spyware/malware problems

Discussion in 'Windows - Virus and spyware problems' started by swidjaja, Aug 26, 2006.

Page 1 of 2
  1. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    hello, i have been visiting ADforums for some time now, it has always been full of insight so i never needed to do anything more then search to get answers to my questions. however i have come under many problems with my computer. i've already gone through all the steps described in this thread http://forums.afterdawn.com/thread_view.cfm/263784 so i leave the rest up to the experts, if youre willing to lend a hand to a computer newbie.

    Logfile of HijackThis v1.99.1
    Scan saved at 7:50:27 PM, on 8/26/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Network Monitor\netmon.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\cvn0.exe
    C:\WINDOWS\system32\zqskw.exe
    C:\WINDOWS\sys01325918532-.exe
    C:\WINDOWS\Duce6.exe
    C:\WINDOWS\esdhzdcA.exe
    C:\WINDOWS\system32\n9nyb.exe
    C:\PROGRA~1\COMMON~1\zmuq\zmuqm.exe
    C:\Program Files\PSLister\PSLister.exe
    C:\Program Files\CMFibula\CMFibula.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    C:\Program Files\InterMute\SpySubtract\SpySub.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\Drivers\Touchpad\Apoint.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Sony\HotKey Utility\HKServ.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    C:\WINDOWS\system32\igfxext.exe
    C:\Program Files\Sony\HotKey Utility\HKWnd.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Opera\Opera.exe
    C:\Documents and Settings\ShawnW\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
    R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
    F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\fogrr.exe
    F2 - REG:system.ini: UserInit=userinit.exe,pknuciy.exe
    O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SmartWiConnectionUtility] C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe /WindowsStartup
    O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
    O4 - HKLM\..\Run: [winlog] winlog.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINDOWS\system32\wfxqhv.exe"
    O4 - HKLM\..\Run: [ad8rIU3s] C:\WINDOWS\system32\cvn0.exe
    O4 - HKLM\..\Run: [sys01325918532-] C:\WINDOWS\sys01325918532-.exe
    O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
    O4 - HKLM\..\Run: [esdhzdcA] C:\WINDOWS\esdhzdcA.exe
    O4 - HKLM\..\Run: [kst8c509] RUNDLL32.EXE w006430c.dll,n 0038c50600000003006430c
    O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O4 - HKLM\..\RunServices: [winlog] winlog.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [zmuq] C:\PROGRA~1\COMMON~1\zmuq\zmuqm.exe
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - HKCU\..\Run: [CMFibula] "C:\Program Files\CMFibula\CMFibula.exe"
    O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\system32\xeymi.dll
    O20 - AppInit_DLLs: repairs303169590.dll
    O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\xDctsrv.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

    thank you to anyone who is willing to take the time
     
    swidjaja, Aug 26, 2006
    #1
  2. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    Go here http://free.grisoft.com/doc/1 and download Ewido.

    Install and update.
    Restart your computer in safe mode(press F8 upon boot, select "Safe Mode" from menu).
    Run a full scan with Ewdio.
    When scanning is finished, set all items to delete and click apply all actions.
    Save a log file!
    Restart in normal mode.

    Post back with a new HijackThis log and the Ewido log.
     
    Niobis, Aug 26, 2006
    #2
  3. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    thank you niobis, im following your instructions now. and its awesome you were able to help me, as well six other people simultaneously. ill post up the fresh logs when theyre complete. thank you!
     
    swidjaja, Aug 26, 2006
    #3
  4. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    well after a few days of constant trying. my computer seems to be in better health. the popups are much less frequent. but the computer is still moving at a very sluggish pace. i wasnt able to get a log from ewido, everytime i used a program to scan, it would stop responding somewhere during the process. so here is another hjt log, hopefully things look healthier and i can get my computer running in good health again with help from you guys. thanks again.

    Logfile of HijackThis v1.99.1
    Scan saved at 6:16:49 AM, on 8/28/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\wfxqhv.exe
    C:\WINDOWS\system32\cvn0.exe
    C:\WINDOWS\sys01325918532-.exe
    C:\WINDOWS\Duce6.exe
    C:\WINDOWS\system32\zqskw.exe
    C:\WINDOWS\esdhzdcA.exe
    C:\WINDOWS\system32\ghynf.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\PSLister\PSLister.exe
    C:\Program Files\CMFibula\CMFibula.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\ShawnW\Desktop\Shelf\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
    R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
    F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\fogrr.exe
    F2 - REG:system.ini: UserInit=userinit.exe,pknuciy.exe
    O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\system32\xeymi.dll
    O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
    O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SmartWiConnectionUtility] C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe /WindowsStartup
    O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINDOWS\system32\wfxqhv.exe"
    O4 - HKLM\..\Run: [ad8rIU3s] C:\WINDOWS\system32\cvn0.exe
    O4 - HKLM\..\Run: [sys01325918532-] C:\WINDOWS\sys01325918532-.exe
    O4 - HKLM\..\Run: [nwtfrb] C:\WINDOWS\system32\ofpnrd.exe reg_run
    O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
    O4 - HKLM\..\Run: [esdhzdcA] C:\WINDOWS\esdhzdcA.exe
    O4 - HKLM\..\Run: [kst8c509] RUNDLL32.EXE w006430c.dll,n 0038c50600000003006430c
    O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [ktbgs] C:\WINDOWS\system32\ofpnrd.exe reg_run
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - HKCU\..\Run: [CMFibula] "C:\Program Files\CMFibula\CMFibula.exe"
    O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\system32\xeymi.dll
    O20 - AppInit_DLLs: repairs303169590.dll
    O20 - Winlogon Notify: Nls - C:\WINDOWS\system32\lv8409lqe.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

     
    swidjaja, Aug 28, 2006
    #4
  5. maca1

    maca1 Regular member

    Joined:
    Mar 15, 2006
    Messages:
    630
    Likes Received:
    0
    Trophy Points:
    26
    You're quite infected

    Download Combofix to your desktop. http://download.bleepingcomputer.com/sUBs/combofix.exe

    Doubleclick combo.exeand follow the prompts.

    Do NOT click on the window while the fix is running because that will cause your system to hang.

    When finished and after reboot, it should open a log, combofix.txt.

    Post this log in your next reply together with a new hijackthislog.
     
