Undetectable problem

Computing.Net > Forums > Security and Virus > Undetectable problem

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Undetectable problem

Name: rajanurs
Date: February 27, 2007 at 23:34:15 Pacific
OS: WinXPPro
CPU/Ram: 3GHZ-HT,RAM1024
Product: Intel

Comment:

Hi,
It appears something has attacked my system and I keep getting these alerts flooding my screen.
Here is a screen shot of the alert messages.
http://i48.photobucket.com/albums/f...
I did a scan with Adaware and it removed a few obeject. The problem did not comeup again for a few hours but now it is back. I did a virus scan as well but nothing was found.
What should I do next or should I use any other program to scan and detect the issue ?
Thanks for your help

Sponsored Link

Ads by Google

Response Number 1

Name: Kaithlyn
Date: February 28, 2007 at 03:39:00 Pacific

Reply:

i think there's problem with your email server, not with your computer. i would suggest you to contact your internet provider. good luck!
tc;

Response Number 2

Name: Jennifer SUMN
Date: February 28, 2007 at 06:41:56 Pacific

Reply:

What are you using for email? I'd remove the option to scan email messages in your Norton/Symantec configuration.
Life's more painless for the brainless.

Response Number 3

Name: rajanurs
Date: February 28, 2007 at 09:11:16 Pacific

Reply:

Using Outlook Express
Yes I could disable Symantec and also removed Outlook Express.
But what is causing the problem? The alert message says "Your email message was unable to be sent..."
This is happening even though I have never sent any emails.

Response Number 4

Name: jabuck
Date: February 28, 2007 at 15:15:16 Pacific

Reply:

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified.
Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Exit Hijack This.
Please download Comboscan from this link:
Comboscan

Close all applications and windows.
Double-click on comboscan.exe to run it, and follow the prompts.
When the scan is complete, a text file will open - ComboScan.txt
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of ComboScan.txt in your next post.
A folder, C:\ComboScan, will also open. In it will be another text file, Supplementary.txt.
Please attach Supplementary.txt to your post.
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

Response Number 5

Name: rajanurs
Date: February 28, 2007 at 21:56:18 Pacific

Reply:

Hi jabuck, thanks for responding :)
Here are the log files:
Hijack this:
http://rajanurs.googlepages.com/hij...
Comboscan:
http://rajanurs.googlepages.com/com...
Comboscan Supplementary:
http://rajanurs.googlepages.com/com...

In the meantime I had run AVG-Free edition and it caught a few virus and trojans
You can see them here: http://rajanurs.googlepages.com/avg...

fortemedia usbehci.sys cygwin editor	ıbm X206 ETHERNET DRİVER virtual ethernet cygwin ftp
See More

Response Number 6

Name: jabuck
Date: March 1, 2007 at 03:50:28 Pacific

Reply:

Please download VundoFix.exe to your C:\.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
Post the log located at C:Vundofix.txt.
Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Response Number 7

Name: rajanurs
Date: March 1, 2007 at 11:00:37 Pacific

Reply:

ok, it's done
VundoFix:
http://rajanurs.googlepages.com/vun...
SmitFraudFix:
http://rajanurs.googlepages.com/smi...

Response Number 8

Name: rajanurs
Date: March 1, 2007 at 11:16:47 Pacific

Reply:

Got this popping up...I clicked on Remove risk.
http://rajanurs.googlepages.com/aut...

Response Number 9

Name: jabuck
Date: March 1, 2007 at 15:12:41 Pacific

Reply:

Please post the following on the forum and not in a google link as to kept this easier to access as a group of scans. I should have said that to start with.
Please download Comboscan from this link:
Comboscan

Close all applications and windows.
Double-click on comboscan.exe to run it, and follow the prompts.
When the scan is complete, a text file will open - ComboScan.txt
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of ComboScan.txt in your next post.
A folder, C:\ComboScan, will also open. In it will be another text file, Supplementary.txt.
Please attach Supplementary.txt to your post.
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

Response Number 10

Name: rajanurs
Date: March 1, 2007 at 22:00:03 Pacific

Reply:

ComboScan v20070226.18 run by rajanurs on 2007-03-02 at 11:21:23
Computer is in Normal Mode.
----------------------
-- HijackThis (run as rajanurs.---------------------
Logfile of HijackThis v1.99.1
Scan saved at 11:21:24 AM, on 3/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\IBserver\apache\Apache.exe
C:\WINDOWS\system32\GSICON.exe
C:\WINDOWS\system32\gdmvstat.exe
C:\WINDOWS\system32\acsbvcc.exe
C:\WINDOWS\system32\cxmdxcs.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\system32\smcrsmm.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\MPA\MBackup\MBackup.exe
C:\IBserver\apache\Apache.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\IBserver\mysql\bin\mysqld-nt.exe
C:\Program Files VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
H:\+SECURITY\comboscan\comboscan.exe
C:\PROGRA~1\HIJACK~1\rajanurs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://localhost/joomla
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5B2D4732-1AE4-4AAD-8608-D6D01E351F5F} - C:\WINDOWS\system32\awvtq.dll
O2 - BHO: (no name) - {60FF4F1F-48E2-4C48-85EB-582AB2ACFC9C} - (no file)
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C} - C:\WINDOWS\system32\pmnoppq.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.exe
O4 - HKLM\..\Run: [kdmmcvs] C:\WINDOWS\system32\gdmvstat.exe
O4 - HKLM\..\Run: [ncsmmlg] C:\WINDOWS\system32\acsbvcc.exe
O4 - HKLM\..\Run: [csmhtop] C:\WINDOWS\system32\cxmdxcs.exe
O4 - HKLM\..\Run: [ddsysmns] C:\WINDOWS\system32\smcrsmm.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [The wave] C:\DOCUME~1\rajanurs\APPLIC~1\MANAGE~1\greyproc.exe
O4 - HKCU\..\Run: [kdmmcvs] C:\WINDOWS\system32\gdmvstat.exe
O4 - HKCU\..\Run: [ncsmmlg] C:\WINDOWS\system32\acsbvcc.exe
O4 - HKCU\..\Run: [csmhtop] C:\WINDOWS\system32\cxmdxcs.exe
O4 - HKCU\..\Run: [ddsysmns] C:\WINDOWS\system32\smcrsmm.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Shortcut to MBackup.exe.lnk = C:\Program Files\MPA\MBackup\MBackup.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add Link to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add Page to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add to &Windows Live Favorites - http://favorites.live.com/quickadd....
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: SiteBar - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: SiteBar Panel - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{57178EEB-AB3E-45CB-B2F8-BAE938692DA5}: NameServer = 125.22.47.125 202.56.250.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: awvtq - C:\WINDOWS\system32\awvtq.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: pmnoppq - C:\WINDOWS\SYSTEM32\pmnoppq.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - C:\IBserver\apache\Apache.exe" --ntservice (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DirectUpdate engine (DirectUpdate) - http://www.wildup.net/ - C:\Program Files\DirectUpdate v4\DUEngine.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: inetd - Unknown owner - C:\cygwin\bin\cygrunsrv.exe (file missing)
O23 - Service: MySql - Unknown owner - C:/IBserver/mysql/bin/mysqld-nt.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - J:\wamp\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - J:\wamp\mysql\bin\mysqld-nt.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe (file missing)

-- Files created between 2007-02-02 and 20----------
2007-03-02 00:19:49 444313 ---hs---- C:\WINDOWS\system32\qtvwa.bak1<QTVWA~1.BAK>
2007-03-02 00:19:02 282164 ---hs---- C:\WINDOWS\system32\awvtq.dll
2007-03-02 00:14:53 2316 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-02 00:14:10 79360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-03-02 00:14:10 40960 --a------ C:\WINDOWS\system32\swsc.exe
2007-03-02 00:14:10 135168 --a------ C:\WINDOWS\system32\swreg.exe
2007-03-02 00:14:10 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-03-02 00:14:10 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-03-02 00:14:09 53248 --a------ C:\WINDOWS\system32\Process.exe
2007-03-01 23:54:47 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-01 23:53:46 92160 --a------ C:\VundoFix.exe
2007-03-01 15:51:40 0 d-------- C:\Program Files\RegScrubXP<REGSCR~1>
2007-03-01 09:52:37 0 d-------- C:\ComboScan1<COMBOS~1>
2007-03-01 09:47:00 0 d-------- C:\Program Files\Hijackthis<HIJACK~1>
2007-03-01 09:41:53 19392 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-03-01 00:39:45 0 dr-h----- C:\$VAULT$.AVG
2007-03-01 00:39:40 12190760 -----n--- C:\AVG7QT.DAT
2007-03-01 00:32:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\AVG7
2007-03-01 00:31:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-03-01 00:31:47 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-03-01 00:31:46 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-03-01 00:31:46 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-03-01 00:31:46 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-03-01 00:31:45 775680 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-03-01 00:31:38 0 d-------- C:\Program Files\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-02-28 12:39:34 0 d--h----- C:\WINDOWS\system32\GroupPolicy<GROUPP~1>
2007-02-28 01:23:20 74267 --a------ C:\WINDOWS\bhgdscdscds.exe<BHGDSC~1.EXE>
2007-02-28 01:21:47 74267 --a------ C:\WINDOWS\uytrefvdsfd.exe<UYTREF~1.EXE>
2007-02-27 23:34:16 26637 ---hs---- C:\WINDOWS\system32\pmnoppq.dll
2007-02-27 23:22:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Base Hole Vga Bend<BASEHO~1>
2007-02-27 23:22:20 0 d-------- C:\Program Files\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:22:20 0 d-------- C:\Documents and Settings\rajanurs\Application Data\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:13:44 16384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-02-27 23:13:44 0 d-------- C:\WINDOWS\system32\Adobe
2007-02-27 23:11:58 0 d-------- C:\Adobe Illustrator Installer<ADOBEI~1>
2007-02-27 20:17:20 0 d--hs---- C:\WINDOWS\ftpcache
2007-02-27 20:17:13 0 d-------- C:\PhotoShopE Intro<PHOTOS~1>
2007-02-27 19:12:06 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Alien Skin<ALIENS~1>
2007-02-27 16:00:58 0 d-------- C:\Program Files\Sodipodi
2007-02-27 16:00:34 0 d-------- C:\Program Files\Common Files\GTK
2007-02-26 19:00:23 0 d-------- C:\Program Files\PhotoZoom Pro 2<PHOTOZ~1>
2007-02-26 12:22:18 0 d-------- C:\Program Files\MorpheusBar<MORPHE~1>
2007-02-26 12:21:21 0 d-------- C:\Program Files\Morpheus
2007-02-26 12:07:20 0 d-------- C:\Documents and Settings\rajanurs\Shared
2007-02-26 12:07:05 0 d-------- C:\Documents and Settings\rajanurs\Incomplete<INCOMP~1>
2007-02-26 12:04:06 0 d-------- C:\Documents and Settings\rajanurs\.limewire<LIMEWI~1>
2007-02-26 11:48:17 0 d-------- C:\Program Files\Java
2007-02-26 11:43:38 0 d-------- C:\Program Files\Common Files\Java
2007-02-24 01:00:23 589824 --a------ C:\WINDOWS\system32\CDRProX.dll
2007-02-24 01:00:18 0 d-------- C:\Program Files\Longtion
2007-02-22 19:48:38 0 d-------- C:\Program Files\WINK FlashDemoMaker<WINKFL~1>
2007-02-22 18:27:28 0 d-------- C:\WINDOWS\APW_DATA
2007-02-22 18:23:01 0 d-------- C:\Documents and Settings\All Users\Application Data\sbooks
2007-02-22 18:22:41 0 d-------- C:\Program Files\Screenbook Maker<SCREEN~1>
2007-02-21 11:20:13 110592 --a------ C:\WINDOWS\system32\tsccvid.dll
2007-02-20 12:31:53 204848 --a------ C:\WINDOWS\system32\gswin32c.exe
2007-02-20 12:31:42 196608 --a------ C:\WINDOWS\system32\Utility.dll
2007-02-20 12:31:41 368912 --a------ C:\WINDOWS\system32\vbar332.dll
2007-02-20 12:31:35 0 d-------- C:\Program Files\LogoSmartzTrial<LOGOSM~1>
2007-02-20 12:16:59 0 d-------- C:\Program Files\AAALOGO
2007-02-16 23:21:15 0 d-------- C:\Documents and Settings\rajanurs\Application Data\gtk-2.0
2007-02-16 23:20:10 0 d-------- C:\Program Files\Inkscape
2007-02-15 22:49:48 0 d-------- C:\WINDOWS\system32\Photosynth<PHOTOS~1>
2007-02-10 13:25:52 0 d-------- C:\Documents and Settings\rajanurs\Application Data\BackLinks Master<BACKLI~1>
2007-02-10 12:20:31 0 d-------- C:\Documents and Settings\rajanurs\Application Data\PaRaMeter<PARAME~1>
2007-02-10 12:20:29 0 d-------- C:\Program Files\PaRaMeter<PARAME~1>
2007-02-10 12:20:13 0 d-------- C:\Program Files\BackLinks Master<BACKLI~1>
2007-02-10 12:19:09 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Free Monitor for Google<FREEMO~1>
2007-02-10 12:19:05 0 d-------- C:\Program Files\Free Monitor for Google<FREEMO~1>

-- Find3M Re-----------
2007-03-02 11:09:03 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-03-02 01:23:22 0 d-------- C:\Program Files\Opera
2007-02-27 23:33:59 0 d-------- C:\Program Files\CPUMon
2007-02-27 23:33:58 0 d-------- C:\Program Files\WebDrive
2007-02-27 23:15:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Adobe
2007-02-27 23:13:44 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-27 23:13:16 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-27 00:32:20 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-02-25 21:48:29 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-02-15 22:50:18 3783 --a------ C:\WINDOWS\mozver.dat
2007-01-28 01:15:45 0 d-------- C:\Program Files\KKDict
2007-01-28 01:15:01 249856 -----n--- C:\WINDOWS\Setup1.exe
2007-01-28 01:15:00 73216 --a------ C:\WINDOWS\ST6UNST.exe
2007-01-15 02:04:50 0 d-------- C:\Program Files\Total Video Converter<TOTALV~1>
2007-01-14 16:24:44 0 d-------- C:\Program Files\Windows Media Connect 2<WI4DF6~1>
2007-01-14 04:29:44 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-01-14 04:29:36 0 d-------- C:\Program Files\Riva
2007-01-13 15:42:41 0 d-------- C:\Program Files\Google
2006-12-03 21:25:27 390240 --a------ C:\WINDOWS\system32\mkdriver.dll

-- Registry -----------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"The wave"="C:\\DOCUME~1\\rajanurs\\APPLIC~1\\MANAGE~1\\greyproc.exe"
"kdmmcvs"="C:\\WINDOWS\\system32\\gdmvstat.exe"
"ncsmmlg"="C:\\WINDOWS\\system32\\acsbvcc.exe"
"csmhtop"="C:\\WINDOWS\\system32\\cxmdxcs.exe"
"ddsysmns"="C:\\WINDOWS\\system32\\smcrsmm.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"GSICONEXE"="GSICON.EXE"
"kdmmcvs"="C:\\WINDOWS\\system32\\gdmvstat.exe"
"ncsmmlg"="C:\\WINDOWS\\system32\\acsbvcc.exe"
"csmhtop"="C:\\WINDOWS\\system32\\cxmdxcs.exe"
"ddsysmns"="C:\\WINDOWS\\system32\\smcrsmm.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"location"="Common Startup"
"item"="Microsoft Office"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlarmMe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AlarmMe"
"hkey"="HKLM"
"command"="\"D:\\Program Files\\Alarm Me\\AlarmMe.exe\" \"-h\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="eraser"
"hkey"="HKCU"
"command"="C:\\Program Files\\Eraser\\eraser.exe -hide"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsnMsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USSShReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ussshreg"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C}"=""
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=hex:00,00,00,00
"NoSaveSettings"=hex:00,00,00,00
"ClearRecentDocsOnExit"=hex:00,00,00,00
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awvtq
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnoppq

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{211c84df-b451-11da-ae03-806d6172696f}]
Shell\AutoRun\command E:\EISetup.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dfe8ba6d-b069-11db-9a59-000779300101}]
Shell\AutoRun\command ie.exe
Shell\explore\Command ie.exe
Shell\open\Command ie.exe

-- End of ComboScan: finished at 2007-03-02 at 11:2-

Response Number 11

Name: rajanurs
Date: March 1, 2007 at 22:05:17 Pacific

Reply:

NOTE: did not get any supplementary logfile this time.
This is the previously done Supplementary logfile [same as posted in the link above]:
ComboScan v20070226.18 run by rajanurs on 2007-03-01 at 09:52:37
Supplementary logfile - please post this as an attachment with your post.
----------------------
-- System Informa------
Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English
CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz
CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz
Percentage of Memory in Use: 31%
Physical Memory (total/avail): 1014.73 MiB / 690.25 MiB
Pagefile Memory (total/avail): 2439.85 MiB / 2187.35 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1999.25 MiB
C: is Fixed (NTFS) - 9.63 GiB total, 1.37 GiB free.
E: is CDROM (No Media)
F: is Fixed (NTFS) - 17.61 GiB total, 17.55 GiB free.
G: is Fixed (NTFS) - 18.84 GiB total, 18.78 GiB free.
H: is Fixed (NTFS) - 9.35 GiB total, 4.88 GiB free.
I: is Fixed (NTFS) - 9.38 GiB total, 9.33 GiB free.
J: is Fixed (NTFS) - 9.71 GiB total, 3.24 GiB free.

