Looks better, we need to look a little further. Once we get you clean you need to decide which antivirus you want to keep and uninstall the other, as they will conflict and cause you problems. Please download SilentRunners from this link Please download SilentRunners from here: http://www.silentrunners.org/Silent%20Runners.zip. Unzip it to the desktop and double-click on it. If you get any kind of warning message about scripts, please choose to allow the script to run. When the scan is finished, it will create a logfile on the desktop. Please post the entire contents of this logfile in a reply to this post.. Unzip it to the desktop and double-click on it. If you get any kind of warning message about scripts, please choose to allow the script to run. When the scan is finished, it will create a logfile on the desktop. Please post the entire contents of this logfile in a reply to this post. Run this free online scan from Panda When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to the desktop, then copy/paste into the text editor and post it.

0

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: ---- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "googletalk" = ""C:\Program Files\Google\Google Talk\googletalk.exe" /autostart" ["Google"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"] "HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"] "CamMonitor" = "c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [empty string] "Share-to-Web Namespace Daemon" = "c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"] "KBD" = "C:\HP\KBD\KBD.exe" ["Hewlett-Packard Company"] "StorageGuard" = ""C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"] "Recguard" = "C:\WINDOWS\SMINST\RECGUARD.exe" [empty string] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"] "ccApp" = ""c:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "ccRegVfy" = ""C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS] "QD FastAndSafe" = "*a" (unwritable string) [file not found] "Microsoft Works Update Detection" = "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" ["Microsoft® Corporation"] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "ViewMgr" = "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" ["Viewpoint Corporation"] "Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"] "LWBMOUSE" = "C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.exe" [empty string] "iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."] "QuickTime Task" = ""C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "Zone Labs Client" = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"] "PrevxOne" = "C:\Program Files\Prevx1\PXConsole.exe" ["Prevx"] "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "!ewido" = ""C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {13467341-860E-40FA-9B09-F73198D6639E}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\awvtu.dll" [null data] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" [null data] {55EA1964-F5E4-4D6A-B9B2-125B37655FCB}\(Default) = "Malicious Scripts Scanner" -> {HKLM...CLSID} = "URLDetector Class" \InProcServer32\(Default) = "C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll" ["Prevx Ltd."] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Share-to-Web Upload Folder" -> {HKLM...CLSID} = "Share-to-Web Upload Folder" \InProcServer32\(Default) = "c:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "SampleView" -> {HKLM...CLSID} = "SampleView" \InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" = "OmniPass Shell Extension" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] "{4EB37360-49E8-11D3-95B5-004033382980}" = "ALZip 4.0 Context Menu Shell Extension" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\OpenOffice.org1.1.0\program\shlxthdl.dll" ["Sun Microsystems, Inc."] "{709C6E11-538F-4759-86AC-6ACB302AA0DE}" = "Desktop Manager" -> {HKLM...CLSID} = "Desktop Manager" \InProcServer32\(Default) = "C:\WINDOWS\System32\msvdm.dll" [null data] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! awvtu\DLLName = "C:\WINDOWS\system32\awvtu.dll" [null data] INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"] INFECTION WARNING! OPXPGina\DLLName = "C:\Program Files\Softex\OmniPass\opxpgina.dll" [null data] INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] OPShellE\(Default) = "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] OPShellE\(Default) = "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] DESKTOP.INI DLL launch in local fixed drive directories: --------------------------- D:\cmdcons\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\MiniNT\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\PRELOAD\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\I386\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\TOOLS\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\hp\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] Startup items in "Justin" & "All Users" startup folders: --------------------------- C:\Documents and Settings\Justin\Start Menu\Programs\Startup "spamsubtract" -> shortcut to: "C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe -q" ["interMute, Inc."] C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Quicken Scheduled Updates" -> shortcut to: "C:\Program Files\Quicken\bagent.exe" ["Intuit Inc."] "Updates from HP" -> shortcut to: "C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe -startup" [null data] Enabled Scheduled Tasks: ------------------------ "Norton AntiVirus - Scan my computer" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"] "Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE" ["Symantec Corporation"] "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.exe" ["Symantec Corporation"] Winsock2 Service Provider DLLs: -- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: SpSubLSP.dll ["interMute, Inc."], 01 - 05, 11 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------- Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" = (no title provided) -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] "{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided) -> {HKLM...CLSID} = "ICQ Toolbar" \InProcServer32\(Default) = "C:\Program Files\ICQToolbar\toolbaru.dll" ["ICQ Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {8F4902B6-6C04-4ADE-8052-AA58578A21BD}\(Default) = (no title provided) -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS] Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}\(Default) = "hp toolkit" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {09FE188B-6E85-479E-9411-51FB2220DF80}\ "ButtonText" = "Subscribe in Desktop Sidebar" "MenuText" = "Subscribe in Desktop Sidebar" "CLSIDExtension" = "{45AD732C-2CE2-4666-B366-B2214AD57A49}" {AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\ "ButtonText" = "AIM" "Exec" = "C:\Program Files\AIM\aim.exe" ["America Online, Inc."] {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\ "ButtonText" = "Yahoo! Messenger" "MenuText" = "Yahoo! Messenger" "Exec" = "C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe" [file not found] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points - C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Missing lines (compared with English-language version): [Strings]: 1 line Running Services (Display Name, Service Name, Path {Service DLL}): -------- AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."] iPodService, iPodService, "C:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."] Norton AntiVirus Auto Protect Service, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] Norton Unerase Protection, NProtectService, ""C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe"" ["Symantec Corporation"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Prevx Agent, PREVXAgent, ""C:\Program Files\Prevx1\PXAgent.exe" -f" ["Prevx"] Softex OmniPass Service, omniserv, "C:\Program Files\Softex\OmniPass\Omniserv.exe" [null data] Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] SymWMI Service, SymWSC, ""C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"] TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 165 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 27 seconds. ---------- (total run time: 278 seconds)