    Last edited: Aug 28, 2006
    maca1, Aug 28, 2006
    #5
  6. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    thanks maca

    Logfile of HijackThis v1.99.1
    Scan saved at 18:33, on 06-08-28
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\cscript.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\wfxqhv.exe
    C:\WINDOWS\system32\cvn0.exe
    C:\WINDOWS\sys01325918532-.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\esdhzdcA.exe
    C:\WINDOWS\system32\zqskw.exe
    C:\WINDOWS\system32\ghynf.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CMFibula\CMFibula.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    C:\Program Files\InterMute\SpySubtract\SpySub.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\ShawnW\Desktop\Shelf\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
    O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\system32\xeymi.dll
    O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SmartWiConnectionUtility] C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe /WindowsStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINDOWS\system32\wfxqhv.exe"
    O4 - HKLM\..\Run: [ad8rIU3s] C:\WINDOWS\system32\cvn0.exe
    O4 - HKLM\..\Run: [sys01325918532-] C:\WINDOWS\sys01325918532-.exe
    O4 - HKLM\..\Run: [esdhzdcA] C:\WINDOWS\esdhzdcA.exe
    O4 - HKLM\..\Run: [kst8c509] RUNDLL32.EXE w006430c.dll,n 0038c50600000003006430c
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - HKCU\..\Run: [CMFibula] "C:\Program Files\CMFibula\CMFibula.exe"
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\system32\xeymi.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

    and the combofix

    ShawnW - 06-08-28 17:54:58.62
    ComboFix 06.08.27BT - Running from: C:\Documents and Settings\ShawnW\Desktop

    ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))

    REGISTRY ENTRIES REMOVED:

    [HKEY_CLASSES_ROOT\CLSID\{888F221F-3053-426A-866F-08E60EF3E9A9}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{888F221F-3053-426A-866F-08E60EF3E9A9}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{888F221F-3053-426A-866F-08E60EF3E9A9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{888F221F-3053-426A-866F-08E60EF3E9A9}\InprocServer32]
    "ThreadingModel"="Apartment"

    [HKEY_CLASSES_ROOT\CLSID\{A60E8055-BB0B-4847-A8EB-AD49ADBBBB75}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A60E8055-BB0B-4847-A8EB-AD49ADBBBB75}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A60E8055-BB0B-4847-A8EB-AD49ADBBBB75}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A60E8055-BB0B-4847-A8EB-AD49ADBBBB75}\InprocServer32]
    @="C:\\WINDOWS\\system32\\fwdrclnr.dll"
    "ThreadingModel"="Apartment"

    * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


    FILES REMOVED:

    C:\WINDOWS\system32\fwdrclnr.dll


    Granting sedebugprivilege to Administrators ... successful


    ((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log )))))))))))))))))))))))))))))))))))))))))))))))))))


    * * * PRE-RUN - Filepaths from Locate * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


    2006-08-27 06:01 45056 --a--c--- C:\WINDOWS\system32\ghynf.exe
    2006-08-27 06:01 221184 --a--c--- C:\WINDOWS\system32\xeymi.dll
    2006-08-25 19:35 53 --a--c--- C:\WINDOWS\neoecp.dat
    2006-07-21 04:24 72704 --a--c--- C:\WINDOWS\system32\hlink.dll
    2006-07-20 16:31 36864 --a--c--- C:\WINDOWS\system32\zqskw.exe
    2006-07-20 16:31 1163264 --a--c--- C:\WINDOWS\system32\wfxqhv.exe


    * * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * *


    06-08-25 19:35 53 neoecp.dat.qoo

    DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO


    ((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\system32\repairs303169590.dll
    C:\Documents and Settings\ShawnW\Application Data\Sskdmns.dll
    C:\WINDOWS\system32\bk.exe
    C:\Program Files\surfsidekick 3\Ssk.exe
    C:\Program Files\surfsidekick 3\SskBho.dll
    C:\Program Files\surfsidekick 3\SskCore.dll


    * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


    (((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\Duce6.exe
    C:\WINDOWS\keyboard1.dat
    C:\Documents and Settings\ShawnW\Local Settings\Temporary Internet Files\Content.IE5\KXS6LJTL\dfndrff_13[1].exe
    C:\Documents and Settings\ShawnW\Local Settings\Temporary Internet Files\Content.IE5\KXS6LJTL\kybrdff_12[1].exe
    C:\Documents and Settings\ShawnW\Local Settings\Temporary Internet Files\Content.IE5\O9BQUAHG\kybrdff_13[1].exe
    C:\Documents and Settings\ShawnW\Local Settings\Temporary Internet Files\Content.IE5\O9BQUAHG\nwnmff_13[1].exe
    C:\WINDOWS\system32\bez6n4r21.exe
    C:\WINDOWS\system32\cvn0.exe
    C:\WINDOWS\system32\ghynf.exe
    C:\WINDOWS\system32\tsuninst.exe
    C:\WINDOWS\system32\wfxqhv.exe
    C:\WINDOWS\system32\xeymi.dll
    C:\WINDOWS\system32\zqskw.exe
    C:\WINDOWS\system32bez6n4r21.exe
    C:\WINDOWS\system32ghynf.exe
    C:\WINDOWS\uninst104.exe
    C:\Program Files\Deskbar
    C:\Program Files\outlook
    C:\Program Files\Common Files\{EC92E0BC-0253-1033-0609-050001}
    C:\WINDOWS\Duce6.exe
    C:\WINDOWS\system32\cvn0.exe
    C:\WINDOWS\system32\ghynf.exe
    C:\WINDOWS\system32\wfxqhv.exe
    C:\WINDOWS\system32\xeymi.dll
    C:\WINDOWS\system32\zqskw.exe
    C:\Program Files\PSLister


    ((((((((((((((((((((((((((((((( Files Created from 2006-07-28 to 2006-08-28 ))))))))))))))))))))))))))))))))))


    2006-08-28 17:59 45,056 --a--c--- C:\WINDOWS\system32ghynf.exe
    2006-08-28 17:59 28,672 --a--c--- C:\WINDOWS\system32bez6n4r21.exe
    2006-08-28 17:55 36,864 --a--c--- C:\WINDOWS\system32n9nyb.exe
    2006-08-27 06:01 45,056 --a--c--- C:\WINDOWS\system32\ghynf.exe
    2006-08-27 06:01 221,184 --a--c--- C:\WINDOWS\system32\xeymi.dll
    2006-08-25 19:36 61,952 --a--c--- C:\WINDOWS\system32\kst8c509.dll
    2006-08-25 19:36 1,233 --a--c--- C:\WINDOWS\system32\kst8c509.sys
    2006-08-25 19:35 556 --a--c--- C:\WINDOWS\mavtj.dll
    2006-08-25 19:35 314,816 -r-hsc--- C:\WINDOWS\esdhzdcA.exe
    2006-08-25 19:35 186,223 --a--c--- C:\WINDOWS\srvxbwjtys.exe
    2006-08-25 19:35 106,496 --a--c--- C:\WINDOWS\Duce6.exe
    2006-08-25 19:34 36,864 --a--c--- C:\WINDOWS\system32\zqskw.exe
    2006-08-25 19:34 28,672 --a--c--- C:\WINDOWS\system32\iqqr.exe
    2006-08-25 19:34 215,308 --a--c--- C:\WINDOWS\srvzwbnxwl.exe
    2006-08-25 19:34 159,744 --a--c--- C:\WINDOWS\system32\cvn0.exe
    2006-08-25 19:34 159,744 --a--c--- C:\WINDOWS\sys01325918532-.exe
    2006-08-25 19:34 1,163,264 --a--c--- C:\WINDOWS\system32\wfxqhv.exe
    2006-08-21 16:48 53,248 --a--c--- C:\WINDOWS\uni_ehhhh.exe
    2006-08-18 22:13 178,408 --a--c--- C:\WINDOWS\system32\muweb.dll
    2006-08-18 22:13 127,208 --a--c--- C:\WINDOWS\system32\mucltui.dll
    2006-08-07 11:17 61,440 --a--c--- C:\WINDOWS\system32\BattyRun2.dll