-- Security Ce---------
AUOptions is disabled.
Windows Internal Firewall is enabled.
FirstRunDisabled is set.
UpdatesDisableNotify is set.
AV: AVG 7.5.446 v7.5.446 (GRISOFT)
AV: Symantec AntiVirus Corporate Edition v10.0.0.359 (Symantec Corporation) [COLOR=RED]Disabled[/COLOR]

-- Environment Varia---
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\rajanurs\Application Data
BitRock=1
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=URS
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\rajanurs
LOGONSERVER=\\URS
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\GTK\2.0\bin
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 3, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0403
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\rajanurs\LOCALS~1\Temp
TMP=C:\DOCUME~1\rajanurs\LOCALS~1\Temp
USERDOMAIN=URS
USERNAME=rajanurs
USERPROFILE=C:\Documents and Settings\rajanurs
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI

-- User Prof-----------
rajanurs [I](admin)[/I]
Administrator [I](admin)[/I]
Guest [I](new local, guest)[/I]

-- Add/Remove Prog-----
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
123 Audio Video Merger --> "C:\Program Files\Manitools\123 Audio Video Merger\unins000.exe"
7-Zip 4.42 --> "C:\Program Files\7-Zip\Uninstall.exe"
AAA Logo 1.22 --> "C:\Program Files\AAALOGO\unins000.exe"
Acronis True Image --> C:\Program Files\Acronis\TrueImage\MediaBuilder.exe -uninstall
Ad-Aware SE Professional --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.exe C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\UninstFl.exe -q
Adobe Illustrator 10 Tryout --> "C:\Program Files\InstallShield Installation Information\{0AC416C3-A600-4A98-B5E1-A629498241DB}\setup.exe"
Adobe Photoshop 7.0.1 --> C:\WINDOWS\ISUNINST.exe -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 6.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-000000000001}
Adobe SVG Viewer 3.0 --> C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log
Advanced GIF Animator 2.23 --> "C:\Program Files\Advanced GIF Animator\unins000.exe"
Aestan Tray Menu 1.4.3 --> "J:\Uniform Server\TrayMenu\unins000.exe"
Amanda Backup Client 2.5.1p2 --> MsiExec.exe /I{2C6D1F54-79F7-4E40-8E16-5833818F5E99}
Animated Intro to Photoshop Elements 5.1 --> "C:\PhotoShopE Intro\unins000.exe"
AutoRun Pro Enterprise version 11 --> "C:\Program Files\Longtion\AutoRunPro Enterprise\unins000.exe"
AVG Free Edition --> C:\Program Files\Grisoft\AVG Free\setup.exe /UNINSTALL
BackLinks Master 1.4 --> "C:\Program Files\BackLinks Master\unins000.exe"
beetel DSL Modem --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C7B39B40-52C3-11D4-AFCE-00E0B8138A4A}\Setup.exe" -l0x9 REMOVE
Belarc Advisor 7.2 --> C:\PROGRA~1\Belarc\Advisor\Uninstall.exe C:\PROGRA~1\Belarc\Advisor\INSTALL.LOG
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
CiD Help --> C:\DOCUME~1\rajanurs\APPLIC~1\MANAGE~1\greyproc.exe -uninstall
CPUMon --> "C:\Program Files\CPUMon\unins000.exe"
DebugMode Wax 2.0 --> "C:\Program Files\DebugMode\Wax 2.0\uninst.exe"
DebugMode Wink --> "C:\Program Files\DebugMode\Wink\uninst.exe"
DirectUpdate --> "C:\Program Files\DirectUpdate v4\unins000.exe"
DiscWizard for Windows --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1BC8E02-6B5B-4B4A-A75F-B27A16918C2B}\Setup.exe"
Domain Name Analyzer v3.2.022303 --> "C:\Program Files\Softnik Technologies\Domain Name Analyzer\unins000.exe"
Drive Rescue 1.9 --> "C:\Program Files\Drive Rescue\unins000.exe"
Driver Genius 2004 --> C:\PROGRA~1\MYDRIV~1\UNWISE.exe C:\PROGRA~1\MYDRIV~1\INSTALL.LOG
Driver Magician Lite 2.8 --> "C:\Program Files\Driver Magician Lite\unins000.exe"
DriverMax 1.2 --> "C:\Program Files\Innovative Solutions\DriverMax\unins000.exe"
EditPlus 2 --> C:\Program Files\EditPlus 2\remove.exe
Eraser 5.8 --> "C:\Program Files\Eraser\unins000.exe"
FileZilla (remove only) --> "J:\Ravenswood-JS-1.0.11.1\FileZilla\uninstall.exe"
Firebird 1.5.0.4306 --> "C:\Program Files\IPCheck Server Monitor 5\Firebird\unins000.exe"
FlashDemo Pro version 2.0 --> "C:\Program Files\Longtion\FlashDemo Pro\unins000.exe"
Free Monitor for Google 2.2 --> "C:\Program Files\Free Monitor for Google\unins000.exe"
Google Desktop --> C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
Google Video Player --> "C:\Program Files\Google\Google Video Player\Uninstall.exe"
GTK+ 2.10.6-1 runtime environment --> "C:\Program Files\Common Files\GTK\2.0\setup\unins000.exe"
Hijackthis 1.99.1 --> "C:\Program Files\Hijackthis\unins000.exe"
HijackThis 1.99.1 --> H:\HiJackThis\HijackThis.exe /uninstall
IBserver version 1.0 (Beta) --> C:\IBserver\unins000.exe
InCD --> C:\WINDOWS\NuNInst.exe /UNINSTALL
Inkscape 0.45 --> "C:\Program Files\Inkscape\uninst.exe"
Intel(R) PRO Network Adapters and Drivers --> Prounstl.exe
J2SE Runtime Environment 5.0 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150010}
JSAS --> "C:\WINDOWS\JSAS\uninstall.exe" "/U:C:\Program Files\JSAS\Uninstall\uninstall.xml"
KK Dictionary Version 1.2 --> C:\WINDOWS\st6unst.exe -n "C:\Program Files\KKDict\ST6UNST.LOG"
LiveUpdate 2.6 (Symantec Corporation) --> C:\Program Files\Symantec\LiveUpdate\LSETUP.exe /U
LogoSmartz 4.0 Trial --> C:\PROGRA~1\LOGOSM~1\UNWISE.exe C:\PROGRA~1\LOGOSM~1\INSTALL.LOG
Macromedia Dreamweaver MX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B4AB829-DFD3-436D-B808-D9733D76C590}\Setup.exe" -l0x9 mmUninstall
Macromedia Extension Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}\setup.exe" -l0x9 mmUninstall
Macromedia Fireworks MX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{930B2432-43D4-11D5-9871-00C04F8EEB39}\Setup.exe" -l0x9 UNINSTALL
Macromedia Flash MX 2004 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2F353D44-73BB-4971-B31D-F7642E9E9531}\Setup.exe" -l0x9 UNINSTALL
Mehul's Backup 1.1 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\MPA\MBackup\Uninst.isu"
Messenger Plus! Live --> "C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
miFiles - My Internet Files 1.12d --> C:\Program Files\miFiles\uninst.exe
Mozilla Firefox (1.5.0.7) --> C:\Program Files\Mozilla Firefox\uninstall\uninstall.exe /ua "1.5.0.7 (en-US)"
Opera --> C:\PROGRA~1\Opera\uninst\unwise.exe C:\PROGRA~1\Opera\uninst\install.log
PaRaMeter 1.2 --> "C:\Program Files\PaRaMeter\unins000.exe"
PhotoZoom Pro 2.1.10 --> C:\Program Files\PhotoZoom Pro 2\Uninstall.exe
Power Retouche Demo --> C:\Program Files\Adobe\Photoshop 7.0\Plug-Ins\PowerRetouche\UnInstall_PRDemo.exe
ReNamer --> "C:\Program Files\ReNamer\unins000.exe"
Riva FLV Encoder 2.0 --> "C:\Program Files\Riva\Riva FLV Encoder 2.0\unins000.exe"
Screenbook Maker (remove only) --> "C:\Program Files\Screenbook Maker\uninst.exe"
Serif PagePlus SE 1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{25BB07FA-D9A0-478E-8A4B-38466A4E8BF2}\Setup.exe" -l0x9
Simple CSS 1.2 --> "C:\Program Files\Simple CSS\unins000.exe"
Sodipodi --> MsiExec.exe /I{0B62392F-B7D7-4DE3-AD15-30819F1C925E}
Symantec AntiVirus --> MsiExec.exe /I{5A633ED0-E5D7-4D65-AB8D-53ED43510284}
Total Video Converter 3.02 --> "C:\Program Files\Total Video Converter\unins000.exe"
Tweak UI --> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
Ulead PhotoImpact 4.2 --> C:\WINDOWS\ISUninst.exe -f"C:\Program Files 2\Ulead Systems\Ulead PhotoImpact 4.2\Uninst.isu" -c"C:\Program Files 2\Ulead Systems\Ulead PhotoImpact 4.2\IS32Inst.dll"
Vector Graphics ActiveX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3D695B6D-D4FF-41FE-BE7C-4F9118256975}\Setup.exe"
VMware Player --> MsiExec.exe /I{31799B14-B3E7-4522-B393-6206C03EC5D3}
w3compiler --> C:\PROGRA~1\Port80\W3COMP~1\\UNWISE.exe C:\PROGRA~1\Port80\W3COMP~1\\INSTALL.LOG
WAMP5 1.6.5 --> J:\wamp\unins000.exe
WebDrive --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\WebDrive\Uninst.isu" -c"C:\Program Files\WebDrive\uninstall.dll"
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger --> MsiExec.exe /I{FCE50DB8-C610-4C42-BE5C-193F46C6F812}
Windows Live Sign-in Assistant --> MsiExec.exe /I{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
WindowShoot Version 1.0 --> "C:\Program Files\WindowShoot\unins000.exe"
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
WinZip --> "C:\Program Files\WinZip\WINZIP32.exe" /uninstall

-- End of ComboScan: finished at 2007-03-01 at 09:5-

Response Number 12

Name: jabuck
Date: March 2, 2007 at 04:06:51 Pacific

Reply:

Download VundoFix at http://www.atribune.org/ccount/click.php?id=4 and save it to your desktop.
Double-click VundoFix.exe to run it.
Put a check next to 'Run VundoFix as a task'.
You will receive a message saying vundofix will close and re-open in a minute or less. Click OK.
When VundoFix re-opens, right click inside the white box and click 'Add More Files?'
Copy and paste the below entries into each line:
C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\qtvwa.*
C:WINDOWS\system32\pmnoppq.dll
C:WINDOWS\system32\qpponmp.*
Click 'Add Files' and click 'Close Window'.
Click 'Scan for Vundo' button.
Once it's done scanning, click the 'Remove Vundo' button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer. click OK.
Turn your computer back on.
Please post the contents of C:\vundofix.txt
Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Download and install AVG Anti-Spyware We will need this later in safe mode
Be sure to update AVG Anti- Spyware
Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":
Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5B2D4732-1AE4-4AAD-8608-D6D01E351F5F} - C:\WINDOWS\system32\awvtq.dll
O2 - BHO: (no name) - {60FF4F1F-48E2-4C48-85EB-582AB2ACFC9C} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C} - C:\WINDOWS\system32\pmnoppq.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [kdmmcvs] C:\WINDOWS\system32\gdmvstat.exe
O4 - HKLM\..\Run: [ncsmmlg] C:\WINDOWS\system32\acsbvcc.exe
O4 - HKLM\..\Run: [csmhtop] C:\WINDOWS\system32\cxmdxcs.exe
O4 - HKLM\..\Run: [ddsysmns] C:\WINDOWS\system32\smcrsmm.exe
O4 - HKCU\..\Run: [kdmmcvs] C:\WINDOWS\system32\gdmvstat.exe
O4 - HKCU\..\Run: [ncsmmlg] C:\WINDOWS\system32\acsbvcc.exe
O4 - HKCU\..\Run: [csmhtop] C:\WINDOWS\system32\cxmdxcs.exe
O4 - HKCU\..\Run: [ddsysmns] C:\WINDOWS\system32\smcrsmm.exe
O20 - Winlogon Notify: awvtq - C:\WINDOWS\system32\awvtq.dll
O20 - Winlogon Notify: pmnoppq - C:\WINDOWS\SYSTEM32\pmnoppq.dll
Exit Hiajack This but remain in safe mode.
Run Killbox from safe mode. Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\WINDOWS\system32\gdmvstat.exe
C:\WINDOWS\system32\acsbvcc.exe
C:\WINDOWS\system32\cxmdxcs.exe
C:\WINDOWS\system32\smcrsmm.exe
C:\WINDOWS\bhgdscdscds.exe
C:\WINDOWS\uytrefvdsfd.exe
C:\WINDOWS\system32\vbar332.dll
C:\WINDOWS\system32\d3d9caps.dat

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!).
If your computer does not restart automatically, please restart it manually.

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Post the AVG log and a new comboscan please.