0

I am currently running Panda, however I have a question - it gave me a choice on what to scan, should i scan everything or just a specific one? Thank you for all your help so far.

0

Please download “Avenger” by swandog46 to your desktop from this link http://swandog46.geekstogo.com/avenger.zip 1. Click on Avenger.zip to open the file Extract avenger.exe to your desktop 2. Copy all the text contained in the area between the X"s below to your Clipboard by highlighting it and pressing (Ctrl+C): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Files to delete: C:\WINDOWS\system32\awvtu.dll XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. 3. Now, start The Avenger program by clicking on its icon on your desktop. Under "Script file to execute" choose "Input Script Manually". Now click on the Magnifying Glass icon which will open a new window titled "View/edit script" Paste the text copied to clipboard into this window by pressing (Ctrl+V). Click Done Now click on the Green Light to begin execution of the script Answer "Yes" twice when prompted. 4. The Avenger will automatically do the following: It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.) On reboot, it will briefly open a black command window on your desktop, this is normal. After the restart, it creates a log file that should open with the results of Avenger's actions. This log file will be located at C:\avenger.txt The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip. 5. Please copy/paste the content of c:\avenger.txt into your reply and post a new Hijack This log.

0

Panda is still scanning. don't want to take the next step untill it is finishes since it restarts.