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


    2006-08-28 17:55 -------- d----c--- C:\Program Files\Common Files
    2006-08-28 17:36 -------- d----c--- C:\Program Files\Mozilla Firefox
    2006-08-28 12:40 -------- d----c--- C:\Program Files\Common Files\zmuq
    2006-08-28 06:48 -------- d----c--- C:\Program Files\ewido anti-spyware 4.0
    2006-08-27 12:01 -------- d----c--- C:\Program Files\Installers
    2006-08-26 23:31 4288 --a--c--- C:\WINDOWS\system32\drivers\avg7rsw.sys
    2006-08-26 23:31 27904 --a--c--- C:\WINDOWS\system32\drivers\avg7rsxp.sys
    2006-08-26 23:31 23424 --a--c--- C:\WINDOWS\system32\drivers\avgmfrs.sys
    2006-08-26 23:31 -------- d----c--- C:\Documents and Settings\ShawnW\Application Data\AVG7
    2006-08-26 23:30 777472 --a--c--- C:\WINDOWS\system32\drivers\avg7core.sys
    2006-08-26 23:30 -------- d----c--- C:\Program Files\Grisoft
    2006-08-26 23:07 -------- d----c--- C:\Program Files\FinePixViewer
    2006-08-26 01:52 -------- d----c--- C:\Program Files\Internet Explorer
    2006-08-26 01:00 -------- d----c--- C:\Program Files\PC Tools AntiVirus
    2006-08-26 01:00 -------- d----c--- C:\Program Files\Common Files\Symantec Shared
    2006-08-26 01:00 -------- d----c--- C:\Documents and Settings\ShawnW\Application Data\Azureus
    2006-08-26 00:52 -------- d----c--- C:\Program Files\ToniArts
    2006-08-26 00:51 -------- d--h-c--- C:\Program Files\InstallShield Installation Information
    2006-08-25 19:36 -------- d----c--- C:\Program Files\CMFibula
    2006-08-25 19:36 -------- d----c--- C:\Program Files\Batty2
    2006-08-25 16:18 -------- d----c--- C:\Program Files\Starcraft
    2006-08-25 01:36 -------- d----c--- C:\Program Files\Pegasys Inc
    2006-08-24 19:58 -------- d----c--- C:\Program Files\Opera
    2006-08-24 19:58 -------- d----c--- C:\Documents and Settings\ShawnW\Application Data\Opera
    2006-08-24 19:57 -------- d---sc--- C:\Documents and Settings\ShawnW\Application Data\Microsoft
    2006-08-24 08:40 -------- d----c--- C:\Program Files\Azureus
    2006-08-23 08:15 -------- d----c--- C:\Documents and Settings\ShawnW\Application Data\PC Tools
    2006-08-19 03:11 -------- d----c--- C:\Program Files\Common Files\Microsoft Shared
    2006-07-28 23:27 -------- d----c--- C:\Documents and Settings\ShawnW\Application Data\Skype
    2006-07-28 14:11 -------- d----c--- C:\Documents and Settings\ShawnW\Application Data\NJStar
    2006-07-27 09:24 679424 --a--c--- C:\WINDOWS\system32\inetcomm.dll
    2006-07-26 01:56 -------- d----c--- C:\Program Files\Skype
    2006-07-22 12:38 -------- d----c--- C:\Program Files\AIM
    2006-07-21 04:24 72704 --a--c--- C:\WINDOWS\system32\hlink.dll
    2006-06-28 12:56 -------- d----c--- C:\Program Files\Smarty Uninstaller Pro


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

    *Note* empty entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
    "SmartWiConnectionUtility"="C:\\Program Files\\Sony\\SmartWi Connection Utility\\SmartWi.exe /WindowsStartup"
    "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
    "k6mmN5IOU"="\"C:\\WINDOWS\\system32\\wfxqhv.exe\""
    "ad8rIU3s"="C:\\WINDOWS\\system32\\cvn0.exe"
    "sys01325918532-"="C:\\WINDOWS\\sys01325918532-.exe"
    "esdhzdcA"="C:\\WINDOWS\\esdhzdcA.exe"
    "kst8c509"="RUNDLL32.EXE w006430c.dll,n 0038c50600000003006430c"
    "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "Installed"="1"
    "NoChange"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "Installed"="1"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Steam"=""
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
    "PSLister"="\"C:\\Program Files\\PSLister\\PSLister.exe\""
    "CMFibula"="\"C:\\Program Files\\CMFibula\\CMFibula.exe\""

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    "dontdisplaylastusername"=dword:00000000
    "legalnoticecaption"=""
    "legalnoticetext"=""
    "shutdownwithoutlogon"=dword:00000001
    "undockwithoutlogon"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:0000009d

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
    "DeskHtmlVersion"=dword:00000110
    "DeskHtmlMinorVersion"=dword:00000005
    "Settings"=dword:00000001
    "GeneralFlags"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"
    "Flags"=dword:00000002
    "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,02,00,00,00,\
    00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
    "CurrentState"=hex:04,00,00,40
    "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
    ff,ff,04,00,00,00
    "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,7c,00,\
    00,00,01,00,00,00

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
    "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="SpySubtract Shell Extension"
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"



    Contents of the 'Scheduled Tasks' folder
    C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - ShawnW.job
    C:\WINDOWS\tasks\Symantec NetDetect.job

    Completion time: 06-08-28 18:04:17.67
    ComboFix.txt
     
    swidjaja, Aug 28, 2006
    #6
  7. maca1

    maca1 Regular member

    Joined:
    Mar 15, 2006
    Messages:
    630
    Likes Received:
    0
    Trophy Points:
    26
    · Run ewido
    · Click on scanner
    · Click Complete System Scan and the scan will begin.
    · When the scan is finished, Set all items to delete
    · Apply all actions
    · look at the bottom of the screen and click the Save report button.
    · Save the report to your C: Drive
    This will take some time to run!
    RE-Boot
    Post that log and a new HiJack log
     
    maca1, Aug 28, 2006
    #7
  8. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    in safe mode right? i've been having problems with ewido before. it scans, runs and fixes problems. but i can never get a log from it. it usually stops responding at that point. also, i can't see the buttons. when in safe mode, my desktop minimizes to a small size. preventing me from seeing the ewido toolbar. nonetheless, ill post the hjt log and try to get the ewido up.
    THANKS again maca. the computer feels much healthier already. popups have stopped occuring.
     
    swidjaja, Aug 28, 2006
    #8
  9. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    my comp has been giving me hell for the last week or so, and i wasn't able to get a connection to the internet with it. anyway, i followed the recent advice from maca and am posting the hjt and ewido logs. thanks for the help guys