Response Number 13

Name: rajanurs
Date: March 2, 2007 at 10:54:52 Pacific

Reply:

AVG Anti-Spyware - Scan Report
----------------
+ Created at: 11:51:12 PM 3/2/2007
+ Scan result:
H:\System Volume Information\_restore{83850148-4BAE-4789-AA81-C507B02E6C22}\RP0\A0097291.exe -> Downloader.Small.edb : Cleaned with backup (quarantined).
H:\System Volume Information\_restore{83850148-4BAE-4789-AA81-C507B02E6C22}\RP0\A0097294.exe -> Downloader.Small.edb : Cleaned with backup (quarantined).
H:\System Volume Information\_restore{83850148-4BAE-4789-AA81-C507B02E6C22}\RP0\A0097290.exe -> Trojan.Agent.qt : Cleaned with backup (quarantined).
H:\System Volume Information\_restore{83850148-4BAE-4789-AA81-C507B02E6C22}\RP0\A0097293.exe -> Trojan.Agent.qt : Cleaned with backup (quarantined).
::Report end
---
Logfile of HijackThis v1.99.1
Scan saved at 11:56:55 PM, on 3/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\GSICON.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\IBserver\apache\Apache.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\MSN Messenger\MsnMsgr.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Eraser\eraser.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
C:\Program Files\MPA\MBackup\MBackup.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\IBserver\mysql\bin\mysqld-nt.exe
C:\Program Files VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.exe
C:\PROGRA~1\HIJACK~1\rajanurs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://localhost/joomla
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {31D886ED-258A-44B0-B7CD-497D25219214} - C:\WINDOWS\system32\ssttt.dll
O2 - BHO: (no name) - {60FF4F1F-48E2-4C48-85EB-582AB2ACFC9C} - (no file)
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AD5DEF5C-D92F-4CE5-9E3E-DB951F5C195F} - C:\WINDOWS\system32\awvtq.dll (file missing)
O2 - BHO: (no name) - {B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C} - C:\WINDOWS\system32\pmnoppq.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlarmMe] "D:\Program Files\Alarm Me\AlarmMe.exe" "-h"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [The wave] C:\DOCUME~1\rajanurs\APPLIC~1\MANAGE~1\greyproc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: Shortcut to MBackup.exe.lnk = C:\Program Files\MPA\MBackup\MBackup.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add Link to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add Page to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add to &Windows Live Favorites - http://favorites.live.com/quickadd....
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: SiteBar - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: SiteBar Panel - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{57178EEB-AB3E-45CB-B2F8-BAE938692DA5}: NameServer = 125.22.47.125 202.56.250.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: pmnoppq - C:\WINDOWS\SYSTEM32\pmnoppq.dll
O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - C:\IBserver\apache\Apache.exe" --ntservice (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DirectUpdate engine (DirectUpdate) - http://www.wildup.net/ - C:\Program Files\DirectUpdate v4\DUEngine.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: inetd - Unknown owner - C:\cygwin\bin\cygrunsrv.exe (file missing)
O23 - Service: MySql - Unknown owner - C:/IBserver/mysql/bin/mysqld-nt.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - J:\wamp\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - J:\wamp\mysql\bin\mysqld-nt.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe (file missing)

-- Files created between 2007-02-02 and 20----------
2007-03-02 22:05:08 444313 ---hs---- C:\WINDOWS\system32\tttss.bak1<TTTSS~1.BAK>
2007-03-02 22:04:28 282164 ---hs---- C:\WINDOWS\system32\ssttt.dll
2007-03-02 19:43:23 0 d-------- C:\!KillBox
2007-03-02 13:34:20 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-02 00:14:53 2316 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-02 00:14:10 79360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-03-02 00:14:10 40960 --a------ C:\WINDOWS\system32\swsc.exe
2007-03-02 00:14:10 135168 --a------ C:\WINDOWS\system32\swreg.exe
2007-03-02 00:14:10 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-03-02 00:14:10 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-03-02 00:14:09 53248 --a------ C:\WINDOWS\system32\Process.exe
2007-03-01 23:54:47 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-01 23:53:46 92160 --a------ C:\VundoFix.exe
2007-03-01 15:51:40 0 d-------- C:\Program Files\RegScrubXP<REGSCR~1>
2007-03-01 09:52:37 0 d-------- C:\ComboScan1<COMBOS~1>
2007-03-01 09:47:00 0 d-------- C:\Program Files\Hijackthis<HIJACK~1>
2007-03-01 09:41:53 19392 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-03-01 00:39:45 0 dr-h----- C:\$VAULT$.AVG
2007-03-01 00:39:40 12190760 -----n--- C:\AVG7QT.DAT
2007-03-01 00:32:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\AVG7
2007-03-01 00:31:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-03-01 00:31:47 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-03-01 00:31:46 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-03-01 00:31:46 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-03-01 00:31:46 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-03-01 00:31:45 775680 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-03-01 00:31:38 0 d-------- C:\Program Files\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-02-28 12:39:34 0 d--h----- C:\WINDOWS\system32\GroupPolicy<GROUPP~1>
2007-02-27 23:34:16 26637 ---hs---- C:\WINDOWS\system32\pmnoppq.dll
2007-02-27 23:22:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Base Hole Vga Bend<BASEHO~1>
2007-02-27 23:22:20 0 d-------- C:\Program Files\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:22:20 0 d-------- C:\Documents and Settings\rajanurs\Application Data\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:13:44 16384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-02-27 23:13:44 0 d-------- C:\WINDOWS\system32\Adobe
2007-02-27 23:11:58 0 d-------- C:\Adobe Illustrator Installer<ADOBEI~1>
2007-02-27 20:17:20 0 d--hs---- C:\WINDOWS\ftpcache
2007-02-27 20:17:13 0 d-------- C:\PhotoShopE Intro<PHOTOS~1>
2007-02-27 19:12:06 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Alien Skin<ALIENS~1>
2007-02-27 16:00:58 0 d-------- C:\Program Files\Sodipodi
2007-02-27 16:00:34 0 d-------- C:\Program Files\Common Files\GTK
2007-02-26 19:00:23 0 d-------- C:\Program Files\PhotoZoom Pro 2<PHOTOZ~1>
2007-02-26 12:22:18 0 d-------- C:\Program Files\MorpheusBar<MORPHE~1>
2007-02-26 12:21:21 0 d-------- C:\Program Files\Morpheus
2007-02-26 12:07:20 0 d-------- C:\Documents and Settings\rajanurs\Shared
2007-02-26 12:07:05 0 d-------- C:\Documents and Settings\rajanurs\Incomplete<INCOMP~1>
2007-02-26 12:04:06 0 d-------- C:\Documents and Settings\rajanurs\.limewire<LIMEWI~1>
2007-02-26 11:48:17 0 d-------- C:\Program Files\Java
2007-02-26 11:43:38 0 d-------- C:\Program Files\Common Files\Java
2007-02-24 01:00:23 589824 --a------ C:\WINDOWS\system32\CDRProX.dll
2007-02-24 01:00:18 0 d-------- C:\Program Files\Longtion
2007-02-22 19:48:38 0 d-------- C:\Program Files\WINK FlashDemoMaker<WINKFL~1>
2007-02-22 18:27:28 0 d-------- C:\WINDOWS\APW_DATA
2007-02-22 18:23:01 0 d-------- C:\Documents and Settings\All Users\Application Data\sbooks
2007-02-22 18:22:41 0 d-------- C:\Program Files\Screenbook Maker<SCREEN~1>
2007-02-21 11:20:13 110592 --a------ C:\WINDOWS\system32\tsccvid.dll
2007-02-20 12:31:53 204848 --a------ C:\WINDOWS\system32\gswin32c.exe
2007-02-20 12:31:42 196608 --a------ C:\WINDOWS\system32\Utility.dll
2007-02-20 12:31:35 0 d-------- C:\Program Files\LogoSmartzTrial<LOGOSM~1>
2007-02-20 12:16:59 0 d-------- C:\Program Files\AAALOGO
2007-02-16 23:21:15 0 d-------- C:\Documents and Settings\rajanurs\Application Data\gtk-2.0
2007-02-16 23:20:10 0 d-------- C:\Program Files\Inkscape
2007-02-15 22:49:48 0 d-------- C:\WINDOWS\system32\Photosynth<PHOTOS~1>
2007-02-10 13:25:52 0 d-------- C:\Documents and Settings\rajanurs\Application Data\BackLinks Master<BACKLI~1>
2007-02-10 12:20:31 0 d-------- C:\Documents and Settings\rajanurs\Application Data\PaRaMeter<PARAME~1>
2007-02-10 12:20:29 0 d-------- C:\Program Files\PaRaMeter<PARAME~1>
2007-02-10 12:20:13 0 d-------- C:\Program Files\BackLinks Master<BACKLI~1>
2007-02-10 12:19:09 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Free Monitor for Google<FREEMO~1>
2007-02-10 12:19:05 0 d-------- C:\Program Files\Free Monitor for Google<FREEMO~1>

-- Find3M Re-----------
2007-03-02 23:14:49 0 d-------- C:\Program Files\Eraser
2007-03-02 12:51:15 0 d-------- C:\Program Files\Mydrivers<MYDRIV~1>
2007-03-02 11:09:03 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-03-02 01:23:22 0 d-------- C:\Program Files\Opera
2007-02-27 23:33:59 0 d-------- C:\Program Files\CPUMon
2007-02-27 23:33:58 0 d-------- C:\Program Files\WebDrive
2007-02-27 23:15:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Adobe
2007-02-27 23:13:44 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-27 23:13:16 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-27 00:32:20 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-02-15 22:50:18 3783 --a------ C:\WINDOWS\mozver.dat
2007-01-28 01:15:45 0 d-------- C:\Program Files\KKDict
2007-01-28 01:15:01 249856 -----n--- C:\WINDOWS\Setup1.exe
2007-01-28 01:15:00 73216 --a------ C:\WINDOWS\ST6UNST.exe
2007-01-15 02:04:50 0 d-------- C:\Program Files\Total Video Converter<TOTALV~1>
2007-01-14 16:24:44 0 d-------- C:\Program Files\Windows Media Connect 2<WI4DF6~1>
2007-01-14 04:29:44 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-01-14 04:29:36 0 d-------- C:\Program Files\Riva
2007-01-13 15:42:41 0 d-------- C:\Program Files\Google
2006-12-03 21:25:27 390240 --a------ C:\WINDOWS\system32\mkdriver.dll

-- Registry -----------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"The wave"="C:\\DOCUME~1\\rajanurs\\APPLIC~1\\MANAGE~1\\greyproc.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"Eraser"="C:\\Program Files\\Eraser\\eraser.exe -hide"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"GSICONEXE"="GSICON.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"AlarmMe"="\"D:\\Program Files\\Alarm Me\\AlarmMe.exe\" \"-h\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"location"="Common Startup"
"item"="Microsoft Office"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USSShReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ussshreg"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=hex:00,00,00,00
"NoSaveSettings"=hex:00,00,00,00
"ClearRecentDocsOnExit"=hex:00,00,00,00
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnoppq
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssttt

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{211c84df-b451-11da-ae03-806d6172696f}]
Shell\AutoRun\command E:\EISetup.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dfe8ba6d-b069-11db-9a59-000779300101}]
Shell\AutoRun\command ie.exe
Shell\explore\Command ie.exe
Shell\open\Command ie.exe

-- End of ComboScan: finished at 2007-03-02 at 23:57:20 ------

Response Number 14

Name: rajanurs
Date: March 2, 2007 at 11:01:18 Pacific

Reply:

Note: these entries were not present in Comboscan
Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5B2D4732-1AE4-4AAD-8608-D6D01E351F5F} - C:\WINDOWS\system32\awvtq.dll
O2 - BHO: (no name) - {60FF4F1F-48E2-4C48-85EB-582AB2ACFC9C} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C} - C:\WINDOWS\system32\pmnoppq.dll
O20 - Winlogon Notify: awvtq - C:\WINDOWS\system32\awvtq.dll
O20 - Winlogon Notify: pmnoppq - C:\WINDOWS\SYSTEM32\pmnoppq.dll

Response Number 15

Name: rajanurs
Date: March 2, 2007 at 11:05:10 Pacific

Reply:

^ Sorry I meant: these entries were not present in HijackThis

Response Number 16

Name: jabuck
Date: March 2, 2007 at 15:16:12 Pacific

Reply:

Go to start> control panel> add/remove programs and un in stall these programs:
Limewire (Many versions known to contain spyware, there are other programs that will do the same thing that have no spyware)
Please Download NoLop to your desktop from one of the links below...
http://www.spywareedge.net/nolop/NoLop.exe
First close any other programs you have running as this will require a reboot
Double click NoLop.exe to run it
Now click the button labelled "Search and Destroy"
<<your computer will now be scanned for infected files>>
When scanning is finished you will be prompted to reboot only if infected, Click OK
Now click the "REBOOT" Button.
A Message should popup from NoLop.
If not, double click the program again and it will finish.
Please download “Avenger” by swandog46 to your desktop from this link http://swandog46.geekstogo.com/avenger.zip
1. Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

2. Copy all the text contained in the area between the X"s below to your Clipboard by highlighting it and pressing (Ctrl+C):
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Files to delete:
C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\pmnoppq.dll
C:\WINDOWS\system32\tttss.bak1

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger's actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
Post a new Comboscan please.

Response Number 17

Name: rajanurs
Date: March 2, 2007 at 22:37:02 Pacific

Reply:

ComboScan v20070226.18 run by rajanurs on 2007-03-03 at 11:35:33
Computer is in Normal Mode.
----------------------
-- HijackThis (run as rajanurs.---------------------
Logfile of HijackThis v1.99.1
Scan saved at 11:35:38 AM, on 3/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\GSICON.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\MPA\MBackup\MBackup.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\IBserver\mysql\bin\mysqld-nt.exe
C:\Program Files VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
C:\PROGRA~1\HIJACK~1\rajanurs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06F383EE-CCD0-4CE8-9F76-5FC31D6A8C5F} - C:\WINDOWS\system32\ssttt.dll (file missing)
O2 - BHO: (no name) - {60FF4F1F-48E2-4C48-85EB-582AB2ACFC9C} - (no file)
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AD5DEF5C-D92F-4CE5-9E3E-DB951F5C195F} - C:\WINDOWS\system32\awvtq.dll (file missing)
O2 - BHO: (no name) - {B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C} - C:\WINDOWS\system32\pmnoppq.dll (file missing)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [The wave] C:\DOCUME~1\rajanurs\APPLIC~1\MANAGE~1\greyproc.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: Shortcut to MBackup.exe.lnk = C:\Program Files\MPA\MBackup\MBackup.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add Link to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add Page to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add to &Windows Live Favorites - http://favorites.live.com/quickadd....
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: SiteBar - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: SiteBar Panel - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: pmnoppq - pmnoppq.dll (file missing)
O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - C:\IBserver\apache\Apache.exe" --ntservice (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DirectUpdate engine (DirectUpdate) - http://www.wildup.net/ - C:\Program Files\DirectUpdate v4\DUEngine.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: inetd - Unknown owner - C:\cygwin\bin\cygrunsrv.exe (file missing)
O23 - Service: MySql - Unknown owner - C:/IBserver/mysql/bin/mysqld-nt.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - J:\wamp\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - J:\wamp\mysql\bin\mysqld-nt.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe (file missing)