0

Results from panda scan of My Computer Incident Status Location Adware:adware/cydoor Not disinfected C:\WINDOWS\system32\CD_CLINT.DLL Adware:adware/navhelper Not disinfected c:\program files\NavExcel Hacktool:rootkit/zaqt.a Not disinfected hkey_local_machine\system\currentcontrolset\services\DP1112 Hacktool:rootkit/fu.a Not disinfected hkey_local_machine\system\currentcontrolset\services\msdirectx Adware:adware/savenow Not disinfected Windows Registry Spyware:Cookie/Gorillanation Not disinfected C:\Documents and Settings\Default User\Cookies\owner@ads.gorillanation[1].txt Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Default User\Cookies\owner@bravenet[1].txt Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Default User\Cookies\owner@c2.gostats[2].txt Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Default User\Cookies\owner@peel[1].txt Spyware:Cookie/Mircx Not disinfected C:\Documents and Settings\Default User\Cookies\owner@pop.mircx[1].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Justin\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\cookies.txt[.go.com/] Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Justin\Application Data\Phoenix\Profiles\Default User\gw9zlp1r.slt\cookies.txt[.go.com/] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Justin\Desktop\smitRem\Process.exe Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Justin\Desktop\smitRem.exe[smitRem/Process.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Justin\Local Settings\Application Data\Mozilla\Firefox\Profiles\jcnyqeq3.default\Cache\0C4879FCd01[smitRem/Process.exe] Spyware:Cookie/Gorillanation Not disinfected C:\Documents and Settings\Mark.YOUR-O0KWKW9JWC\Cookies\owner@ads.gorillanation[1].txt Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Mark.YOUR-O0KWKW9JWC\Cookies\owner@bravenet[1].txt Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Mark.YOUR-O0KWKW9JWC\Cookies\owner@c2.gostats[2].txt Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Mark.YOUR-O0KWKW9JWC\Cookies\owner@peel[1].txt Spyware:Cookie/Mircx Not disinfected C:\Documents and Settings\Mark.YOUR-O0KWKW9JWC\Cookies\owner@pop.mircx[1].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-1.txt[.realmedia.com/] Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-1.txt[.adultfriendfinder.com/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-1.txt[.dist.belnk.com/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-1.txt[.belnk.com/] Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-1.txt[.did-it.com/] Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-2.txt[.azjmp.com/] Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-2.txt[.bravenet.com/] Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Mozilla\Firefox\Profiles\1ynksf8q.default\cookies-2.txt[landing.domainsponsor.com/] Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Phoenix\Profiles\Default User\3kg5ieth.slt\cookies.txt[.go.com/] Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3c936701-6d62132f.zip[javainstaller/InstallerApplet.class] Spyware:Cookie/Gorillanation Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Cookies\owner@ads.gorillanation[1].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Cookies\owner@atwola[1].txt Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Cookies\owner@c2.gostats[2].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Cookies\owner@go[1].txt Spyware:Cookie/Mircx Not disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Cookies\owner@pop.mircx[1].txt Potentially unwanted tool:Application/HideWindow.A Not disinfected C:\hp\bin\FondleWindow.exe Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe Potentially unwanted tool:Application/KillApp.A Not disinfected C:\hp\bin\Terminator.exe Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.doubleclick.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.tribalfusion.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.mediaplex.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00278739.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.mediaplex.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.tribalfusion.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.doubleclick.net/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00278743.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.doubleclick.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00278902.MOZ[.go.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.doubleclick.net/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.mediaplex.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00278912.MOZ[.go.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.doubleclick.net/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.mediaplex.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00279201.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.doubleclick.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00279364.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.doubleclick.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00279514.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.doubleclick.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00279527.MOZ[.go.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.doubleclick.net/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.mediaplex.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.zedo.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.questionmarket.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00279580.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.doubleclick.net/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.questionmarket.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.tribalfusion.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.zedo.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00279593.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.mediaplex.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.tribalfusion.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.doubleclick.net/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.questionmarket.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.zedo.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.atwola.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.c2.gostats.com/] Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.gostats.com/] Spyware:Cookie/Gorillanation Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[ads.gorillanation.com/] Spyware:Cookie/Go Not disinfected C:\RECYCLER\NPROTECT\00279609.MOZ[.go.com/] Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\NPROTECT\00279613.MOZ[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\NPROTECT\00279613.MOZ[.doubleclick.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\NPROTECT\00279613.MOZ[.tribalfusion.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\NPROTECT\00279613.MOZ[.questionmarket.com/] Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\NPROTECT\00279613.MOZ[ad.yieldmanager.com/] Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00279613.MOZ[.zedo.com/] Spyware:Cookie/Atwola Not disinfected C:\RECYCLER\NPROTECT\00279613.MOZ[.atwola.com/] S

0

When i ran avenger as requested the log file is empty.