    Logfile of HijackThis v1.99.1
    Scan saved at 15:22, on 06-09-05
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\ShawnW\Desktop\Shelf\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
    O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\system32\xeymi.dll (file missing)
    O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SmartWiConnectionUtility] C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe /WindowsStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [kst8c509] RUNDLL32.EXE w006430c.dll,n 0038c50600000003006430c
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\system32\xeymi.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 15:11 06-09-05

    + Scan result:



    C:\Program Files\Batty2\Batty2.dll -> Adware.CASClient : Cleaned with backup (quarantined).
    C:\Program Files\Batty2\Batty2.exe -> Adware.CASClient : Cleaned with backup (quarantined).
    C:\Program Files\CMFibula\CMFibula.exe -> Adware.CASClient : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\BattyRun2.dll -> Adware.CASClient : Cleaned with backup (quarantined).
    C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : Cleaned with backup (quarantined).
    C:\Documents and Settings\ShawnW\Local Settings\Temporary Internet Files\Content.IE5\1KNEQEWN\bbqa[1].cab/cvn0.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\bez6n4r21.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\cvn0.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\ghynf.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined).
    C:\WINDOWS\system32bez6n4r21.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined).
    C:\WINDOWS\system32ghynf.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined).
    C:\Documents and Settings\ShawnW\Local Settings\Temporary Internet Files\Content.IE5\1KNEQEWN\bbqa[1].cab/wfxqhv.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
    C:\Documents and Settings\ShawnW\Local Settings\Temporary Internet Files\Content.IE5\1KNEQEWN\bbqa[1].cab/zqskw.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\iqqr.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\wfxqhv.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\xeymi.dll -> Adware.Suggestor : Cleaned with backup (quarantined).
    C:\WINDOWS\system32n9nyb.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
    C:\Program Files\webHancer -> Adware.Webhancer : Cleaned with backup (quarantined).
    C:\Program Files\webHancer\Programs -> Adware.Webhancer : Cleaned with backup (quarantined).
    C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.Webhancer : Cleaned with backup (quarantined).
    C:\Program Files\webHancer\Programs\whiehlpr.dll -> Adware.Webhancer : Cleaned with backup (quarantined).
    :mozilla.123:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.124:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.125:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.126:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.127:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.129:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.130:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.131:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.132:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.283:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.469:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.507:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.553:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.559:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.571:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\ShawnW\Cookies\shawnw@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\ShawnW\Cookies\shawnw@partygaming.122.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.157:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.158:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.164:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.221:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
    :mozilla.165:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.166:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.167:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.168:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.169:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.170:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.173:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.658:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.361:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
    :mozilla.362:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
    :mozilla.100:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.97:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.98:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.99:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.29:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.181:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
    :mozilla.227:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
    :mozilla.228:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
    :mozilla.229:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
    :mozilla.230:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
    :mozilla.408:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
    :mozilla.409:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.410:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.411:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.213:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.214:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.215:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.216:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.177:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
    :mozilla.178:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
    :mozilla.255:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Com : Cleaned.
    :mozilla.360:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
    :mozilla.484:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
    :mozilla.485:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
    :mozilla.486:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
    :mozilla.487:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
    C:\Documents and Settings\ShawnW\Cookies\shawnw@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
    :mozilla.640:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned.
    :mozilla.35:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.36:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.37:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.38:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.39:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.40:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.218:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.219:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.220:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.222:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.73:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.74:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.75:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.76:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.77:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.78:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
    :mozilla.69:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.70:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.71:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.72:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.420:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.421:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.422:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.423:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.532:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Hypertracker : Cleaned.
    :mozilla.544:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Komtrack : Cleaned.
    :mozilla.278:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
    :mozilla.279:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
    :mozilla.664:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.665:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.666:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.667:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.668:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.669:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.670:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.174:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.175:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.638:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
    :mozilla.639:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
    C:\Documents and Settings\ShawnW\Cookies\shawnw@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
    :mozilla.290:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Ne : Cleaned.
    :mozilla.291:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Ne : Cleaned.
    :mozilla.249:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
    :mozilla.579:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
    :mozilla.449:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.450:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.451:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.452:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.584:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Popularix : Cleaned.
    :mozilla.585:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
    :mozilla.586:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
    :mozilla.116:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.133:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.134:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.677:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    :mozilla.678:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    :mozilla.679:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    :mozilla.680:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    :mozilla.184:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
    :mozilla.504:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.505:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    :mozilla.506:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\ShawnW\Cookies\shawnw@banners.searchingbooth[1].txt -> TrackingCookie.Searchingbooth : Cleaned.
    :mozilla.609:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.610:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.611:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.612:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.241:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
    :mozilla.242:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
    :mozilla.243:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
    :mozilla.244:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
    :mozilla.337:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.338:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.339:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.340:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.341:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.308:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.314:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.315:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.648:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.641:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Texttbnru : Cleaned.
    C:\Documents and Settings\ShawnW\Cookies\shawnw@media.top-banners[1].txt -> TrackingCookie.Top-banners : Cleaned.
    :mozilla.198:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.199:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.200:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.201:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.202:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.203:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.204:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.205:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.223:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.224:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.225:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.61:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.62:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.63:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.64:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.66:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.67:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\ShawnW\Cookies\shawnw@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.332:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.333:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
    :mozilla.334:C:\Documents and Settings\ShawnW\Application Data\Mozilla\Firefox\Profiles\521fqv52.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.


    ::Report end

     
    swidjaja, Sep 5, 2006
    #9
  10. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    Nice, open HijackThis click "Open the Misc Tool Section. Under system tools click "delete a file on reboot..." Find and select this file.

    [bold]C:\WINDOWS\system32\xeymi.dll[/bold]

    Restart when prompted.

    Now, run a scan only with HijackThis and check to fix these.

    [bold]R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)

    O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\system32\xeymi.dll (file missing)

    O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file) [/bold]

    Close all window except HijackThis then click Fix Checked.

    Post a new HijackThis log and tell how things are now.

    Also, delete the files in Ewido's quarantine.
     
    Last edited: Sep 5, 2006
    Niobis, Sep 5, 2006
    #10
  11. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    i wasn't able to find xeymi.dll so i didnt do anything about that. another thing that might be worth mentioning. i get an error message at startup saying that something couldn't run because of the missing w006430c.dll if that's not harmful, ill just ignore it

    Logfile of HijackThis v1.99.1
    Scan saved at 19:29, on 06-09-05
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\ShawnW\Desktop\Shelf\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SmartWiConnectionUtility] C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe /WindowsStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [kst8c509] RUNDLL32.EXE w006430c.dll,n 0038c50600000003006430c
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\system32\xeymi.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

    thanks niobis for the speedy help
     
    swidjaja, Sep 5, 2006
    #11
  12. maca1

    maca1 Regular member

    Joined:
    Mar 15, 2006
    Messages:
    630
    Likes Received:
    0
    Trophy Points:
    26
    in safe mode

    rescan with hijackthis and check these

    O4 - HKLM\..\Run: [kst8c509] RUNDLL32.EXE w006430c.dll,n 0038c50600000003006430c
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\system32\xeymi.dll


    make sure all other windows are closed and click fix checked

    go to start - search

    [bold]xeymi.dll[/bold]

    delete if found

    search for this folder and delete also
    C:\Program Files\[bold]PSLister[/bold]\

    In normal mode
    Run ActiveScan online virus scan:
    http://www.pandasoftware.com/products/activescan.htm
    When the scan is finished, save the results from the scan!