-- Files created between 2007-02-03 and 20----------
2007-03-03 11:30:02 0 d-------- C:\avenger
2007-03-03 11:17:58 0 d-------- C:\NoLopBackups<NOLOPB~1>
2007-03-02 19:43:23 0 d-------- C:\!KillBox
2007-03-02 13:34:20 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-02 00:14:53 2316 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-02 00:14:10 79360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-03-02 00:14:10 40960 --a------ C:\WINDOWS\system32\swsc.exe
2007-03-02 00:14:10 135168 --a------ C:\WINDOWS\system32\swreg.exe
2007-03-02 00:14:10 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-03-02 00:14:10 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-03-02 00:14:09 53248 --a------ C:\WINDOWS\system32\Process.exe
2007-03-01 23:54:47 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-01 23:53:46 92160 --a------ C:\VundoFix.exe
2007-03-01 15:51:40 0 d-------- C:\Program Files\RegScrubXP<REGSCR~1>
2007-03-01 09:47:00 0 d-------- C:\Program Files\Hijackthis<HIJACK~1>
2007-03-01 09:41:53 19392 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-03-01 00:39:45 0 dr-h----- C:\$VAULT$.AVG
2007-03-01 00:39:40 12190760 -----n--- C:\AVG7QT.DAT
2007-03-01 00:32:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\AVG7
2007-03-01 00:31:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-03-01 00:31:47 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-03-01 00:31:46 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-03-01 00:31:46 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-03-01 00:31:46 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-03-01 00:31:45 775680 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-03-01 00:31:38 0 d-------- C:\Program Files\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-02-28 12:39:34 0 d--h----- C:\WINDOWS\system32\GroupPolicy<GROUPP~1>
2007-02-27 23:22:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Base Hole Vga Bend<BASEHO~1>
2007-02-27 23:22:20 0 d-------- C:\Program Files\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:22:20 0 d-------- C:\Documents and Settings\rajanurs\Application Data\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:13:44 16384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-02-27 23:13:44 0 d-------- C:\WINDOWS\system32\Adobe
2007-02-27 23:11:58 0 d-------- C:\Adobe Illustrator Installer<ADOBEI~1>
2007-02-27 20:17:20 0 d--hs---- C:\WINDOWS\ftpcache
2007-02-27 20:17:13 0 d-------- C:\PhotoShopE Intro<PHOTOS~1>
2007-02-27 19:12:06 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Alien Skin<ALIENS~1>
2007-02-27 16:00:58 0 d-------- C:\Program Files\Sodipodi
2007-02-27 16:00:34 0 d-------- C:\Program Files\Common Files\GTK
2007-02-26 19:00:23 0 d-------- C:\Program Files\PhotoZoom Pro 2<PHOTOZ~1>
2007-02-26 12:22:18 0 d-------- C:\Program Files\MorpheusBar<MORPHE~1>
2007-02-26 12:21:21 0 d-------- C:\Program Files\Morpheus
2007-02-26 12:07:20 0 d-------- C:\Documents and Settings\rajanurs\Shared
2007-02-26 12:07:05 0 d-------- C:\Documents and Settings\rajanurs\Incomplete<INCOMP~1>
2007-02-26 11:48:17 0 d-------- C:\Program Files\Java
2007-02-26 11:43:38 0 d-------- C:\Program Files\Common Files\Java
2007-02-24 01:00:23 589824 --a------ C:\WINDOWS\system32\CDRProX.dll
2007-02-24 01:00:18 0 d-------- C:\Program Files\Longtion
2007-02-22 19:48:38 0 d-------- C:\Program Files\WINK FlashDemoMaker<WINKFL~1>
2007-02-22 18:27:28 0 d-------- C:\WINDOWS\APW_DATA
2007-02-22 18:23:01 0 d-------- C:\Documents and Settings\All Users\Application Data\sbooks
2007-02-22 18:22:41 0 d-------- C:\Program Files\Screenbook Maker<SCREEN~1>
2007-02-21 11:20:13 110592 --a------ C:\WINDOWS\system32\tsccvid.dll
2007-02-20 21:29:24 0 d-------- C:\Documents and Settings\All Users\Application Data\Macrovision<MACROV~1>
2007-02-20 12:31:53 204848 --a------ C:\WINDOWS\system32\gswin32c.exe
2007-02-20 12:31:42 196608 --a------ C:\WINDOWS\system32\Utility.dll
2007-02-20 12:31:35 0 d-------- C:\Program Files\LogoSmartzTrial<LOGOSM~1>
2007-02-20 12:16:59 0 d-------- C:\Program Files\AAALOGO
2007-02-16 23:21:15 0 d-------- C:\Documents and Settings\rajanurs\Application Data\gtk-2.0
2007-02-16 23:20:10 0 d-------- C:\Program Files\Inkscape
2007-02-15 22:49:48 0 d-------- C:\WINDOWS\system32\Photosynth<PHOTOS~1>
2007-02-10 13:25:52 0 d-------- C:\Documents and Settings\rajanurs\Application Data\BackLinks Master<BACKLI~1>
2007-02-10 12:20:31 0 d-------- C:\Documents and Settings\rajanurs\Application Data\PaRaMeter<PARAME~1>
2007-02-10 12:20:29 0 d-------- C:\Program Files\PaRaMeter<PARAME~1>
2007-02-10 12:20:13 0 d-------- C:\Program Files\BackLinks Master<BACKLI~1>
2007-02-10 12:19:09 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Free Monitor for Google<FREEMO~1>
2007-02-10 12:19:05 0 d-------- C:\Program Files\Free Monitor for Google<FREEMO~1>

-- Find3M Re-----------
2007-03-03 11:33:04 0 d-------- C:\Program Files\Eraser
2007-03-02 12:51:15 0 d-------- C:\Program Files\Mydrivers<MYDRIV~1>
2007-03-02 11:09:03 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-03-02 01:23:22 0 d-------- C:\Program Files\Opera
2007-02-27 23:33:59 0 d-------- C:\Program Files\CPUMon
2007-02-27 23:33:58 0 d-------- C:\Program Files\WebDrive
2007-02-27 23:15:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Adobe
2007-02-27 23:13:44 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-27 23:13:16 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-27 00:32:20 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-02-15 22:50:18 3783 --a------ C:\WINDOWS\mozver.dat
2007-01-28 01:15:45 0 d-------- C:\Program Files\KKDict
2007-01-28 01:15:01 249856 -----n--- C:\WINDOWS\Setup1.exe
2007-01-28 01:15:00 73216 --a------ C:\WINDOWS\ST6UNST.exe
2007-01-15 02:04:50 0 d-------- C:\Program Files\Total Video Converter<TOTALV~1>
2007-01-14 16:24:44 0 d-------- C:\Program Files\Windows Media Connect 2<WI4DF6~1>
2007-01-14 04:29:44 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-01-14 04:29:36 0 d-------- C:\Program Files\Riva
2007-01-13 15:42:41 0 d-------- C:\Program Files\Google
2006-12-03 21:25:27 390240 --a------ C:\WINDOWS\system32\mkdriver.dll

-- Registry -----------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"The wave"="C:\\DOCUME~1\\rajanurs\\APPLIC~1\\MANAGE~1\\greyproc.exe"
"Eraser"="C:\\Program Files\\Eraser\\eraser.exe -hide"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"GSICONEXE"="GSICON.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"location"="Common Startup"
"item"="Microsoft Office"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlarmMe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AlarmMe"
"hkey"="HKLM"
"command"="\"D:\\Program Files\\Alarm Me\\AlarmMe.exe\" \"-h\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USSShReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ussshreg"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=hex:00,00,00,00
"NoSaveSettings"=hex:00,00,00,00
"ClearRecentDocsOnExit"=hex:00,00,00,00
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnoppq
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssttt

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{211c84df-b451-11da-ae03-806d6172696f}]
Shell\AutoRun\command E:\EISetup.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dfe8ba6d-b069-11db-9a59-000779300101}]
Shell\AutoRun\command ie.exe
Shell\explore\Command ie.exe
Shell\open\Command ie.exe

-- End of ComboScan: finished at 2007-03-03 at 11:3-

Response Number 18

Name: jabuck
Date: March 3, 2007 at 08:33:37 Pacific

Reply:

Run Hijack This from normal mode, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked":
O2 - BHO: (no name) - {5B2D4732-1AE4-4AAD-8608-D6D01E351F5F} - C:\WINDOWS\system32\awvtq.dll
O2 - BHO: (no name) - {60FF4F1F-48E2-4C48-85EB-582AB2ACFC9C} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AD5DEF5C-D92F-4CE5-9E3E-DB951F5C195F} - C:\WINDOWS\system32\awvtq.dll (file missing)
O2 - BHO: (no name) - {B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C} - C:\WINDOWS\system32\pmnoppq.dll
O20 - Winlogon Notify: pmnoppq - C:\WINDOWS\SYSTEM32\pmnoppq.dll
O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll
Exit Hijack This.
Open notepad (Start Menu > Run > Type notepad and press "ok".
Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnoppq]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssttt]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop.
Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes.
Go to this link, http://virusscan.jotti.org/ and use the "browse" button to locate this file C:\Documenys and Settings\rajanurs\Applications Data\MANAGE~1\greyproc.exe (The folder will begin with "manage" any other characters could follow)
then double click the file to enter it into the "upload and scan box", click submit then post the results.
navigate to and delete this folder if found:
C:\Documents and Settings\All Users\Application Data\Base Hole Vga Bend
We are going to need a scan from "AutoRun" to find a virus and it is usally a lage file that may require two post to get the info to us.
Download "Autoruns" from this link:
http://download.sysinternals.com/Files/Autoruns.zip
Save it and unzip it to its own folder.
Open folder and double click autoruns.exe
Wait for scan to finish.
Click the "options" menu and check "include empty sections" & "varify code signatures".
click the "users" menu and checkmark "Fire"
If it does not scan again automatically; click the "file" menu and click "refresh".
Wait for scan to finish.
Click the floppy icon> save log> post log.

Response Number 19

Name: rajanurs
Date: March 3, 2007 at 11:13:15 Pacific

Reply:

virusscan.jotti.org scan result:
Scan taken on 03 Mar 2007 18:42:02 (GMT)
AntiVir Found TR/Dldr.Swizzor.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Trojan.FatObfus.Gen
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
VirusBuster Found Adware.Lop.Gen
VBA32 Found MalwareScope.Trojan-Downloader.Obfuscated.2
......................................
AUTORUNS LOG:

HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
+ rdpclip RDP Clip Monitor (Verified) Microsoft Windows Publisher c:\windows\system32\rdpclip.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
+ C:\WINDOWS\system32\userinit.exe Userinit Logon Application (Verified) Microsoft Windows Publisher c:\windows\system32\userinit.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
+ Explorer.exe Windows Explorer (Verified) Microsoft Windows Publisher c:\windows\explorer.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ AVG7_CC AVG Control Center (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg free\avgcc.exe
+ ccApp Symantec User Session (Verified) Symantec Corporation c:\program files\common files\symantec shared\ccapp.exe
+ GSICONEXE DSL Modem Monitor (Not verified) GlobespanVirata, Inc. c:\windows\system32\gsicon.exe
+ QuickTime Task QuickTime Task (Not verified) Apple Computer, Inc. c:\program files\quicktime\qttask.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup
+ Adobe Gamma Loader.lnk Adobe Gamma Loader (Not verified) Adobe Systems, Inc. c:\program files\common files\adobe\calibration\adobe gamma loader.exe
C:\Documents and Settings\rajanurs\Start Menu\Programs\Startup
+ Shortcut to MBackup.exe.lnk MBackup MFC Application (Not verified) MPA c:\program files\mpa\mbackup\mbackup.exe
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+ ctfmon.exe CTF Loader (Verified) Microsoft Windows Publisher c:\windows\system32\ctfmon.exe
+ Eraser Eraser. (Not verified) - c:\program files\eraser\eraser.exe
+ msnmsgr Messenger (Verified) Microsoft Corporation c:\program files\msn messenger\msnmsgr.exe
+ The wave c:\documents and settings\rajanurs\application data\managermapifile\greyproc.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Classes\Protocols\Filter
+ Class Install Handler OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ deflate OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ gzip OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ lzdhtml OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ text/webviewhtml Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
HKLM\SOFTWARE\Classes\Protocols\Handler
+ about Microsoft (R) HTML Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\mshtml.dll
+ belarc Belarc VoilaX Control (Not verified) Belarc, Inc. c:\program files\belarc\advisor\system\bavoilax.dll
+ cdl OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ cdo Microsoft SharePoint Portal Server Object Model (Not verified) Microsoft Corporation c:\program files\common files\microsoft shared\web folders\pkmcdo.dll
+ dvd ActiveX control for streaming video (Verified) Microsoft Windows Publisher c:\windows\system32\msvidctl.dll
+ file OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ ftp OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ gopher OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ http OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ https OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ its Microsoft® InfoTech Storage System Library (Verified) Microsoft Windows Publisher c:\windows\system32\itss.dll
+ javascript Microsoft (R) HTML Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\mshtml.dll
+ livecall MSN Messenger Protocol Handler (Verified) Microsoft Corporation c:\program files\msn messenger\msgrapp.8.0.0812.00.dll
+ local OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ mailto Microsoft (R) HTML Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\mshtml.dll
+ mhtml Microsoft Internet Messaging API (Verified) Microsoft Windows Publisher c:\windows\system32\inetcomm.dll
+ mk OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ ms-its Microsoft® InfoTech Storage System Library (Verified) Microsoft Windows Publisher c:\windows\system32\itss.dll
+ ms-itss Microsoft® InfoTech Storage System Library (Not verified) Microsoft Corporation c:\program files\common files\microsoft shared\information retrieval\msitss.dll
+ msnim MSN Messenger Protocol Handler (Verified) Microsoft Corporation c:\program files\msn messenger\msgrapp.8.0.0812.00.dll
+ mso-offdap Microsoft Office XP Web Components (Verified) Microsoft Corporation c:\program files\common files\microsoft shared\web components\10\owc10.dll
+ res Microsoft (R) HTML Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\mshtml.dll
+ sysimage Microsoft (R) HTML Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\mshtml.dll
+ tv ActiveX control for streaming video (Verified) Microsoft Windows Publisher c:\windows\system32\msvidctl.dll
+ vbscript Microsoft (R) HTML Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\mshtml.dll
+ wia WIA Scripting Layer (Verified) Microsoft Windows Publisher c:\windows\system32\wiascr.dll
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
+ 0 File not found: About:Home
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
+ Address Book 6 Outlook Express Setup Library (Verified) Microsoft Windows Publisher c:\program files\outlook express\setup50.exe
+ Browser Customizations Microsoft Internet Explorer Customization DLL (Verified) Microsoft Windows Publisher c:\windows\system32\iedkcs32.dll
+ Internet Explorer Windows NT User Data Migration Tool (Verified) Microsoft Windows Publisher c:\windows\system32\shmgrate.exe
+ Internet Explorer Windows Setup API (Verified) Microsoft Windows Publisher c:\windows\system32\setupapi.dll
+ Internet Explorer 6 IE 5.0 Per-User Install Utility (Verified) Microsoft Windows Publisher c:\windows\system32\ie4uinit.exe
+ Microsoft Outlook Express 6 Outlook Express Setup Library (Verified) Microsoft Windows Publisher c:\program files\outlook express\setup50.exe
+ Microsoft Windows Media Player Microsoft Windows Media Player Setup Utility (Verified) Microsoft Windows Publisher c:\windows\inf\unregmp2.exe
+ Microsoft Windows Media Player ADVPACK (Verified) Microsoft Windows Publisher c:\windows\system32\advpack.dll
+ MSN Messenger Service 1.0 ADVPACK (Verified) Microsoft Windows Publisher c:\windows\system32\advpack.dll
+ NetMeeting 3.01 ADVPACK (Verified) Microsoft Windows Publisher c:\windows\system32\advpack.dll
+ Outlook Express Windows NT User Data Migration Tool (Verified) Microsoft Windows Publisher c:\windows\system32\shmgrate.exe
+ Themes Setup Microsoft(C) Register Server (Verified) Microsoft Windows Publisher c:\windows\system32\regsvr32.exe
+ Windows Desktop Update Microsoft(C) Register Server (Verified) Microsoft Windows Publisher c:\windows\system32\regsvr32.exe
HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
+ Browseui preloader Shell Browser UI Library (Verified) Microsoft Windows Publisher c:\windows\system32\browseui.dll
+ Component Categories cache daemon Shell Browser UI Library (Verified) Microsoft Windows Publisher c:\windows\system32\browseui.dll
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
+ CDBurn Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
+ PostBootReminder Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
+ SysTray Systray shell service object (Verified) Microsoft Windows Publisher c:\windows\system32\stobject.dll
+ WebCheck Web Site Monitor (Verified) Microsoft Windows Publisher c:\windows\system32\webcheck.dll
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ shell32.dll Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ 7-Zip Shell Extension c:\program files\7-zip\7-zip.dll
+ AVG7 Find Extension AVG Shell Extension (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg free\avgse.dll
+ AVG7 Shell Extension AVG Shell Extension (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg free\avgse.dll
+ Eraser Shell Extension Eraser Shell Extension. (Not verified) - c:\windows\system32\erasext.dll
+ GDI+ file thumbnail extractor Windows Picture and Fax Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\shimgvw.dll
+ HTML Thumbnail Extractor Windows Picture and Fax Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\shimgvw.dll
+ Messenger Sharing Folders Messenger File Sharing Shell Extensions (Verified) Microsoft Corporation c:\program files\msn messenger\fsshext.8.0.0812.00.dll
+ Microsoft Office HTML Icon Handler Microsoft Office XP component (Verified) Microsoft Corporation c:\program files\microsoft office\office10\msohev.dll
+ Microsoft Outlook Custom Icon Handler Outlook Shell Hook for Start/Find (Verified) Microsoft Corporation c:\program files\microsoft office\office10\olkfstub.dll
+ Portable Devices Portable Devices Shell Extension (Verified) Microsoft Windows Component Publisher c:\windows\system32\wpdshext.dll
+ Portable Devices Menu Portable Devices Shell Extension (Verified) Microsoft Windows Component Publisher c:\windows\system32\wpdshext.dll
+ Portable Media Devices Portable Media Devices Shell Extension (Verified) Microsoft Windows Component Publisher c:\windows\system32\audiodev.dll
+ Shell Extension for CDRW UDF Shell Extension DLL (Not verified) Nero AG c:\program files\ahead\incd\incdshx.dll
+ Shell Image Data Factory Windows Picture and Fax Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\shimgvw.dll
+ Shell Image Property Handler Windows Picture and Fax Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\shimgvw.dll
+ Shell Image Verbs Windows Picture and Fax Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\shimgvw.dll
+ Summary Info Thumbnail handler (DOCFILES) Windows Picture and Fax Viewer (Verified) Microsoft Windows Publisher c:\windows\system32\shimgvw.dll
+ Web Folders Microsoft Web Folders (Not verified) Microsoft Corporation c:\program files\common files\microsoft shared\web folders\msonsext.dll
+ Windows Media Player Add to Playlist Context Menu Handler Windows Media Player Launcher (Verified) Microsoft Windows Publisher c:\windows\system32\wmpshell.dll
+ Windows Media Player Burn Audio CD Context Menu Handler Windows Media Player Launcher (Verified) Microsoft Windows Publisher c:\windows\system32\wmpshell.dll
+ Windows Media Player Play as Playlist Context Menu Handler Windows Media Player Launcher (Verified) Microsoft Windows Publisher c:\windows\system32\wmpshell.dll
+ WinRAR shell extension c:\program files\winrar\rarext.dll
HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
+ {0D2E74C4-3C34-11d2-A27E-00C04FC30871} Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
+ {24F14F01-7B1C-11d1-838f-0000F80461CF} Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
+ {24F14F02-7B1C-11d1-838f-0000F80461CF} Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
+ {66742402-F9B9-11D1-A202-0000F81FEDEE} Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
HKCU\Software\Microsoft\Ctf\LangBarAddin
HKLM\Software\Microsoft\Ctf\LangBarAddin
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ AcroIEHlprObj Class Adobe Acrobat IE Helper Version 6.0 for ActivieX (Verified) Adobe Systems, Incorporated c:\program files\acrobat 6.0\reader\activex\acroiehelper.dll
+ IeCaptureBho Object Google Desktop (Not verified) Google c:\program files\google\google desktop search\googledesktopie.dll
+ Windows Live Sign-in Helper WindowsLiveLogin.dll (Verified) Microsoft Corporation c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
+ shdocvw.dll Shell Doc Object and Control Library (Verified) Microsoft Windows Publisher c:\windows\system32\shdocvw.dll
HKLM\Software\Microsoft\Internet Explorer\Toolbar
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Extensions
HKLM\Software\Microsoft\Internet Explorer\Extensions
Task Scheduler
HKLM\System\CurrentControlSet\Services
+ AcrSch2Svc Acronis Scheduler 2 (Not verified) Acronis c:\program files\common files\acronis\schedule2\schedul2.exe
+ Apache Apache/1.3.26 (Win32) PHP/4.2.3 c:\ibserver\apache\apache.exe
+ AudioSrv Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\audiosrv.dll
+ AVG Anti-Spyware Guard AVG Anti-Spyware guard (Not verified) Anti-Malware Development a.s. c:\program files\grisoft\avg anti-spyware 7.5\guard.exe
+ Avg7Alrt AVG Alert Manager (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg free\avgamsvr.exe
+ Avg7UpdSvc AVG Update Service (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg free\avgupsvc.exe
+ AVGEMS AVG E-Mail Scanner (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg free\avgemc.exe
+ BITS Transfers data between clients and servers in the background. If BITS is disabled, features such as Windows Update will not work correctly. (Verified) Microsoft Windows Publisher c:\windows\system32\qmgr.dll
+ Browser Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\browser.dll
+ ccEvtMgr Event propagation and logging service (Verified) Symantec Corporation c:\program files\common files\symantec shared\ccevtmgr.exe
+ ccSetMgr Settings storage and management service (Verified) Symantec Corporation c:\program files\common files\symantec shared\ccsetmgr.exe
+ CiSvc Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. (Verified) Microsoft Windows Publisher c:\windows\system32\cisvc.exe
+ CryptSvc Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\cryptsvc.dll
+ DcomLaunch Provides launch functionality for DCOM services. (Verified) Microsoft Windows Publisher c:\windows\system32\rpcss.dll
+ DefWatch Monitors and maintains virus definitions. (Verified) Symantec Corporation c:\program files\symantec antivirus\defwatch.exe
+ Dhcp Manages network configuration by registering and updating IP addresses and DNS names. (Verified) Microsoft Windows Publisher c:\windows\system32\dhcpcsvc.dll
+ dmserver Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\dmserver.dll
+ Dnscache Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\dnsrslvr.dll
+ ERSvc Allows error reporting for services and applictions running in non-standard environments. (Verified) Microsoft Windows Publisher c:\windows\system32\ersvc.dll
+ Eventlog Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. (Verified) Microsoft Windows Publisher c:\windows\system32\services.exe
+ FirebirdGuardianDefaultInstance Firebird SQL Server (Not verified) The Firebird Project c:\program files\ipcheck server monitor 5\firebird\bin\fbguard.exe
+ helpsvc Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\pchealth\helpctr\binaries\pchsvc.dll
+ InCDsrv Helper service for the InCD filesystem driver (Not verified) Nero AG c:\program files\ahead\incd\incdsrv.exe
+ inetd Unix inetd services File not found: C:\cygwin\bin\cygrunsrv.exe
+ lanmanserver Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\srvsvc.dll
+ lanmanworkstation Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\wkssvc.dll
+ LmHosts Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. (Verified) Microsoft Windows Publisher c:\windows\system32\lmhsvc.dll
+ MDM Manages local and remote debugging for Visual Studio debuggers (Not verified) Microsoft Corporation c:\program files\common files\microsoft shared\vs7debug\mdm.exe
+ MySql c:/ibserver/mysql/bin/mysqld-nt.exe
+ PlugPlay Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. (Verified) Microsoft Windows Publisher c:\windows\system32\services.exe
+ PolicyAgent Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. (Verified) Microsoft Windows Publisher c:\windows\system32\lsass.exe
+ ProtectedStorage Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. (Verified) Microsoft Windows Publisher c:\windows\system32\lsass.exe
+ RemoteRegistry Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\regsvc.dll
+ RpcSs Provides the endpoint mapper and other miscellaneous RPC services. (Verified) Microsoft Windows Publisher c:\windows\system32\rpcss.dll
+ SamSs Stores security information for local user accounts. (Verified) Microsoft Windows Publisher c:\windows\system32\lsass.exe
+ Schedule Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\schedsvc.dll
+ seclogon Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\seclogon.dll
+ SENS Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. (Verified) Microsoft Windows Publisher c:\windows\system32\sens.dll
+ SharedAccess Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. (Verified) Microsoft Windows Publisher c:\windows\system32\ipnathlp.dll
+ ShellHWDetection Provides notifications for AutoPlay hardware events. (Verified) Microsoft Windows Publisher c:\windows\system32\shsvcs.dll
+ Spooler Loads files to memory for later printing. (Verified) Microsoft Windows XP Publisher c:\windows\system32\spoolsv.exe
+ srservice Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties (Verified) Microsoft Windows Publisher c:\windows\system32\srsvc.dll
+ Themes Provides user experience theme management. (Verified) Microsoft Windows Publisher c:\windows\system32\shsvcs.dll
+ TrkWks Maintains links between NTFS files within a computer or across computers in a network domain. (Verified) Microsoft Windows Publisher c:\windows\system32\trkwks.dll
+ VMAuthdService Authorization and authentication service for starting and accessing virtual machines (Not verified) VMware, Inc. c:\program files vmware\vmware player\vmware-authd.exe
+ VMnetDHCP DHCP service for virtual networks (Not verified) VMware, Inc. c:\windows\system32\vmnetdhcp.exe
+ vmount2 virtual disk mount service (Not verified) VMware, Inc. c:\program files\common files\vmware\vmware virtual image editing\vmount2.exe
+ VMware NAT Service Network address translation for virtual networks (Not verified) VMware, Inc. c:\windows\system32\vmnat.exe
+ W32Time Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\w32time.dll
+ WebClient Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\webclnt.dll
+ WebDriveService Maps a drive to a FTP, DAV, or FrontPage Server File not found: C:\Program Files\WebDrive\wdservice.exe
+ winmgmt Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\wbem\wmisvc.dll
+ wscsvc Monitors system security settings and configurations. (Verified) Microsoft Windows Publisher c:\windows\system32\wscsvc.dll
+ wuauserv Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site. (Verified) Microsoft Windows Publisher c:\windows\system32\wuauserv.dll
+ WZCSVC Provides automatic configuration for the 802.11 adapters (Verified) Microsoft Windows Publisher c:\windows\system32\wzcsvc.dll
HKLM\System\CurrentControlSet\Services
+ ACPI ACPI Driver for NT (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\acpi.sys
+ aec Microsoft Acoustic Echo Canceller (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\aec.sys
+ AFD AFD Networking Support Environment (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\afd.sys
+ AsyncMac RAS Asynchronous Media Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\asyncmac.sys
+ atapi IDE/ATAPI Port Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\atapi.sys
+ Atmarpc ATM ARP Client Protocol (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\atmarpc.sys
+ audstub AudStub Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\audstub.sys
+ Avg7Core AVG Scanning Engine (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avg7core.sys
+ Avg7RsW AVG Resident Shield Unload Helper (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avg7rsw.sys
+ Avg7RsXP AVG Resident Anti-Virus Shield (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avg7rsxp.sys
+ AvgAsCln AVG7 Clean Driver (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avgascln.sys
+ AvgClean AVG7 Clean Driver (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avgclean.sys
+ AvgTdi AVG Network connection watcher (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avgtdi.sys
+ BANTExt c:\windows\system32\drivers\bantext.sys
+ Cdrom SCSI CD-ROM Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\cdrom.sys
+ Disk PnP Disk Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\disk.sys
+ dmio NT Disk Manager I/O Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\dmio.sys
+ dmload NT Disk Manager Startup Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\dmload.sys
+ DMusic Microsoft Kernel DLS Synthesizer (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\dmusic.sys
+ drmkaud Microsoft Kernel DRM Audio Descrambler Filter (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\drmkaud.sys
+ E100B Intel(R) PRO/100 Adapter NDIS 5.1 driver (Verified) Microsoft Windows Hardware Compatibility Publisher c:\windows\system32\drivers\e100b325.sys
+ eeCtrl Symantec Eraser Control Driver (Verified) Symantec Corporation c:\program files\common files\symantec shared\eengine\eectrl.sys
+ Fdc Floppy Disk Controller Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\fdc.sys
+ Flpydisk Floppy Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\flpydisk.sys
+ FreshIO File not found: C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys
+ Ftdisk FT Disk Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ftdisk.sys
+ gafwload USB ADSL Firmware Loader (Not verified) GlobespanVirata Inc. c:\windows\system32\drivers\gafwload.sys
+ gameport Game Port Enumerator (Not verified) Windows (R) 2000 DDK provider c:\windows\system32\drivers\fmjoy.sys
+ Gpc Generic Packet Classifier (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\msgpc.sys
+ hcmon VMware USB Driver (Not verified) VMware, Inc. c:\windows\system32\drivers\hcmon.sys
+ HTTP This service implements the hypertext transfer protocol (HTTP). If this service is disabled, any services that explicitly depend on it will fail to start. (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\http.sys
+ i8042prt i8042 Port Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\i8042prt.sys
+ Imapi IMAPI Kernel Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\imapi.sys
+ InCDPass Ahead RW Filter Driver (Not verified) Nero AG c:\windows\system32\drivers\incdpass.sys
+ IntelIde Intel PCI IDE Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\intelide.sys
+ intelppm Processor Device Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\intelppm.sys
+ Ip6Fw Provides intrusion prevention service for a home or small office network. (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ip6fw.sys
+ IpFilterDriver IP Traffic Filter Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ipfltdrv.sys
+ IpInIp IP in IP Tunnel Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ipinip.sys
+ IpNat IP Network Address Translator (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ipnat.sys
+ IPSec IPSEC driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ipsec.sys
+ IRENUM Infra-Red Bus Enumerator (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\irenum.sys
+ isapnp PNP ISA Bus Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\isapnp.sys
+ Kbdclass Keyboard Class Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\kbdclass.sys
+ kmixer Kernel Mode Audio Mixer (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\kmixer.sys
+ Mouclass Mouse Class Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\mouclass.sys
+ MSKSSRV MS KS Server (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\mskssrv.sys
+ MSPCLOCK MS Proxy Clock (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\mspclock.sys
+ MSPQM MS Proxy Quality Manager (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\mspqm.sys
+ mssmbios System Management BIOS Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\mssmbios.sys
+ NAVENG AV Engine (Verified) Symantec Corporation c:\program files\common files\symantec shared\virusdefs\20070226.036\naveng.sys
+ NAVEX15 AV Engine (Verified) Symantec Corporation c:\program files\common files\symantec shared\virusdefs\20070226.036\navex15.sys
+ NdisTapi Remote Access NDIS TAPI Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ndistapi.sys
+ Ndisuio NDIS Usermode I/O Protocol (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ndisuio.sys
+ NdisWan Remote Access NDIS WAN Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ndiswan.sys
+ NetBT NetBios over Tcpip (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\netbt.sys
+ NwlnkFlt IPX Traffic Filter Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\nwlnkflt.sys
+ NwlnkFwd IPX Traffic Forwarder Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\nwlnkfwd.sys
+ Parport Parallel Port Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\parport.sys
+ PCI NT Plug and Play PCI Enumerator (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\pci.sys
+ PptpMiniport WAN Miniport (PPTP) (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\raspptp.sys
+ PSched QoS Packet Scheduler (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\psched.sys
+ Ptilink Direct Parallel Link Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\ptilink.sys
+ RasAcd Remote Access Auto Connection Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\rasacd.sys
+ Rasl2tp WAN Miniport (L2TP) (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\rasl2tp.sys
+ RasPppoe Remote Access PPPOE Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\raspppoe.sys
+ Raspti Direct Parallel (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\raspti.sys
+ RDPCDD RDP Miniport (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\rdpcdd.sys
+ rdpdr Microsoft RDP Device redirector (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\rdpdr.sys
+ redbook Redbook Audio Filter Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\redbook.sys
+ SANDRA File not found: C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\Sandra.sys
+ SAVRT AutoProtect (Verified) Symantec Corporation c:\program files\symantec antivirus\savrt.sys
+ SAVRTPEL SAVRTPEL (Verified) Symantec Corporation c:\program files\symantec antivirus\savrtpel.sys
+ Secdrv SafeDisc driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\secdrv.sys
+ serenum Serial Port Enumerator (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\serenum.sys
+ Serial Serial Device Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\serial.sys
+ sermouse Serial Mouse Filter Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\sermouse.sys
+ SIWIO File not found: C:\WINDOWS\TEMP\SiwIo.sys
+ SMBios Intel(R) System Managment BIOS Driver (Not verified) Intel Corporation c:\windows\system32\drivers\smbios.sys
+ snapman Acronis Snapshot API (Not verified) Acronis c:\windows\system32\drivers\snapman.sys
+ SPBBCDrv SPBBC Driver (Verified) Symantec Corporation c:\program files\common files\symantec shared\spbbc\spbbcdrv.sys
+ splitter Microsoft Kernel Audio Splitter (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\splitter.sys
+ svgam Intel (R) E7221 SVGA Driver (Not verified) Intel (R) Corporation c:\windows\system32\drivers\svgam.sys
+ swenum Plug and Play Software Device Enumerator (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\swenum.sys
+ swmidi Microsoft GS Wavetable Synthesizer (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\swmidi.sys
+ SymEvent Symantec Event Library (Verified) Symantec Corporation c:\program files\symantec\symevent.sys
+ SYMREDRV Redirector Filter Driver (Verified) Symantec Corporation c:\windows\system32\drivers\symredrv.sys
+ SYMTDI Network Dispatch Driver (Verified) Symantec Corporation c:\windows\system32\drivers\symtdi.sys
+ sysaudio System Audio WDM Filter (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\sysaudio.sys
+ Tcpip TCP/IP Protocol Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\tcpip.sys
+ TermDD Terminal Server Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\termdd.sys
+ timounter TrueImage Backup Archive Explorer (Not verified) Acronis c:\windows\system32\drivers\timntr.sys
+ Update Update Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\update.sys
+ usbehci EHCI eUSB Miniport Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\usbehci.sys
+ usbhub Default Hub Driver for USB (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\usbhub.sys
+ USBSTOR USB Mass Storage Class Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\usbstor.sys
+ usbuhci UHCI USB Miniport Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\usbuhci.sys
+ Vcs c:\windows\system32\drivers\vcs.sys
+ VgaSave VGA/Super VGA Video Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\vga.sys
+ VMnetAdapter Driver for VMware's Virtual Ethernet Adapters Ver. 2 (Verified) Microsoft Windows Hardware Compatibility Publisher c:\windows\system32\drivers\vmnetadapter.sys
+ VMnetBridge VMware Bridge Protocol (Not verified) VMware, Inc. c:\windows\system32\drivers\vmnetbridge.sys
+ VMnetuserif Allows VMware applications to use virtual networks. (Not verified) VMware, Inc. c:\windows\system32\drivers\vmnetuserif.sys
+ VMparport VMware Parallel Port Driver (Not verified) VMware, Inc. c:\windows\system32\drivers\vmparport.sys
+ vmusb VMware USB driver (Verified) Microsoft Windows Hardware Compatibility Publisher c:\windows\system32\drivers\vmusb.sys
+ vmx86 VMware Virtualization Driver (Not verified) VMware, Inc. c:\windows\system32\drivers\vmx86.sys
+ vstor2 VMware Virtual Storage Volume Driver (Not verified) VMware, Inc. c:\program files\common files\vmware\vmware virtual image editing\vstor2.sys
+ Wanarp Remote Access IP ARP Driver (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\wanarp.sys
+ wanusb USB ADSL Driver (Not verified) GlobespanVirata Inc. c:\windows\system32\drivers\gwausb.sys
+ wdm_fm801 WDM PCI Audio Driver (Not verified) ForteMedia, Inc. c:\windows\system32\drivers\fm801.sys
+ wdmaud MMSYSTEM Wave/Midi API mapper (Verified) Microsoft Windows Publisher c:\windows\system32\drivers\wdmaud.sys
+ WudfPf Provide communciation services for UMDF components. (Verified) Microsoft Windows c:\windows\system32\drivers\wudfpf.sys
+ WudfRd Reflect device requests to user-mode driver drivers (Verified) Microsoft Windows c:\windows\system32\drivers\wudfrd.sys
+ yukonwxp NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller (Not verified) Marvell c:\windows\system32\drivers\yk51x86.sys
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
+ autocheck autochk * Auto Check Utility (Verified) Microsoft Windows Publisher c:\windows\system32\autochk.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
+ Your Image File Name Here without a path Symbolic Debugger for Windows 2000 (Verified) Microsoft Windows Publisher c:\windows\system32\ntsd.exe
HKLM\Software\Microsoft\Command Processor\Autorun
HKCU\Software\Microsoft\Command Processor\Autorun
HKLM\SOFTWARE\Classes\Exefile\Shell\Open\Command\(Default)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
+ advapi32 Advanced Windows 32 Base API (Verified) Microsoft Windows Publisher c:\windows\system32\advapi32.dll
+ comdlg32 Common Dialogs DLL (Verified) Microsoft Windows Publisher c:\windows\system32\comdlg32.dll
+ gdi32 GDI Client DLL (Verified) Microsoft Windows Publisher c:\windows\system32\gdi32.dll
+ imagehlp Windows NT Image Helper (Verified) Microsoft Windows Publisher c:\windows\system32\imagehlp.dll
+ kernel32 Windows NT BASE API Client DLL (Verified) Microsoft Windows Publisher c:\windows\system32\kernel32.dll
+ lz32 LZ Expand/Compress API DLL (Verified) Microsoft Windows Publisher c:\windows\system32\lz32.dll
+ ole32 Microsoft OLE for Windows (Verified) Microsoft Windows Publisher c:\windows\system32\ole32.dll
+ oleaut32 (Verified) Microsoft Windows Publisher c:\windows\system32\oleaut32.dll
+ olecli32 Object Linking and Embedding Client Library (Verified) Microsoft Windows Publisher c:\windows\system32\olecli32.dll
+ olecnv32 Microsoft OLE for Windows (Verified) Microsoft Windows Publisher c:\windows\system32\olecnv32.dll
+ olesvr32 Object Linking and Embedding Server Library (Verified) Microsoft Windows Publisher c:\windows\system32\olesvr32.dll
+ olethk32 Microsoft OLE for Windows (Verified) Microsoft Windows Publisher c:\windows\system32\olethk32.dll
+ rpcrt4 Remote Procedure Call Runtime (Verified) Microsoft Windows Publisher c:\windows\system32\rpcrt4.dll
+ shell32 Windows Shell Common Dll (Verified) Microsoft Windows Publisher c:\windows\system32\shell32.dll
+ url Internet Shortcut Shell Extension DLL (Verified) Microsoft Windows Publisher c:\windows\system32\url.dll
+ urlmon OLE32 Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\urlmon.dll
+ user32 Windows XP USER API Client DLL (Verified) Microsoft Windows Publisher c:\windows\system32\user32.dll
+ version Version Checking and File Installation Libraries (Verified) Microsoft Windows Publisher c:\windows\system32\version.dll
+ wininet Internet Extensions for Win32 (Verified) Microsoft Windows Publisher c:\windows\system32\wininet.dll
+ wldap32 Win32 LDAP API DLL (Verified) Microsoft Windows Publisher c:\windows\system32\wldap32.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost
+ logonui.exe Windows Logon UI (Verified) Microsoft Windows Publisher c:\windows\system32\logonui.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
+ crypt32chain Crypto API32 (Verified) Microsoft Windows Publisher c:\windows\system32\crypt32.dll
+ cryptnet Crypto Network Related API (Verified) Microsoft Windows Publisher c:\windows\system32\cryptnet.dll
+ cscdll Offline Network Agent (Verified) Microsoft Windows Publisher c:\windows\system32\cscdll.dll
+ NavLogon Symantec AntiVirus Logon Notification (Verified) Symantec Corporation c:\windows\system32\navlogon.dll
+ ScCertProp Common DLL to receive Winlogon notifications (Verified) Microsoft Windows Publisher c:\windows\system32\wlnotify.dll
+ Schedule Common DLL to receive Winlogon notifications (Verified) Microsoft Windows Publisher c:\windows\system32\wlnotify.dll
+ sclgntfy Secondary Logon Service Notification DLL (Verified) Microsoft Windows Publisher c:\windows\system32\sclgntfy.dll
+ SensLogn Common DLL to receive Winlogon notifications (Verified) Microsoft Windows Publisher c:\windows\system32\wlnotify.dll
+ termsrv Common DLL to receive Winlogon notifications (Verified) Microsoft Windows Publisher c:\windows\system32\wlnotify.dll
+ wlballoon Common DLL to receive Winlogon notifications (Verified) Microsoft Windows Publisher c:\windows\system32\wlnotify.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKCU\Control Panel\Desktop\Scrnsave.exe
HKLM\System\CurrentControlSet\Control\BootVerificationProgram\ImageName
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{11746636-E1A7-4E2A-9B44-AEF156517754}] DATAGRAM 7 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{11746636-E1A7-4E2A-9B44-AEF156517754}] SEQPACKET 7 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{50431436-3D25-498A-9F54-C6DA060D815A}] DATAGRAM 0 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{50431436-3D25-498A-9F54-C6DA060D815A}] SEQPACKET 0 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{51BB85EC-E5C6-4BBD-9E06-D66AD48A75A8}] DATAGRAM 1 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{51BB85EC-E5C6-4BBD-9E06-D66AD48A75A8}] SEQPACKET 1 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{57178EEB-AB3E-45CB-B2F8-BAE938692DA5}] DATAGRAM 5 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{57178EEB-AB3E-45CB-B2F8-BAE938692DA5}] SEQPACKET 5 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{6B468574-89AC-4C43-9CE1-DD846056A025}] DATAGRAM 6 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{6B468574-89AC-4C43-9CE1-DD846056A025}] SEQPACKET 6 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{83CE4452-9E3F-4843-A7B9-2F1A32B0A790}] DATAGRAM 4 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{83CE4452-9E3F-4843-A7B9-2F1A32B0A790}] SEQPACKET 4 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{8E13F4B9-500B-4B5A-B905-E1796D04CD96}] DATAGRAM 2 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{8E13F4B9-500B-4B5A-B905-E1796D04CD96}] SEQPACKET 2 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{E1FBA11A-6B5F-43F5-A349-E3ED5C6131D3}] DATAGRAM 3 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD NetBIOS [\Device\NetBT_Tcpip_{E1FBA11A-6B5F-43F5-A349-E3ED5C6131D3}] SEQPACKET 3 Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD Tcpip [RAW/IP] Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD Tcpip [TCP/IP] Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ MSAFD Tcpip [UDP/IP] Microsoft Windows Sockets 2.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\mswsock.dll
+ RSVP TCP Service Provider Microsoft Windows Rsvp 1.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\rsvpsp.dll
+ RSVP UDP Service Provider Microsoft Windows Rsvp 1.0 Service Provider (Verified) Microsoft Windows Publisher c:\windows\system32\rsvpsp.dll
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
+ BJ Language Monitor Langage Monitor for Canon Bubble-Jet Printer (Verified) Microsoft Windows Publisher c:\windows\system32\cnbjmon.dll
+ Local Port Local Spooler DLL (Verified) Microsoft Windows Publisher c:\windows\system32\localspl.dll
+ PJL Language Monitor PJL Language monitor (Verified) Microsoft Windows Publisher c:\windows\system32\pjlmon.dll
+ Standard TCP/IP Port Standard TCP/IP Port Monitor DLL (Verified) Microsoft Windows Publisher c:\windows\system32\tcpmon.dll
+ USB Monitor Standard Dynamic Printing Port Monitor DLL (Verified) Microsoft Windows Publisher c:\windows\system32\usbmon.dll
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders
+ digest.dll Digest SSPI Authentication Package (Verified) Microsoft Windows Publisher c:\windows\system32\digest.dll
+ msapsspc.dll DPA Client for 32 bit platforms (Verified) Microsoft Windows Publisher c:\windows\system32\msapsspc.dll
+ msnsspc.dll MSN Internet Access (Verified) Microsoft Windows Publisher c:\windows\system32\msnsspc.dll
+ schannel.dll TLS / SSL Security Provider (Verified) Microsoft Windows Publisher c:\windows\system32\schannel.dll
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
+ msv1_0 Microsoft Authentication Package v1.0 (Verified) Microsoft Windows Publisher c:\windows\system32\msv1_0.dll
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
+ scecli Windows Security Configuration Editor Client Engine (Verified) Microsoft Windows Publisher c:\windows\system32\scecli.dll
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
+ kerberos Kerberos Security Package (Verified) Microsoft Windows Publisher c:\windows\system32\kerberos.dll
+ msv1_0 Microsoft Authentication Package v1.0 (Verified) Microsoft Windows Publisher c:\windows\system32\msv1_0.dll
+ schannel TLS / SSL Security Provider (Verified) Microsoft Windows Publisher c:\windows\system32\schannel.dll
+ wdigest Microsoft Digest Access (Verified) Microsoft Windows Publisher c:\windows\system32\wdigest.dll
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
+ LanmanWorkstation Microsoft Windows Network (Verified) Microsoft Windows Publisher c:\windows\system32\ntlanman.dll
+ RDPNP Microsoft Terminal Services (Verified) Microsoft Windows Publisher c:\windows\system32\drprov.dll
+ RFNP32 WebDrive Network (Not verified) River Front Software c:\windows\system32\rfnp32.dll
+ WebClient Web Client Network (Verified) Microsoft Windows Publisher c:\windows\system32\davclnt.dll