0

new hijack this... Logfile of HijackThis v1.99.1 Scan saved at 8:44:53 PM, on 7/30/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Softex\OmniPass\Omniserv.exe C:\Program Files\Softex\OmniPass\OPXPApp.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\HP\KBD\KBD.exe c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\Google\Google Talk\googletalk.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.exe O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.exe TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing) O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

0

Empty the Norton Protected Recycle Bin: Right-click the Norton Protected Recycle Bin icon, and then click Empty Norton Protected Files. Follow the prompts. Navigate to and delete the contents of these folders: C:\Documents and Settings\Mark.YOUR-O0KWKW9JWC\Cookies C:\Documents and Settings\Default User\Cookies Reboot into safe mode. Double-click on Killbox.exe to run it. Put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time. C:\WINDOWS\system32\CD_CLINT.DLL c:\program files\NavExcel Hacktool:rootkit/zaqt.a Click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box. While still in safe mode navigate to and delete this folder: c:\program files\NavExcel Reboot to normal mode and run silentrunners once more and post its log please.

0

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: ---- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "googletalk" = ""C:\Program Files\Google\Google Talk\googletalk.exe" /autostart" ["Google"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"] "HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"] "CamMonitor" = ""c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe"" [empty string] "Share-to-Web Namespace Daemon" = ""c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"" ["Hewlett-Packard"] "KBD" = "C:\HP\KBD\KBD.exe" ["Hewlett-Packard Company"] "StorageGuard" = ""C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"] "Recguard" = "C:\WINDOWS\SMINST\RECGUARD.exe" [empty string] "NvCplDaemon" = ""RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = ""nwiz.exe" /install" ["NVIDIA Corporation"] "PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"] "ccApp" = ""c:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "ccRegVfy" = ""C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"" ["Sun Microsystems, Inc."] "NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Tweak UI" = ""RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp" [MS] "QD FastAndSafe" = (empty string) "Microsoft Works Update Detection" = ""C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"" ["Microsoft® Corporation"] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "ViewMgr" = ""C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe"" ["Viewpoint Corporation"] "Symantec NetDriver Monitor" = ""C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer" ["Symantec Corporation"] "LWBMOUSE" = ""C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.exe"" [empty string] "iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."] "QuickTime Task" = ""C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "Zone Labs Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"] "PrevxOne" = ""C:\Program Files\Prevx1\PXConsole.exe"" ["Prevx"] "AVG7_CC" = ""C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP" ["GRISOFT, s.r.o."] "!ewido" = ""C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."] "SpySweeper" = ""C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray" ["Webroot Software, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" [null data] {55EA1964-F5E4-4D6A-B9B2-125B37655FCB}\(Default) = "Malicious Scripts Scanner" -> {HKLM...CLSID} = "URLDetector Class" \InProcServer32\(Default) = "C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll" ["Prevx Ltd."] {6CE32636-8AD6-4FCB-817E-994D56EC588B}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\awvtu.dll" [null data] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Share-to-Web Upload Folder" -> {HKLM...CLSID} = "Share-to-Web Upload Folder" \InProcServer32\(Default) = "c:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "SampleView" -> {HKLM...CLSID} = "SampleView" \InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" = "OmniPass Shell Extension" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] "{4EB37360-49E8-11D3-95B5-004033382980}" = "ALZip 4.0 Context Menu Shell Extension" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\OpenOffice.org1.1.0\program\shlxthdl.dll" ["Sun Microsystems, Inc."] "{709C6E11-538F-4759-86AC-6ACB302AA0DE}" = "Desktop Manager" -> {HKLM...CLSID} = "Desktop Manager" \InProcServer32\(Default) = "C:\WINDOWS\System32\msvdm.dll" [null data] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! awvtu\DLLName = "C:\WINDOWS\system32\awvtu.dll" [null data] INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"] INFECTION WARNING! OPXPGina\DLLName = "C:\Program Files\Softex\OmniPass\opxpgina.dll" [null data] INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS] INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] OPShellE\(Default) = "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] OPShellE\(Default) = "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] DESKTOP.INI DLL launch in local fixed drive directories: --------------------------- D:\cmdcons\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\MiniNT\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\PRELOAD\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\I386\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\TOOLS\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\hp\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] Startup items in "Justin" & "All Users" startup folders: --------------------------- C:\Documents and Settings\Justin\Start Menu\Programs\Startup "spamsubtract" -> shortcut to: "C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe -q" ["interMute, Inc."] C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Quicken Scheduled Updates" -> shortcut to: "C:\Program Files\Quicken\bagent.exe" ["Intuit Inc."] "Updates from HP" -> shortcut to: "C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe -startup" [null data] Enabled Scheduled Tasks: ------------------------ "Norton AntiVirus - Scan my computer" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"] "Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE" ["Symantec Corporation"] "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.exe" ["Symantec Corporation"] "wrSpySweeperTrialSweep" -> launches: "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /ScheduleSweep=wrSpySweeperTrialSweep" ["Webroot Software, Inc."] Winsock2 Service Provider DLLs: -- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: SpSubLSP.dll ["interMute, Inc."], 01 - 05, 11 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------- Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" = (no title provided) -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] "{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided) -> {HKLM...CLSID} = "ICQ Toolbar" \InProcServer32\(Default) = "C:\Program Files\ICQToolbar\toolbaru.dll" ["ICQ Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {8F4902B6-6C04-4ADE-8052-AA58578A21BD}\(Default) = (no title provided) -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS] Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}\(Default) = "hp toolkit" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {09FE188B-6E85-479E-9411-51FB2220DF80}\ "ButtonText" = "Subscribe in Desktop Sidebar" "MenuText" = "Subscribe in Desktop Sidebar" "CLSIDExtension" = "{45AD732C-2CE2-4666-B366-B2214AD57A49}" {AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\ "ButtonText" = "AIM" "Exec" = "C:\Program Files\AIM\aim.exe" ["America Online, Inc."] {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\ "ButtonText" = "Yahoo! Messenger" "MenuText" = "Yahoo! Messenger" "Exec" = "C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe" [file not found] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points - C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Missing lines (compared with English-language version): [Strings]: 1 line Running Services (Display Name, Service Name, Path {Service DLL}): -------- AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."] iPodService, iPodService, "C:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."] Norton AntiVirus Auto Protect Service, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] Norton Unerase Protection, NProtectService, ""C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe"" ["Symantec Corporation"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Softex OmniPass Service, omniserv, "C:\Program Files\Softex\OmniPass\Omniserv.exe" [null data] Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] SymWMI Service, SymWSC, ""C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"] TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"] Webroot Spy Sweeper Engine, WebrootSpySweeperService, ""C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe"" ["Webroot Software, Inc."] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 395 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 64 seconds. ---------- (total run time: 590 seconds)