    Come back here and post a new Hijack This log along with the logs from the Panda scans.





     
    Last edited: Sep 5, 2006
    maca1, Sep 5, 2006
    #12
  13. maca1

    maca1 Regular member

    Joined:
    Mar 15, 2006
    Messages:
    630
    Likes Received:
    0
    Trophy Points:
    26
    ...........
     
    Last edited: Sep 7, 2006
    maca1, Sep 7, 2006
    #13
  14. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    pandascan is not working. i can load the applet but it only goes as far as selecting which folder to scan. another note, the pslister folder wasnt found at all. perhaps it was removed after i deleted the files in quarantine?
     
    swidjaja, Sep 7, 2006
    #14
  15. maca1

    maca1 Regular member

    Joined:
    Mar 15, 2006
    Messages:
    630
    Likes Received:
    0
    Trophy Points:
    26
    can you see if you can run panda scan now, sometimes it can do that
    If not just post a new hijackthis log
     
    maca1, Sep 8, 2006
    #15
  16. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    pandascan still not working correctly for me.

    Logfile of HijackThis v1.99.1
    Scan saved at 00:56, on 06-09-09
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\Drivers\Touchpad\Apoint.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Sony\HotKey Utility\HKServ.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    C:\WINDOWS\system32\igfxext.exe
    C:\Program Files\Sony\HotKey Utility\HKWnd.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\ShawnW\Desktop\Shelf\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SmartWiConnectionUtility] C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe /WindowsStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

    thank you maca
     
    swidjaja, Sep 8, 2006
    #16
  17. maca1

    maca1 Regular member

    Joined:
    Mar 15, 2006
    Messages:
    630
    Likes Received:
    0
    Trophy Points:
    26
    Click here to download ATF Cleaner by Atribune and save it to your desktop.

    http://majorgeeks.com/ATF_Cleaner_d4949.html


    * Double-click ATF-Cleaner.exe to run the program.
    * Under Main choose: Select All
    * Click the Empty Selected button.
    o If you use Firefox:
    + Click Firefox at the top and choose: Select All
    + Click the Empty Selected button.
    + NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    o If you use Opera:
    + Click Opera at the top and choose: Select All
    + Click the Empty Selected button.
    + NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    * Click Exit on the Main menu to close the program.


    Download WinPFind
    http://www.bleepingcomputer.com/files/winpfind.php
    Right Click the Zip Folder and Select "Extract All"
    Extract it somewhere you will remember like the Desktop
    Don’t do anything with it yet!

    Reboot into Safe Mode.


    Double click WinPFind.exe
    Click "Start Scan"
    It will scan the entire System, so please be patient and let it complete.


    Reboot back to Normal Mode!

    Go to the WinPFind folder
    Locate WinPFind.txt
    Copy and paste WinPFind.txt in your next post here please
     
    maca1, Sep 9, 2006
    #17
  18. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

    If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows sometimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

    »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Logfile created on: 06-09-09 13:48:38
    WinPFind v1.5.0 Folder = C:\Documents and Settings\ShawnW\Desktop\WinPFind\WinPFind\
    Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
    Internet Explorer (Version = 6.0.2900.2180)

    »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

    Checking %SystemDrive% folder...
    qoologic 06-08-28 18:04:18 12236 C:\ComboFix.txt ()

    Checking %ProgramFilesDir% folder...

    Checking %WinDir% folder...

    Checking %System% folder...
    UPX! 04-09-01 10:49:56 284672 C:\WINDOWS\SYSTEM32\avisynth.dll (The Public)
    aspack 05-07-22 20:59:04 2319568 C:\WINDOWS\SYSTEM32\d3dx9_27.dll (Microsoft Corporation)
    PEC2 04-08-04 08:00:00 41397 C:\WINDOWS\SYSTEM32\dfrg.msc ()
    PEC2 05-08-09 18:14:00 692736 C:\WINDOWS\SYSTEM32\DivX.dll (DivXNetworks)
    PECompact2 05-08-09 18:14:00 692736 C:\WINDOWS\SYSTEM32\DivX.dll (DivXNetworks)
    UPX! 06-08-25 19:36:14 61952 C:\WINDOWS\SYSTEM32\kst8c509.dll ()
    PTech 06-06-19 16:19:42 571184 C:\WINDOWS\SYSTEM32\LegitCheckControl.dll (Microsoft Corporation)
    PECompact2 06-08-09 15:03:04 8325544 C:\WINDOWS\SYSTEM32\MRT.exe (Microsoft Corporation)
    aspack 06-08-09 15:03:04 8325544 C:\WINDOWS\SYSTEM32\MRT.exe (Microsoft Corporation)
    WSUD 04-08-04 08:00:00 1200128 C:\WINDOWS\SYSTEM32\ntbackup.exe (Microsoft Corporation)
    aspack 04-08-04 08:00:00 708096 C:\WINDOWS\SYSTEM32\ntdll.dll (Microsoft Corporation)
    WSUD 04-08-04 08:00:00 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl (Microsoft Corporation)
    Umonitor 04-08-04 08:00:00 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll (Microsoft Corporation)
    winsync 04-08-04 08:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu ()
    PTech 06-06-19 16:19:26 304944 C:\WINDOWS\SYSTEM32\WgaTray.exe (Microsoft Corporation)

    Checking %System%\Drivers folder and sub-folders...
    UPX! 06-08-26 23:31:00 777472 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys (GRISOFT, s.r.o.)
    FSG! 06-08-26 23:31:00 777472 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys (GRISOFT, s.r.o.)
    PEC2 06-08-26 23:31:00 777472 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys (GRISOFT, s.r.o.)
    aspack 06-08-26 23:31:00 777472 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys (GRISOFT, s.r.o.)

    Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


    Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
    06-09-09 13:46:58 S 2048 C:\WINDOWS\bootstat.dat ()
    06-09-07 02:14:58 H 54156 C:\WINDOWS\QTFont.qfn ()
    06-08-18 22:13:42 H 0 C:\WINDOWS\inf\oem18.inf ()
    06-08-10 14:42:50 H 1401768 C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\fa6a8b6ef758224c8bfe859aa426f0c7\BIT3B.tmp (Microsoft Corporation)
    06-07-28 08:16:08 S 23751 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB918899.cat ()
    06-07-27 10:00:28 S 10337 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB920214.cat ()
    06-07-21 05:03:14 S 10925 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB920670.cat ()
    06-07-13 10:24:46 S 13050 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB921398.cat ()
    06-07-14 12:13:00 S 10925 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB921883.cat ()
    06-07-14 11:53:20 S 10925 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB922616.cat ()
    06-09-09 13:46:46 H 8192 C:\WINDOWS\system32\config\default.LOG ()
    06-09-09 13:47:40 H 1024 C:\WINDOWS\system32\config\SAM.LOG ()
    06-09-09 13:47:02 H 12288 C:\WINDOWS\system32\config\SECURITY.LOG ()
    06-09-09 13:47:44 H 73728 C:\WINDOWS\system32\config\software.LOG ()
    06-09-09 13:47:08 H 1073152 C:\WINDOWS\system32\config\system.LOG ()
    06-08-15 08:37:54 H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG ()
    06-08-25 20:07:22 S 27618 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1 ()
    06-08-25 20:07:22 S 245330 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019 ()
    06-08-25 20:07:22 S 120 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1 ()
    06-08-25 20:07:22 S 124 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019 ()
    06-07-21 14:44:48 HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\4826c487-2a3e-4aa3-a403-5efe1b580b89 ()
    06-07-21 14:44:48 HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\Preferred ()
    06-09-09 13:45:40 H 6 C:\WINDOWS\Tasks\SA.DAT ()

    Checking for CPL files...
    04-08-04 08:00:00 68608 C:\WINDOWS\SYSTEM32\access.cpl (Microsoft Corporation)
    04-08-04 08:00:00 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl (Microsoft Corporation)
    04-08-04 08:00:00 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl (Microsoft Corporation)
    04-08-04 08:00:00 135168 C:\WINDOWS\SYSTEM32\desk.cpl (Microsoft Corporation)
    04-08-04 08:00:00 80384 C:\WINDOWS\SYSTEM32\firewall.cpl (Microsoft Corporation)
    04-08-04 08:00:00 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl (Microsoft Corporation)
    04-10-08 11:29:16 94208 C:\WINDOWS\SYSTEM32\igfxcpl.cpl (Intel Corporation)
    04-08-04 08:00:00 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl (Microsoft Corporation)
    04-08-04 08:00:00 129536 C:\WINDOWS\SYSTEM32\intl.cpl (Microsoft Corporation)
    04-08-04 08:00:00 380416 C:\WINDOWS\SYSTEM32\irprops.cpl (Microsoft Corporation)
    04-08-04 08:00:00 68608 C:\WINDOWS\SYSTEM32\joy.cpl (Microsoft Corporation)
    05-11-10 14:03:50 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl (Sun Microsystems, Inc.)
    04-08-04 08:00:00 187904 C:\WINDOWS\SYSTEM32\main.cpl (Microsoft Corporation)
    04-08-04 08:00:00 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl (Microsoft Corporation)
    04-08-04 08:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl (Microsoft Corporation)
    04-08-04 08:00:00 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl (Microsoft Corporation)
    04-08-04 08:00:00 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl (Microsoft Corporation)
    04-08-04 08:00:00 36864 C:\WINDOWS\SYSTEM32\nwc.cpl (Microsoft Corporation)
    04-08-04 08:00:00 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl (Microsoft Corporation)
    04-08-04 08:00:00 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl (Microsoft Corporation)
    04-08-04 08:00:00 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl (Microsoft Corporation)
    04-08-04 08:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl (Microsoft Corporation)
    04-08-04 08:00:00 94208 C:\WINDOWS\SYSTEM32\timedate.cpl (Microsoft Corporation)
    05-02-28 23:07:20 86016 C:\WINDOWS\SYSTEM32\VCCenter.cpl (Sony Corporation)
    04-08-04 08:00:00 148480 C:\WINDOWS\SYSTEM32\wscui.cpl (Microsoft Corporation)
    05-05-26 07:16:30 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl (Microsoft Corporation)
    04-08-04 08:00:00 68608 C:\WINDOWS\SYSTEM32\dllcache\access.cpl (Microsoft Corporation)
    04-08-04 08:00:00 549888 C:\WINDOWS\SYSTEM32\dllcache\appwiz.cpl (Microsoft Corporation)
    04-08-04 08:00:00 135168 C:\WINDOWS\SYSTEM32\dllcache\desk.cpl (Microsoft Corporation)
    04-08-04 08:00:00 80384 C:\WINDOWS\SYSTEM32\dllcache\firewall.cpl (Microsoft Corporation)
    04-08-04 08:00:00 155136 C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl (Microsoft Corporation)
    04-08-04 08:00:00 358400 C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl (Microsoft Corporation)
    04-08-04 08:00:00 129536 C:\WINDOWS\SYSTEM32\dllcache\intl.cpl (Microsoft Corporation)
    04-08-04 08:00:00 380416 C:\WINDOWS\SYSTEM32\dllcache\irprops.cpl (Microsoft Corporation)
    04-08-04 08:00:00 68608 C:\WINDOWS\SYSTEM32\dllcache\joy.cpl (Microsoft Corporation)
    04-08-04 08:00:00 187904 C:\WINDOWS\SYSTEM32\dllcache\main.cpl (Microsoft Corporation)
    04-08-04 08:00:00 618496 C:\WINDOWS\SYSTEM32\dllcache\mmsys.cpl (Microsoft Corporation)
    04-08-04 08:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl (Microsoft Corporation)
    04-08-04 08:00:00 25600 C:\WINDOWS\SYSTEM32\dllcache\netsetup.cpl (Microsoft Corporation)
    04-08-04 08:00:00 257024 C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl (Microsoft Corporation)
    04-08-04 08:00:00 36864 C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl (Microsoft Corporation)
    04-08-04 08:00:00 32768 C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl (Microsoft Corporation)
    04-08-04 08:00:00 114688 C:\WINDOWS\SYSTEM32\dllcache\powercfg.cpl (Microsoft Corporation)
    04-08-04 08:00:00 155648 C:\WINDOWS\SYSTEM32\dllcache\sapi.cpl (Microsoft Corporation)
    04-08-04 08:00:00 298496 C:\WINDOWS\SYSTEM32\dllcache\sysdm.cpl (Microsoft Corporation)
    04-08-04 08:00:00 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl (Microsoft Corporation)
    04-08-04 08:00:00 94208 C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl (Microsoft Corporation)
    04-08-04 08:00:00 148480 C:\WINDOWS\SYSTEM32\dllcache\wscui.cpl (Microsoft Corporation)
    05-05-26 07:16:30 174360 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl (Microsoft Corporation)

    Checking for Downloaded Program Files...
    {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - Symantec AntiVirus scanner - CodeBase = http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    {644E432F-49D3-41A1-8DD5-E099162EEEC5} - Symantec RuFSI Utility Class - CodeBase = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    {8AD9C840-044E-11D1-B3E9-00805F499D93} - Java Plug-in 1.5.0_06 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - ActiveScan Installer Class - CodeBase = http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - Java Plug-in 1.5.0 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
    {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - Java Plug-in 1.5.0_05 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
    {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - Java Plug-in 1.5.0_06 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - Java Plug-in 1.5.0_06 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