Response Number 20

Name: jabuck
Date: March 3, 2007 at 13:06:41 Pacific

Reply:

What was the real name of this folder:
C:\Documenys and Settings\rajanurs\Applications Data\MANAGE~1

Response Number 21

Name: rajanurs
Date: March 3, 2007 at 23:21:46 Pacific

Reply:

The full name of the folder is: MANAGERMAPIFILE

Response Number 22

Name: jabuck
Date: March 4, 2007 at 05:36:52 Pacific

Reply:

Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.

Copy all the text contained in the area between the X"s below to your Clipboard by highlighting it and pressing (Ctrl+C):
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Files to delete:
C:\Documents and Settings\rajanurs\Applications Data\Managermapifile\greyproc.exe
Folders to delete:
C:\Documenys and Settings\rajanurs\Applications Data\Managermapifile

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.
After the restart, it creates a log file that should open with the results of Avenger’s actions.
This log file will be located at C:\avenger.txt
Please copy/paste the content of C:\avenger.txt into your reply.
Post a new comboscan log please.

Response Number 23

Name: rajanurs
Date: March 4, 2007 at 09:32:41 Pacific

Reply:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\Sytem\CurrentControlSet\Services\hfcibscr
*******************
Script file located at: ckiytbvx
Could not open script file! Error
Could not open script file!
Status: 0xc000003b Abort!

