592 bytes free Post-Run: 13,203,595,264 bytes free 294 --- E O F --- 2008-12-24 02:14:19 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:31, on 2009-01-05 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\StkASv2K.exe C:\WINDOWS\system32\pctspk.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\htpatch.exe C:\WINDOWS\System32\khooker.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000046.000000b5 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM') O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user') O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.iqon.ie O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpqdktp/downloads/sysinfo.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.carzone.ie/my/aurigma/ImageUploader4.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe -- End of file - 8093 bytes
That looks good, how’s it doing? Any problems?? Your Java is out of date, need to update: Please download JavaRa and unzip it to your desktop. • Double-click on JavaRa.exe to start the program. • Click on Remove Older Versions to remove the older versions of Java installed on your computer. • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK. • A logfile will pop up. Please save it to a convenient location. Then download and install Java Runtime Environment (JRE) 6 Update 11. 2OG
07anto07, Your Logs are clear of malware.. Slow can be caused by a number of things like full/fragmented hard drive, not enough RAM, resource hog programs, etc. etc. See Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth. 2OG
You're welcome, 07anto07. hehe I kinda threw that last post in for gavint's benifit. see ya around, 2OG