    »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

    Checking files in %ALLUSERSPROFILE%\Startup folder...
    05-11-17 16:25:06 1757 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk ()
    05-03-30 22:51:04 HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini ()
    06-02-28 21:39:34 551 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk ()
    05-12-09 01:27:34 1777 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk ()
    06-02-13 02:15:02 1719 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MiniEYE-MiniREAD Launch.lnk ()
    05-09-07 07:31:20 787 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk ()

    Checking files in %ALLUSERSPROFILE%\Application Data folder...
    05-03-30 14:39:06 HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini ()
    06-05-03 14:16:24 1303 C:\Documents and Settings\All Users\Application Data\hpzinstall.log ()
    06-06-26 08:54:12 1359 C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache ()

    Checking files in %USERPROFILE%\Startup folder...
    05-03-30 22:51:04 HS 84 C:\Documents and Settings\ShawnW\Start Menu\Programs\Startup\desktop.ini ()

    Checking files in %USERPROFILE%\Application Data folder...
    05-03-30 14:39:04 HS 62 C:\Documents and Settings\ShawnW\Application Data\desktop.ini ()

    »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

    >>> Internet Explorer Settings <<<


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
    \\Start Page - http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
    \\Search Page - http://ie.search.msn.com
    \\Default_Page_URL - http://www.sony.com/vaiopeople
    \\Default_Search_URL - http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    \\Local Page - %SystemRoot%\system32\blank.htm

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main]
    \\Start Page - http://google.com/
    \\Search Page - http://ie.search.msn.com
    \\Default_Search_URL - http://ie.search.msn.com
    \\Local Page - C:\WINDOWS\SYSTEM32\blank.htm

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
    \\CustomizeSearch - http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
    \\SearchAssistant - http://www.mrfindalot.com/search.asp?si=


    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    \\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Microsoft Url Search Hook = %SystemRoot%\system32\shdocvw.dll (Microsoft Corporation)

    >>> BHO's <<<
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

    >>> Internet Explorer Bars, Toolbars and Extensions <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
    \{4D5C8C25-D075-11d0-B416-00C04FB90376} - &Tip of the Day = %SystemRoot%\system32\shdocvw.dll (Microsoft Corporation)

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
    \{EFA24E64-B078-11D0-89E4-00C04FC9E26E} - Explorer Band = %SystemRoot%\system32\shdocvw.dll (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
    \ShellBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Address = %SystemRoot%\system32\browseui.dll (Microsoft Corporation)
    \WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Address = %SystemRoot%\system32\browseui.dll (Microsoft Corporation)
    \WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383} - &Links = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation)
    \WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} - = ()
    \WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - Norton Internet Security = C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
    \WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus = C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\CmdMapping]
    \\{FB5F1910-F110-11d2-BB9E-00C04F795683} - 8192 = Windows Messenger
    \\NEXTID - 8198
    \\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 8193 = Sun Java Console
    \\{92780B25-18CC-41C8-B9BE-3C9C571A8263} - 8194 =
    \\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - 8195 =
    \\{A75C6120-9B36-11d4-A3F0-009027427750} - 8196 =
    \\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - 8197 =

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
    \{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - MenuText: Sun Java Console = C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll (Sun Microsystems, Inc.)
    \{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - MenuText: Sun Java Console = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)(HKCU CLSID)
    \{92780B25-18CC-41C8-B9BE-3C9C571A8263} - ButtonText: Research =
    \{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - ButtonText: AIM = C:\Program Files\AIM\aim.exe (America Online, Inc.)
    \{FB5F1910-F110-11d2-BB9E-00C04F795683} - ButtonText: Messenger = C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

    >>> Approved Shell Extensions (Non-Microsoft Only) <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    \\{42071714-76d4-11d1-8b24-00a0c9068ff3} - Display Panning CPL Extension = deskpan.dll ()
    \\{764BF0E1-F219-11ce-972D-00AA00A14F56} - Shell extensions for file compression = ()
    \\{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} - Encryption Context Menu = ()
    \\{88895560-9AA2-1069-930E-00AA0030EBC8} - HyperTerminal Icon Ext = C:\WINDOWS\system32\hticons.dll (Hilgraeve, Inc.)
    \\{0DF44EAA-FF21-4412-828E-260A8728E7F1} - Taskbar and Start Menu = ()
    \\{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} - Autoplay for SlideShow = ()
    \\{7A9D77BD-5403-11d2-8785-2E0420524153} - User Accounts = ()
    \\{ED58A35B-B554-42AF-A26C-6F3D424200D3} - Sony Power Management Extensiond = C:\Program Files\Sony\VAIO Power Management\SPMPanel.dll (Sony Corporation)
    \\{DEE12703-6333-4D4E-8F34-738C4DCC2E04} - RecordNow! SendToExt = C:\Program Files\Sonic\RecordNow!\shlext.dll ()
    \\{E91B2703-013E-4A99-AD33-2B6FB00AA356} - RecordNow! ContextMenuExt = C:\Program Files\Sonic\RecordNow!\shlext.dll ()
    \\{FA010552-4A27-4cb1-A1BB-3E2D697F1639} - SpySubtract Shell Extension = ()
    \\{C6643EC0-49AC-4c15-A455-04104DB900A9} - Image Converter context menu extension = C:\PROGRA~1\Sony\IMAGEC~1\CtxMenu.dll ( )
    \\{41bad023-93c0-43c3-b197-81eab1a0e5b0} - Samsung YP-55Shell Hook = YP55h.dll (Samsung, Inc.)
    \\{B41DB860-8EE4-11D2-9906-E49FADC173CA} - WinRAR shell extension = C:\Program Files\WinRAR\rarext.dll ()
    \\{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - Shell Extensions for RealOne Player = C:\Program Files\Real\RealPlayer\rpshell.dll (RealNetworks, Inc.)
    \\{32020A01-506E-484D-A2A8-BE3CF17601C3} - AlcoholShellEx = ()
    \\{516EC4D3-4AD9-11D5-AA6A-00E0189008B3} - The Core Media Player Shell Extension = C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL ()
    \\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} - AVG7 Shell Extension = C:\Program Files\Grisoft\AVG Free\avgse.dll (GRISOFT, s.r.o.)
    \\{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} - AVG7 Find Extension = C:\Program Files\Grisoft\AVG Free\avgse.dll (GRISOFT, s.r.o.)