.......................................
Comboscan:
ComboScan v20070226.18 run by rajanurs on 2007-03-04 at 22:35:19
Computer is in Normal Mode.
----------------
-- HijackThis (run as rajanurs.exe) ---------
Logfile of HijackThis v1.99.1
Scan saved at 10:35:24 PM, on 3/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\GSICON.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\eraser.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\MPA\MBackup\MBackup.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\IBserver\mysql\bin\mysqld-nt.exe
C:\Program Files VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\HIJACK~1\rajanurs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06F383EE-CCD0-4CE8-9F76-5FC31D6A8C5F} - (no file)
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [The wave] C:\DOCUME~1\rajanurs\APPLIC~1\MANAGE~1\greyproc.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Shortcut to MBackup.exe.lnk = C:\Program Files\MPA\MBackup\MBackup.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add Link to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add Page to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add to &Windows Live Favorites - http://favorites.live.com/quickadd....
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: SiteBar - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: SiteBar Panel - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - C:\IBserver\apache\Apache.exe" --ntservice (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DirectUpdate engine (DirectUpdate) - http://www.wildup.net/ - C:\Program Files\DirectUpdate v4\DUEngine.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: inetd - Unknown owner - C:\cygwin\bin\cygrunsrv.exe (file missing)
O23 - Service: MySql - Unknown owner - C:/IBserver/mysql/bin/mysqld-nt.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - J:\wamp\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - J:\wamp\mysql\bin\mysqld-nt.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe (file missing)

-- Files created between 2007-02-04 and 20----------
2007-03-04 22:04:50 0 d-------- C:\avenger
2007-03-04 00:18:27 0 d-------- C:\AutoRuns
2007-03-03 11:17:58 0 d-------- C:\NoLopBackups<NOLOPB~1>
2007-03-02 19:43:23 0 d-------- C:\!KillBox
2007-03-02 13:34:20 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-02 00:14:53 2316 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-02 00:14:10 79360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-03-02 00:14:10 40960 --a------ C:\WINDOWS\system32\swsc.exe
2007-03-02 00:14:10 135168 --a------ C:\WINDOWS\system32\swreg.exe
2007-03-02 00:14:10 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-03-02 00:14:10 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-03-02 00:14:09 53248 --a------ C:\WINDOWS\system32\Process.exe
2007-03-01 23:54:47 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-01 23:53:46 92160 --a------ C:\VundoFix.exe
2007-03-01 15:51:40 0 d-------- C:\Program Files\RegScrubXP<REGSCR~1>
2007-03-01 09:52:37 0 d-------- C:\ComboScan<COMBOS~1>
2007-03-01 09:47:00 0 d-------- C:\Program Files\Hijackthis<HIJACK~1>
2007-03-01 09:41:53 19392 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-03-01 00:39:45 0 dr-h----- C:\$VAULT$.AVG
2007-03-01 00:39:40 12190760 -----n--- C:\AVG7QT.DAT
2007-03-01 00:32:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\AVG7
2007-03-01 00:31:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-03-01 00:31:47 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-03-01 00:31:46 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-03-01 00:31:46 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-03-01 00:31:46 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-03-01 00:31:45 775680 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-03-01 00:31:38 0 d-------- C:\Program Files\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-02-28 12:39:34 0 d--h----- C:\WINDOWS\system32\GroupPolicy<GROUPP~1>
2007-02-27 23:22:20 0 d-------- C:\Program Files\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:22:20 0 d-------- C:\Documents and Settings\rajanurs\Application Data\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:13:44 16384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-02-27 23:13:44 0 d-------- C:\WINDOWS\system32\Adobe
2007-02-27 23:11:58 0 d-------- C:\Adobe Illustrator Installer<ADOBEI~1>
2007-02-27 20:17:20 0 d--hs---- C:\WINDOWS\ftpcache
2007-02-27 20:17:13 0 d-------- C:\PhotoShopE Intro<PHOTOS~1>
2007-02-27 19:12:06 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Alien Skin<ALIENS~1>
2007-02-27 16:00:58 0 d-------- C:\Program Files\Sodipodi
2007-02-27 16:00:34 0 d-------- C:\Program Files\Common Files\GTK
2007-02-26 19:00:23 0 d-------- C:\Program Files\PhotoZoom Pro 2<PHOTOZ~1>
2007-02-26 12:22:18 0 d-------- C:\Program Files\MorpheusBar<MORPHE~1>
2007-02-26 12:21:21 0 d-------- C:\Program Files\Morpheus
2007-02-26 12:07:20 0 d-------- C:\Documents and Settings\rajanurs\Shared
2007-02-26 12:07:05 0 d-------- C:\Documents and Settings\rajanurs\Incomplete<INCOMP~1>
2007-02-26 11:48:17 0 d-------- C:\Program Files\Java
2007-02-26 11:43:38 0 d-------- C:\Program Files\Common Files\Java
2007-02-24 01:00:23 589824 --a------ C:\WINDOWS\system32\CDRProX.dll
2007-02-24 01:00:18 0 d-------- C:\Program Files\Longtion
2007-02-22 19:48:38 0 d-------- C:\Program Files\WINK FlashDemoMaker<WINKFL~1>
2007-02-22 18:27:28 0 d-------- C:\WINDOWS\APW_DATA
2007-02-22 18:23:01 0 d-------- C:\Documents and Settings\All Users\Application Data\sbooks
2007-02-22 18:22:41 0 d-------- C:\Program Files\Screenbook Maker<SCREEN~1>
2007-02-21 11:20:13 110592 --a------ C:\WINDOWS\system32\tsccvid.dll
2007-02-20 12:31:53 204848 --a------ C:\WINDOWS\system32\gswin32c.exe
2007-02-20 12:31:42 196608 --a------ C:\WINDOWS\system32\Utility.dll
2007-02-20 12:31:35 0 d-------- C:\Program Files\LogoSmartzTrial<LOGOSM~1>
2007-02-20 12:16:59 0 d-------- C:\Program Files\AAALOGO
2007-02-16 23:21:15 0 d-------- C:\Documents and Settings\rajanurs\Application Data\gtk-2.0
2007-02-16 23:20:10 0 d-------- C:\Program Files\Inkscape
2007-02-15 22:49:48 0 d-------- C:\WINDOWS\system32\Photosynth<PHOTOS~1>
2007-02-10 13:25:52 0 d-------- C:\Documents and Settings\rajanurs\Application Data\BackLinks Master<BACKLI~1>
2007-02-10 12:20:31 0 d-------- C:\Documents and Settings\rajanurs\Application Data\PaRaMeter<PARAME~1>
2007-02-10 12:20:29 0 d-------- C:\Program Files\PaRaMeter<PARAME~1>
2007-02-10 12:20:13 0 d-------- C:\Program Files\BackLinks Master<BACKLI~1>
2007-02-10 12:19:09 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Free Monitor for Google<FREEMO~1>
2007-02-10 12:19:05 0 d-------- C:\Program Files\Free Monitor for Google<FREEMO~1>

-- Find3M Re-----------
2007-03-04 22:24:00 0 --a------ C:\Documents and Settings\rajanurs\Application Data\New Text Document.txt<NEWTEX~1.TXT>
2007-03-04 22:02:59 0 d-------- C:\Program Files\Eraser
2007-03-02 12:51:15 0 d-------- C:\Program Files\Mydrivers<MYDRIV~1>
2007-03-02 11:09:03 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-03-02 01:23:22 0 d-------- C:\Program Files\Opera
2007-02-27 23:33:59 0 d-------- C:\Program Files\CPUMon
2007-02-27 23:33:58 0 d-------- C:\Program Files\WebDrive
2007-02-27 23:15:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Adobe
2007-02-27 23:13:44 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-27 23:13:16 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-27 00:32:20 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-02-15 22:50:18 3783 --a------ C:\WINDOWS\mozver.dat
2007-01-28 01:15:45 0 d-------- C:\Program Files\KKDict
2007-01-28 01:15:01 249856 -----n--- C:\WINDOWS\Setup1.exe
2007-01-28 01:15:00 73216 --a------ C:\WINDOWS\ST6UNST.exe
2007-01-15 02:04:50 0 d-------- C:\Program Files\Total Video Converter<TOTALV~1>
2007-01-14 16:24:44 0 d-------- C:\Program Files\Windows Media Connect 2<WI4DF6~1>
2007-01-14 04:29:44 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-01-14 04:29:36 0 d-------- C:\Program Files\Riva
2007-01-13 15:42:41 0 d-------- C:\Program Files\Google

-- Registry -----------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"The wave"="C:\\DOCUME~1\\rajanurs\\APPLIC~1\\MANAGE~1\\greyproc.exe"
"Eraser"="C:\\Program Files\\Eraser\\eraser.exe -hide"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"GSICONEXE"="GSICON.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"location"="Common Startup"
"item"="Microsoft Office"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlarmMe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AlarmMe"
"hkey"="HKLM"
"command"="\"D:\\Program Files\\Alarm Me\\AlarmMe.exe\" \"-h\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USSShReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ussshreg"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=hex:00,00,00,00
"NoSaveSettings"=hex:00,00,00,00
"ClearRecentDocsOnExit"=hex:00,00,00,00
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{211c84df-b451-11da-ae03-806d6172696f}]
Shell\AutoRun\command E:\EISetup.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dfe8ba6d-b069-11db-9a59-000779300101}]
Shell\AutoRun\command ie.exe
Shell\explore\Command ie.exe
Shell\open\Command ie.exe

-- End of ComboScan: finished at 2007-03-04 at 22:35:42 --

Response Number 24

Name: jabuck
Date: March 4, 2007 at 13:27:51 Pacific

Reply:

Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok.
Go to start> run. Type each command then press enter.:
cmd (press enter)
cd application data (press enter)
cd MANAGERMAPIFILE (press enter)
attrib -h -s -r greyproc.exe (press enter)
del /q /s greyproc.exe (press enter)
cd application data (press enter)
attrib -h -s -r MANAGERMAPIFILE (press enter)
deltree MANAGERMAPIFILE (press enter)
Exit cmd by pressing the x at the top right of the black screen.
Navigate to and delete theis file if found:
C:\WINDOWS\ie.exe
Post a new comboscan please.

Response Number 25

Name: rajanurs
Date: March 4, 2007 at 14:07:44 Pacific

Reply:

Ok Done. But C:\WINDOWS\ie.exe was not found.
...........................................
ComboScan v20070226.18 run by rajanurs on 2007-03-05 at 03:13:30
Computer is in Normal Mode.
----------------
-- HijackThis (run as rajanurs.exe) ---------
Logfile of HijackThis v1.99.1
Scan saved at 3:13:35 AM, on 3/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\GSICON.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\MPA\MBackup\MBackup.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\IBserver\mysql\bin\mysqld-nt.exe
C:\Program Files VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\HIJACK~1\rajanurs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06F383EE-CCD0-4CE8-9F76-5FC31D6A8C5F} - (no file)
O2 - BHO: IeCaptureBho Object - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [The wave] C:\DOCUME~1\rajanurs\APPLIC~1\MANAGE~1\greyproc.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Shortcut to MBackup.exe.lnk = C:\Program Files\MPA\MBackup\MBackup.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add Link to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add Page to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add to &Windows Live Favorites - http://favorites.live.com/quickadd....
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: SiteBar - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: SiteBar Panel - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{57178EEB-AB3E-45CB-B2F8-BAE938692DA5}: NameServer = 125.22.47.125 202.56.250.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - C:\IBserver\apache\Apache.exe" --ntservice (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DirectUpdate engine (DirectUpdate) - http://www.wildup.net/ - C:\Program Files\DirectUpdate v4\DUEngine.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: inetd - Unknown owner - C:\cygwin\bin\cygrunsrv.exe (file missing)
O23 - Service: MySql - Unknown owner - C:/IBserver/mysql/bin/mysqld-nt.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - J:\wamp\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - J:\wamp\mysql\bin\mysqld-nt.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe (file missing)

-- Files created between 2007-02-05 and 20----------
2007-03-04 22:04:50 0 d-------- C:\avenger
2007-03-04 00:18:27 0 d-------- C:\AutoRuns
2007-03-03 11:17:58 0 d-------- C:\NoLopBackups<NOLOPB~1>
2007-03-02 19:43:23 0 d-------- C:\!KillBox
2007-03-02 13:34:20 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-02 00:14:53 2316 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-02 00:14:10 79360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-03-02 00:14:10 40960 --a------ C:\WINDOWS\system32\swsc.exe
2007-03-02 00:14:10 135168 --a------ C:\WINDOWS\system32\swreg.exe
2007-03-02 00:14:10 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-03-02 00:14:10 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-03-02 00:14:09 53248 --a------ C:\WINDOWS\system32\Process.exe
2007-03-01 23:54:47 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-01 23:53:46 92160 --a------ C:\VundoFix.exe
2007-03-01 15:51:40 0 d-------- C:\Program Files\RegScrubXP<REGSCR~1>
2007-03-01 09:52:37 0 d-------- C:\ComboScan<COMBOS~1>
2007-03-01 09:47:00 0 d-------- C:\Program Files\Hijackthis<HIJACK~1>
2007-03-01 09:41:53 19392 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-03-01 00:39:45 0 dr-h----- C:\$VAULT$.AVG
2007-03-01 00:39:40 12190760 -----n--- C:\AVG7QT.DAT
2007-03-01 00:32:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\AVG7
2007-03-01 00:31:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-03-01 00:31:47 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-03-01 00:31:46 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-03-01 00:31:46 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-03-01 00:31:46 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-03-01 00:31:45 775680 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-03-01 00:31:38 0 d-------- C:\Program Files\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-02-28 12:39:34 0 d--h----- C:\WINDOWS\system32\GroupPolicy<GROUPP~1>
2007-02-27 23:22:20 0 d-------- C:\Program Files\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:13:44 16384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-02-27 23:13:44 0 d-------- C:\WINDOWS\system32\Adobe
2007-02-27 23:11:58 0 d-------- C:\Adobe Illustrator Installer<ADOBEI~1>
2007-02-27 20:17:20 0 d--hs---- C:\WINDOWS\ftpcache
2007-02-27 20:17:13 0 d-------- C:\PhotoShopE Intro<PHOTOS~1>
2007-02-27 19:12:06 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Alien Skin<ALIENS~1>
2007-02-27 16:00:58 0 d-------- C:\Program Files\Sodipodi
2007-02-27 16:00:34 0 d-------- C:\Program Files\Common Files\GTK
2007-02-26 19:00:23 0 d-------- C:\Program Files\PhotoZoom Pro 2<PHOTOZ~1>
2007-02-26 12:22:18 0 d-------- C:\Program Files\MorpheusBar<MORPHE~1>
2007-02-26 12:21:21 0 d-------- C:\Program Files\Morpheus
2007-02-26 12:07:20 0 d-------- C:\Documents and Settings\rajanurs\Shared
2007-02-26 12:07:05 0 d-------- C:\Documents and Settings\rajanurs\Incomplete<INCOMP~1>
2007-02-26 11:48:17 0 d-------- C:\Program Files\Java
2007-02-26 11:43:38 0 d-------- C:\Program Files\Common Files\Java
2007-02-24 01:00:23 589824 --a------ C:\WINDOWS\system32\CDRProX.dll
2007-02-24 01:00:18 0 d-------- C:\Program Files\Longtion
2007-02-22 19:48:38 0 d-------- C:\Program Files\WINK FlashDemoMaker<WINKFL~1>
2007-02-22 18:27:28 0 d-------- C:\WINDOWS\APW_DATA
2007-02-22 18:23:01 0 d-------- C:\Documents and Settings\All Users\Application Data\sbooks
2007-02-22 18:22:41 0 d-------- C:\Program Files\Screenbook Maker<SCREEN~1>
2007-02-21 11:20:13 110592 --a------ C:\WINDOWS\system32\tsccvid.dll
2007-02-20 12:31:53 204848 --a------ C:\WINDOWS\system32\gswin32c.exe
2007-02-20 12:31:42 196608 --a------ C:\WINDOWS\system32\Utility.dll
2007-02-20 12:31:35 0 d-------- C:\Program Files\LogoSmartzTrial<LOGOSM~1>
2007-02-20 12:16:59 0 d-------- C:\Program Files\AAALOGO
2007-02-16 23:21:15 0 d-------- C:\Documents and Settings\rajanurs\Application Data\gtk-2.0
2007-02-16 23:20:10 0 d-------- C:\Program Files\Inkscape
2007-02-15 22:49:48 0 d-------- C:\WINDOWS\system32\Photosynth<PHOTOS~1>
2007-02-10 13:25:52 0 d-------- C:\Documents and Settings\rajanurs\Application Data\BackLinks Master<BACKLI~1>
2007-02-10 12:20:31 0 d-------- C:\Documents and Settings\rajanurs\Application Data\PaRaMeter<PARAME~1>
2007-02-10 12:20:29 0 d-------- C:\Program Files\PaRaMeter<PARAME~1>
2007-02-10 12:20:13 0 d-------- C:\Program Files\BackLinks Master<BACKLI~1>
2007-02-10 12:19:09 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Free Monitor for Google<FREEMO~1>
2007-02-10 12:19:05 0 d-------- C:\Program Files\Free Monitor for Google<FREEMO~1>