0

Vundo is still there, lets try this tool. Download VundoFix at http://www.atribune.org/ccount/click.php?id=4 and save it to your desktop. Double-click VundoFix.exe to run it. Put a check next to 'Run VundoFix as a task'. You will receive a message saying vundofix will close and re-open in a minute or less. Click OK. When VundoFix re-opens, right click inside the white box and click 'Add More Files?' Copy and paste the below entries into each line: C:\WINDOWS\system32\awvtu.dll C:\WINDOWS\system32\utvwa.* Click 'Add Files' and click 'Close Window'. Click 'Scan for Vundo' button. Once it's done scanning, click the 'Remove Vundo' button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will shutdown your computer. click OK. Turn your computer back on. Please post the contents of C:\vundofix.txt here. Post a new silentrunners log please.

0

This thing does not want to get fixed. When i click run as a task it never reopens, if i reopen it it says error:75 path/file access error. On top of that, i cant open My computer..control panel, ect now.

0

I got it to work with a restart. VundoFix V5.1.6 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version... Java version is 1.4.2.1 Java version is 1.4.2.6 Java version is 1.5.0.2 Java version is 1.5.0.4 Java version is 1.5.0.6 Scan started at 11:52:52 AM 7/31/2006 Listing files found while scanning.... C:\windows\system32\awvtu.dll C:\windows\system32\utvwa.ini C:\windows\system32\utvwa.bak1 C:\windows\system32\utvwa.bak2 C:\windows\system32\utvwa.ini2 Beginning removal... The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\awvtu.dll C:\windows\system32\awvtu.dll Has been deleted! Attempting to delete C:\windows\system32\utvwa.ini C:\windows\system32\utvwa.ini Has been deleted! Attempting to delete C:\windows\system32\utvwa.bak1 C:\windows\system32\utvwa.bak1 Has been deleted! Attempting to delete C:\windows\system32\utvwa.bak2 C:\windows\system32\utvwa.bak2 Has been deleted! Attempting to delete C:\windows\system32\utvwa.ini2 C:\windows\system32\utvwa.ini2 Has been deleted! Performing Repairs to the registry. Done!