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

    >>> Context Menu Handlers (Non-Microsoft Only) <<<
    [HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers]
    \AVG7 Shell Extension - {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll (GRISOFT, s.r.o.)
    \ewido anti-spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll (Anti-Malware Development a.s.)
    \ImageConverter2 - {C6643EC0-49AC-4c15-A455-04104DB900A9} = C:\PROGRA~1\Sony\IMAGEC~1\CtxMenu.dll ( )
    \Symantec.Norton.Antivirus.IEContextMenu - {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
    \WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll ()

    [HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers]

    [HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers]
    \CoreShellAgent - {516EC4D3-4AD9-11D5-AA6A-00E0189008B3} = C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL ()
    \ewido anti-spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll (Anti-Malware Development a.s.)
    \ImageConverter2 - {C6643EC0-49AC-4c15-A455-04104DB900A9} = C:\PROGRA~1\Sony\IMAGEC~1\CtxMenu.dll ( )
    \WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll ()

    [HKEY_LOCAL_MACHINE\Software\Classes\Directory\BackGround\shellex\ContextMenuHandlers]
    \igfxcui - {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} = C:\WINDOWS\system32\igfxpph.dll (Intel Corporation)
    \ImageConverter2 - {C6643EC0-49AC-4c15-A455-04104DB900A9} = C:\PROGRA~1\Sony\IMAGEC~1\CtxMenu.dll ( )

    [HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers]
    \AVG7 Shell Extension - {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll (GRISOFT, s.r.o.)
    \Symantec.Norton.Antivirus.IEContextMenu - {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
    \WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll ()

    >>> Column Handlers (Non-Microsoft Only) <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
    \{F9DB5320-233E-11D1-9F84-707F02C10627} - PDF Column Info = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll (Adobe Systems, Inc.)

    >>> Registry Run Keys <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    TkBellExe - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
    SmartWiConnectionUtility - C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe (Sony Electronics Corporation)
    ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
    AVG7_CC - C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe (GRISOFT, s.r.o.)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
    IMAIL Installed = 1
    MAPI Installed = 1
    MSFS Installed = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    Steam - Reg Data missing or invalid ()
    ctfmon.exe - C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
    Yahoo! Pager - C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE (Yahoo! Inc.)

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

    >>> Startup Links <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\\Common Startup]
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini ()
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.)
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe (InterVideo Inc.)
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MiniEYE-MiniREAD Launch.lnk - C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe ()
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\SpySub.exe (InterMute, Inc.)

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\\Startup]
    C:\Documents and Settings\ShawnW\Start Menu\Programs\Startup\desktop.ini ()

    >>> MSConfig Disabled Items <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

    [All Users Startup Folder Disabled Items]

    [Current User Startup Folder Disabled Items]

    >>> User Agent Post Platform <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    \\sv1 -

    >>> AppInit Dll's <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs]

    >>> Image File Execution Options <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
    \Your Image File Name Here without a path - Debugger = ntsd -d

    >>> Shell Service Object Delay Load <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    \\PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation)
    \\CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation)
    \\WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll (Microsoft Corporation)
    \\SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)

    >>> Shell Execute Hooks <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    \\{AEB6717E-7E19-11d0-97EE-00C04FD91972} - URL Exec Hook = shell32.dll (Microsoft Corporation)
    \\{FA010552-4A27-4cb1-A1BB-3E2D697F1639} - = ()
    \\{57B86673-276A-48B2-BAE7-C6DBB3020EB8} - CShellExecuteHookImpl Object = C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll (Anti-Malware Development a.s.)

    >>> Shared Task Scheduler <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

    >>> Winlogon <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    \\UserInit = c:\windows\system32\userinit.exe,
    \\Shell = explorer.exe
    \\System =

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
    \crypt32chain - crypt32.dll = (Microsoft Corporation)
    \cryptnet - cryptnet.dll = (Microsoft Corporation)
    \cscdll - cscdll.dll = (Microsoft Corporation)
    \ScCertProp - wlnotify.dll = (Microsoft Corporation)
    \Schedule - wlnotify.dll = (Microsoft Corporation)
    \sclgntfy - sclgntfy.dll = (Microsoft Corporation)
    \SensLogn - WlNotify.dll = (Microsoft Corporation)
    \termsrv - wlnotify.dll = (Microsoft Corporation)
    \WgaLogon - WgaLogon.dll = (Microsoft Corporation)
    \wlballoon - wlnotify.dll = (Microsoft Corporation)
    \wzcnotif - wzcdlg.dll = (Microsoft Corporation)

    >>> DNS Name Servers <<<
    {2D7C4487-A5EE-4689-AA2C-4746C9800F29} - (Intel(R) PRO/100 VE Network Connection)
    {8E389B19-1E65-4DEF-B763-CD51E099A786} - (1394 Net Adapter)
    {A87C5DCE-4434-40B7-93F3-1DE1228E43A9} - (Intel(R) PRO/Wireless 2200BG Network Connection)
    {B5C036D0-A380-4892-A3FC-27035658C63B} - ()
    {E35E00B0-B0D3-4E27-BE23-7DA62F6DB2A8} - (Sony Ericsson Wireless WAN Adapter)

    >>> All Winsock2 Catalogs <<<
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries]
    \000000000001\\LibraryPath - %SystemRoot%\system32\wshbth.dll (Microsoft Corporation)
    \000000000002\\LibraryPath - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation)
    \000000000003\\LibraryPath - %SystemRoot%\System32\winrnr.dll (Microsoft Corporation)
    \000000000004\\LibraryPath - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation)
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries]
    \000000000001\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000002\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000003\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000004\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000005\\PackedCatalogItem - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation)
    \000000000006\\PackedCatalogItem - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation)
    \000000000007\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000008\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000009\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000010\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000011\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000012\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000013\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000014\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000015\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000016\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000017\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000018\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000019\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
    \000000000020\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)

    >>> Protocol Handlers (Non-Microsoft Only) <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler]
    \ipp - ()
    \msdaipp - ()

    >>> Protocol Filters (Non-Microsoft Only) <<<
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter]

    >>> Selected AddOn's <<<


    »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
     
    swidjaja, Sep 9, 2006
    #18
  19. maca1

    maca1 Regular member

    Joined:
    Mar 15, 2006
    Messages:
    630
    Likes Received:
    0
    Trophy Points:
    26
    rescan with hijackthis and check and fix this if its still there

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=


    search for and delete this file using Start - Search

    kst8c509.dll

    post a new hijackthis log






     
    Last edited: Sep 10, 2006
    maca1, Sep 10, 2006
    #19
  20. swidjaja

    swidjaja Member

    Joined:
    Aug 26, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    kst8c509.dll was not found. perhaps it was removed when R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si= was fixed?

    Logfile of HijackThis v1.99.1
    Scan saved at 13:40, on 06-09-10
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Sony\HotKey Utility\HKServ.exe
    C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    C:\WINDOWS\system32\igfxext.exe
    C:\Program Files\Sony\HotKey Utility\HKWnd.exe
    C:\WINDOWS\Drivers\Touchpad\Apoint.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\ShawnW\Desktop\Shelf\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SmartWiConnectionUtility] C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe /WindowsStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
    O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
    O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
    O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

     
    swidjaja, Sep 10, 2006
    #20
Page 1 of 2

Share This Page