-- Find3M Re-----------
2007-03-05 01:23:48 0 d-------- C:\Program Files\Eraser
2007-03-04 22:24:00 0 --a------ C:\Documents and Settings\rajanurs\Application Data\New Text Document.txt<NEWTEX~1.TXT>
2007-03-02 12:51:15 0 d-------- C:\Program Files\Mydrivers<MYDRIV~1>
2007-03-02 11:09:03 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-03-02 01:23:22 0 d-------- C:\Program Files\Opera
2007-02-27 23:33:59 0 d-------- C:\Program Files\CPUMon
2007-02-27 23:33:58 0 d-------- C:\Program Files\WebDrive
2007-02-27 23:15:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Adobe
2007-02-27 23:13:44 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-27 23:13:16 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-27 00:32:20 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-02-15 22:50:18 3783 --a------ C:\WINDOWS\mozver.dat
2007-01-28 01:15:45 0 d-------- C:\Program Files\KKDict
2007-01-28 01:15:01 249856 -----n--- C:\WINDOWS\Setup1.exe
2007-01-28 01:15:00 73216 --a------ C:\WINDOWS\ST6UNST.exe
2007-01-15 02:04:50 0 d-------- C:\Program Files\Total Video Converter<TOTALV~1>
2007-01-14 16:24:44 0 d-------- C:\Program Files\Windows Media Connect 2<WI4DF6~1>
2007-01-14 04:29:44 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-01-14 04:29:36 0 d-------- C:\Program Files\Riva
2007-01-13 15:42:41 0 d-------- C:\Program Files\Google

-- Registry -----------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"The wave"="C:\\DOCUME~1\\rajanurs\\APPLIC~1\\MANAGE~1\\greyproc.exe"
"Eraser"="C:\\Program Files\\Eraser\\eraser.exe -hide"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"GSICONEXE"="GSICON.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"location"="Common Startup"
"item"="Microsoft Office"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlarmMe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AlarmMe"
"hkey"="HKLM"
"command"="\"D:\\Program Files\\Alarm Me\\AlarmMe.exe\" \"-h\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USSShReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ussshreg"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=hex:00,00,00,00
"NoSaveSettings"=hex:00,00,00,00
"ClearRecentDocsOnExit"=hex:00,00,00,00
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{211c84df-b451-11da-ae03-806d6172696f}]
Shell\AutoRun\command E:\EISetup.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dfe8ba6d-b069-11db-9a59-000779300101}]
Shell\AutoRun\command ie.exe
Shell\explore\Command ie.exe
Shell\open\Command ie.exe

-- End of ComboScan: finished at 2007-03-05 at 03:1-

Response Number 26

Name: jabuck
Date: March 4, 2007 at 15:43:39 Pacific

Reply:

Found the problem or at least part of it.
Go to start> control panel> add/remove programs and unistall these programs if found
CiD Help
Post a new comboscan log make sure we get the second part of the scan.
Please download and run Catchme from this link http://www.gmer.net/catchme.php then post the results of the scan.

Response Number 27

Name: rajanurs
Date: March 4, 2007 at 21:01:33 Pacific

Reply:

CiD Help was found and removed.
...........................................
ComboScan v20070226.18 run by rajanurs on 2007-03-05 at 10:05:03
Computer is in Normal Mode.
----------------
-- HijackThis (run as rajanurs.exe) ---------
Logfile of HijackThis v1.99.1
Scan saved at 10:05:05 AM, on 3/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\IBserver\apache\Apache.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\IBserver\apache\Apache.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\IBserver\mysql\bin\mysqld-nt.exe
C:\Program Files VMware\VMware Player\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\GSICON.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MPA\MBackup\MBackup.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Symantec AntiVirus\vptray.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\HIJACK~1\rajanurs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06F383EE-CCD0-4CE8-9F76-5FC31D6A8C5F} - (no file)
O2 - BHO: IeCaptureBho Object - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [The wave] C:\DOCUME~1\rajanurs\APPLIC~1\MANAGE~1\greyproc.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Shortcut to MBackup.exe.lnk = C:\Program Files\MPA\MBackup\MBackup.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Add Link to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add Page to SiteBar - http://my.sitebar.org/ctxmenu.php?a...
O8 - Extra context menu item: Add to &Windows Live Favorites - http://favorites.live.com/quickadd....
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: SiteBar - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: SiteBar Panel - {23F5C49C-74DF-42BA-A194-FF92A3B59FED} - Shdocvw.dll (file missing) (HKCU)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{57178EEB-AB3E-45CB-B2F8-BAE938692DA5}: NameServer = 125.22.47.125 202.56.250.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - C:\IBserver\apache\Apache.exe" --ntservice (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DirectUpdate engine (DirectUpdate) - http://www.wildup.net/ - C:\Program Files\DirectUpdate v4\DUEngine.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\IPCheck Server Monitor 5\Firebird\bin\fbserver.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: inetd - Unknown owner - C:\cygwin\bin\cygrunsrv.exe (file missing)
O23 - Service: MySql - Unknown owner - C:/IBserver/mysql/bin/mysqld-nt.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - J:\wamp\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - J:\wamp\mysql\bin\mysqld-nt.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe (file missing)

-- Files created between 2007-02-05 and 20----------
2007-03-05 03:17:46 0 d-------- C:\Documents and Settings\rajanurs\Application Data\MANAGERMAPIFILE<MANAGE~1>
2007-03-05 01:02:50 0 d-------- C:\Program Files\Yahoo!
2007-03-05 01:02:44 0 d-------- C:\Program Files\CCleaner
2007-03-04 22:04:50 0 d-------- C:\avenger
2007-03-04 00:18:27 0 d-------- C:\AutoRuns
2007-03-03 11:17:58 0 d-------- C:\NoLopBackups<NOLOPB~1>
2007-03-02 19:43:23 0 d-------- C:\!KillBox
2007-03-02 13:34:20 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-02 00:14:53 2316 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-02 00:14:10 79360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-03-02 00:14:10 40960 --a------ C:\WINDOWS\system32\swsc.exe
2007-03-02 00:14:10 135168 --a------ C:\WINDOWS\system32\swreg.exe
2007-03-02 00:14:10 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-03-02 00:14:10 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-03-02 00:14:09 53248 --a------ C:\WINDOWS\system32\Process.exe
2007-03-01 23:54:47 0 d-------- C:\VundoFix Backups<VUNDOF~1>
2007-03-01 23:53:46 92160 --a------ C:\VundoFix.exe
2007-03-01 15:51:40 0 d-------- C:\Program Files\RegScrubXP<REGSCR~1>
2007-03-01 09:47:00 0 d-------- C:\Program Files\Hijackthis<HIJACK~1>
2007-03-01 09:41:53 19392 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-03-01 00:39:45 0 dr-h----- C:\$VAULT$.AVG
2007-03-01 00:39:40 12190760 -----n--- C:\AVG7QT.DAT
2007-03-01 00:32:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\AVG7
2007-03-01 00:31:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-03-01 00:31:47 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-03-01 00:31:46 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-03-01 00:31:46 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-03-01 00:31:46 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-03-01 00:31:45 775680 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-03-01 00:31:38 0 d-------- C:\Program Files\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-03-01 00:31:38 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-02-28 12:39:34 0 d--h----- C:\WINDOWS\system32\GroupPolicy<GROUPP~1>
2007-02-27 23:22:20 0 d-------- C:\Program Files\MANAGERMAPIFILE<MANAGE~1>
2007-02-27 23:13:44 16384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-02-27 23:13:44 0 d-------- C:\WINDOWS\system32\Adobe
2007-02-27 23:11:58 0 d-------- C:\Adobe Illustrator Installer<ADOBEI~1>
2007-02-27 20:17:20 0 d--hs---- C:\WINDOWS\ftpcache
2007-02-27 20:17:13 0 d-------- C:\PhotoShopE Intro<PHOTOS~1>
2007-02-27 19:12:06 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Alien Skin<ALIENS~1>
2007-02-27 16:00:58 0 d-------- C:\Program Files\Sodipodi
2007-02-27 16:00:34 0 d-------- C:\Program Files\Common Files\GTK
2007-02-26 19:00:23 0 d-------- C:\Program Files\PhotoZoom Pro 2<PHOTOZ~1>
2007-02-26 12:22:18 0 d-------- C:\Program Files\MorpheusBar<MORPHE~1>
2007-02-26 12:21:21 0 d-------- C:\Program Files\Morpheus
2007-02-26 12:07:20 0 d-------- C:\Documents and Settings\rajanurs\Shared
2007-02-26 12:07:05 0 d-------- C:\Documents and Settings\rajanurs\Incomplete<INCOMP~1>
2007-02-26 11:48:17 0 d-------- C:\Program Files\Java
2007-02-26 11:43:38 0 d-------- C:\Program Files\Common Files\Java
2007-02-24 01:00:23 589824 --a------ C:\WINDOWS\system32\CDRProX.dll
2007-02-24 01:00:18 0 d-------- C:\Program Files\Longtion
2007-02-22 19:48:38 0 d-------- C:\Program Files\WINK FlashDemoMaker<WINKFL~1>
2007-02-22 18:27:28 0 d-------- C:\WINDOWS\APW_DATA
2007-02-22 18:23:01 0 d-------- C:\Documents and Settings\All Users\Application Data\sbooks
2007-02-22 18:22:41 0 d-------- C:\Program Files\Screenbook Maker<SCREEN~1>
2007-02-21 11:20:13 110592 --a------ C:\WINDOWS\system32\tsccvid.dll
2007-02-20 12:31:53 204848 --a------ C:\WINDOWS\system32\gswin32c.exe
2007-02-20 12:31:42 196608 --a------ C:\WINDOWS\system32\Utility.dll
2007-02-20 12:31:35 0 d-------- C:\Program Files\LogoSmartzTrial<LOGOSM~1>
2007-02-20 12:16:59 0 d-------- C:\Program Files\AAALOGO
2007-02-16 23:21:15 0 d-------- C:\Documents and Settings\rajanurs\Application Data\gtk-2.0
2007-02-16 23:20:10 0 d-------- C:\Program Files\Inkscape
2007-02-15 22:49:48 0 d-------- C:\WINDOWS\system32\Photosynth<PHOTOS~1>
2007-02-10 13:25:52 0 d-------- C:\Documents and Settings\rajanurs\Application Data\BackLinks Master<BACKLI~1>
2007-02-10 12:20:31 0 d-------- C:\Documents and Settings\rajanurs\Application Data\PaRaMeter<PARAME~1>
2007-02-10 12:20:29 0 d-------- C:\Program Files\PaRaMeter<PARAME~1>
2007-02-10 12:20:13 0 d-------- C:\Program Files\BackLinks Master<BACKLI~1>
2007-02-10 12:19:09 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Free Monitor for Google<FREEMO~1>
2007-02-10 12:19:05 0 d-------- C:\Program Files\Free Monitor for Google<FREEMO~1>

-- Find3M Re-----------
2007-03-05 09:44:14 0 d-------- C:\Program Files\Symantec AntiVirus<SYMANT~1>
2007-03-05 09:33:27 0 d-------- C:\Program Files\Eraser
2007-03-05 09:32:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\uTorrent
2007-03-05 05:00:34 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-03-04 22:24:00 0 --a------ C:\Documents and Settings\rajanurs\Application Data\New Text Document.txt<NEWTEX~1.TXT>
2007-03-02 12:51:15 0 d-------- C:\Program Files\Mydrivers<MYDRIV~1>
2007-03-02 01:23:22 0 d-------- C:\Program Files\Opera
2007-02-27 23:33:59 0 d-------- C:\Program Files\CPUMon
2007-02-27 23:33:58 0 d-------- C:\Program Files\WebDrive
2007-02-27 23:15:10 0 d-------- C:\Documents and Settings\rajanurs\Application Data\Adobe
2007-02-27 23:13:44 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-27 23:13:16 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-15 22:50:18 3783 --a------ C:\WINDOWS\mozver.dat
2007-01-28 01:15:45 0 d-------- C:\Program Files\KKDict
2007-01-28 01:15:01 249856 -----n--- C:\WINDOWS\Setup1.exe
2007-01-28 01:15:00 73216 --a------ C:\WINDOWS\ST6UNST.exe
2007-01-15 02:04:50 0 d-------- C:\Program Files\Total Video Converter<TOTALV~1>
2007-01-14 16:24:44 0 d-------- C:\Program Files\Windows Media Connect 2<WI4DF6~1>
2007-01-14 04:29:44 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-01-14 04:29:36 0 d-------- C:\Program Files\Riva
2007-01-13 15:42:41 0 d-------- C:\Program Files\Google

-- Registry -----------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"The wave"="C:\\DOCUME~1\\rajanurs\\APPLIC~1\\MANAGE~1\\greyproc.exe"
"Eraser"="C:\\Program Files\\Eraser\\eraser.exe -hide"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"GSICONEXE"="GSICON.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"vptray"="C:\\PROGRA~1\\SYMANT~1\\\\vptray.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"location"="Common Startup"
"item"="Microsoft Office"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlarmMe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AlarmMe"
"hkey"="HKLM"
"command"="\"D:\\Program Files\\Alarm Me\\AlarmMe.exe\" \"-h\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USSShReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Ussshreg"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B56EEC08-9ECD-4C21-8C83-66F2BBAA7C9C}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=hex:00,00,00,00
"NoSaveSettings"=hex:00,00,00,00
"ClearRecentDocsOnExit"=hex:00,00,00,00
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{211c84df-b451-11da-ae03-806d6172696f}]
Shell\AutoRun\command E:\EISetup.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dfe8ba6d-b069-11db-9a59-000779300101}]
Shell\AutoRun\command ie.exe
Shell\explore\Command ie.exe
Shell\open\Command ie.exe
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_ERASERUTILDRVI1

-- End of ComboScan: finished at 2007-03-05 at 10:0-

Response Number 28

Name: rajanurs
Date: March 4, 2007 at 21:04:33 Pacific

Reply:

catchme log:
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Response Number 29

Name: rajanurs
Date: March 8, 2007 at 01:11:27 Pacific

Reply:

The problem has not returned so far.
Thanks a lot jabuck

Response Number 30

Name: jabuck
Date: March 8, 2007 at 03:34:14 Pacific

Reply:

Glad we could help.

Sponsored Link

Ads by Google

Firefox updates

New Antivirus Test Result...

Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.

Go to Security and Virus Forum Home

Sponsored links

Ads by Google

Results for: Undetectable problem

NEW Virus Undetectable

Summary

www.computing.net/answers/security/new-virus-undetectable/20244.html

Virus [inetcpl.exe] undetected with

Summary

www.computing.net/answers/security/virus-inetcplexe-undetected-with/14261.html

malware problem undetected by adawa

Summary

www.computing.net/answers/security/malware-problem-undetected-by-adawa/16173.html

From the Geek Dictionary
steam - Steam refers to a Digital Distribution Platform developed by Valve Software...

Ask a Question!

Weekly Poll
What do you think of the new preview of Chrome OS?

Poll Finishes In 5 Days.
Discuss in The Lounge
Poll History

Recent Posts
password recovery or bypass

"save as" button

Kaspersky Internet Security 2010

boot failure

online gaming

All Awaiting Reply

Tom's News
Woman Tracks Down Club Attacker on Facebook

Geolocation Functions Come to Twitter

New Craigslist Trend: Trade Sex for Rent?

Law Firm Investigates MS Over Xbox Live Bans

Amazon Charges $25 for Palm Pixi and $80 for Pre

More Tom's Guide News

Data Recovery

Manufacturer List | About Us | Advertising Info | Contact Us
The information on Computing.Net is the opinions of its users. Such opinions may not be accurate and they are to be used at your own risk. Computing.Net cannot verify the validity of the statements made on this site. Computing.Net and Computing.Net LLC hereby disclaim all responsibility and liability for the content of Computing.Net and its accuracy.
PLEASE READ THE FULL DISCLAIMER AND LEGAL TERMS BY CLICKING HERE