0

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: ---- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvMediaCenter" = ""RUNDLL32.EXE" C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" [MS] "googletalk" = ""C:\Program Files\Google\Google Talk\googletalk.exe" /autostart" ["Google"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"] "HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"] "CamMonitor" = ""c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe"" [empty string] "Share-to-Web Namespace Daemon" = ""c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"" ["Hewlett-Packard"] "KBD" = "C:\HP\KBD\KBD.exe" ["Hewlett-Packard Company"] "StorageGuard" = ""C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"] "Recguard" = "C:\WINDOWS\SMINST\RECGUARD.exe" [empty string] "NvCplDaemon" = ""RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = ""nwiz.exe" /install" ["NVIDIA Corporation"] "PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"] "ccApp" = ""c:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "ccRegVfy" = ""C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"" ["Sun Microsystems, Inc."] "NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Tweak UI" = ""RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp" [MS] "QD FastAndSafe" = (empty string) "Microsoft Works Update Detection" = ""C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"" ["Microsoft® Corporation"] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "ViewMgr" = ""C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe"" ["Viewpoint Corporation"] "Symantec NetDriver Monitor" = ""C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer" ["Symantec Corporation"] "LWBMOUSE" = ""C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.exe"" [empty string] "iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."] "QuickTime Task" = ""C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "Zone Labs Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"] "PrevxOne" = ""C:\Program Files\Prevx1\PXConsole.exe"" ["Prevx"] "AVG7_CC" = ""C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP" ["GRISOFT, s.r.o."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" [null data] {55EA1964-F5E4-4D6A-B9B2-125B37655FCB}\(Default) = "Malicious Scripts Scanner" -> {HKLM...CLSID} = "URLDetector Class" \InProcServer32\(Default) = "C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll" ["Prevx Ltd."] {73A4F193-957E-4AF0-A4BD-324C5404700B}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\awvtu.dll" [file not found] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Share-to-Web Upload Folder" -> {HKLM...CLSID} = "Share-to-Web Upload Folder" \InProcServer32\(Default) = "c:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "SampleView" -> {HKLM...CLSID} = "SampleView" \InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" = "OmniPass Shell Extension" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] "{4EB37360-49E8-11D3-95B5-004033382980}" = "ALZip 4.0 Context Menu Shell Extension" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\OpenOffice.org1.1.0\program\shlxthdl.dll" ["Sun Microsystems, Inc."] "{709C6E11-538F-4759-86AC-6ACB302AA0DE}" = "Desktop Manager" -> {HKLM...CLSID} = "Desktop Manager" \InProcServer32\(Default) = "C:\WINDOWS\System32\msvdm.dll" [null data] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"] INFECTION WARNING! OPXPGina\DLLName = "C:\Program Files\Softex\OmniPass\opxpgina.dll" [null data] INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS] INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] OPShellE\(Default) = "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] OPShellE\(Default) = "{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}" -> {HKLM...CLSID} = "OmniPass Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Softex\OmniPass\opshelle.dll" ["Softex Incorporated"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ ALZip\(Default) = "{4EB37360-49E8-11D3-95B5-004033382980}" -> {HKLM...CLSID} = "ALZip 5.0 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\ESTsoft\ALZip\AZCTM.DLL" [null data] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Local Settings\Application Data\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] DESKTOP.INI DLL launch in local fixed drive directories: --------------------------- D:\cmdcons\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\MiniNT\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\PRELOAD\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\I386\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\TOOLS\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] D:\hp\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} -> {HKLM...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"] Startup items in "Owner" & "All Users" startup folders: -------------------------- C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Start Menu\Programs\Startup "Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "OpenOffice.org 1.1.0" -> shortcut to: "C:\Program Files\OpenOffice.org1.1.0\program\quickstart.exe" [null data] "spamsubtract" -> shortcut to: "C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe -q" ["interMute, Inc."] C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Quicken Scheduled Updates" -> shortcut to: "C:\Program Files\Quicken\bagent.exe" ["Intuit Inc."] "Updates from HP" -> shortcut to: "C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe -startup" [null data] Enabled Scheduled Tasks: ------------------------ "At4" -> launches: "c:\windows\system32\VundoFix.exe" [file not found] "At5" -> launches: "c:\windows\system32\VundoFix.exe" [file not found] "Norton AntiVirus - Scan my computer" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"] "Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE" ["Symantec Corporation"] "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.exe" ["Symantec Corporation"] "wrSpySweeperTrialSweep" -> launches: "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /ScheduleSweep=wrSpySweeperTrialSweep" ["Webroot Software, Inc."] Winsock2 Service Provider DLLs: -- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: SpSubLSP.dll ["interMute, Inc."], 01 - 05, 11 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------- Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" = (no title provided) -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] "{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided) -> {HKLM...CLSID} = "ICQ Toolbar" \InProcServer32\(Default) = "C:\Program Files\ICQToolbar\toolbaru.dll" ["ICQ Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {8F4902B6-6C04-4ADE-8052-AA58578A21BD}\(Default) = (no title provided) -> {HKLM...CLSID} = "hp toolkit" \InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS] Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}\(Default) = "hp toolkit" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\HP\EXPLOREBAR\HPTOOLKT.DLL" ["Hewlett-Packard Company"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {09FE188B-6E85-479E-9411-51FB2220DF80}\ "ButtonText" = "Subscribe in Desktop Sidebar" "MenuText" = "Subscribe in Desktop Sidebar" "CLSIDExtension" = "{45AD732C-2CE2-4666-B366-B2214AD57A49}" {AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\ "ButtonText" = "AIM" "Exec" = "C:\Program Files\AIM\aim.exe" ["America Online, Inc."] {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\ "ButtonText" = "Yahoo! Messenger" "MenuText" = "Yahoo! Messenger" "Exec" = "C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe" [file not found] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points - C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Missing lines (compared with English-language version): [Strings]: 1 line HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ "{855F3B16-6D32-4fe6-8A56-BBB695989046}" = (no title provided) -> {HKLM...CLSID} = "ICQ Toolbar" \InProcServer32\(Default) = "C:\Program Files\ICQToolbar\toolbaru.dll" ["ICQ Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): -------- AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."] HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]} iPodService, iPodService, "C:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."] Norton AntiVirus Auto Protect Service, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] Norton Unerase Protection, NProtectService, ""C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe"" ["Symantec Corporation"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Prevx Agent, PREVXAgent, ""C:\Program Files\Prevx1\PXAgent.exe" -f" ["Prevx"] Softex OmniPass Service, omniserv, "C:\Program Files\Softex\OmniPass\Omniserv.exe" [null data] Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] SymWMI Service, SymWSC, ""C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"] TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"] Webroot Spy Sweeper Engine, WebrootSpySweeperService, ""C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe"" ["Webroot Software, Inc."] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 143 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 31 seconds. ---------- (total run time: 257 seconds)

0

That got it, your log should be clean now. You should add "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

Great, thanks a lot for all of your help with this.

0

Glad we could help.

0