Maisel59 Posted September 10, 2007 Report Share Posted September 10, 2007 (edited) Hello Lately, I have been having issues with my Avast! scan. The list of files that it can not scan is growing in length. My computer is about 50% slower than it used to be. And today I found 2 files that Avast! said it couldn't read, but noted as a "Decompression Bombs". I can't imagine that that's a good thing I'm very nervous about this discovery. I'm trying to find out how to get rid of these bad files from my computer. Below is a copy of the HJT log from notepad. Please let me know if this is not enough information to provide aid in my situation. Any help that you can offer would be wonderful. Thank you. Logfile of HijackThis v1.99.1Scan saved at 9:51:06 PM, on 9/9/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Creative\Shared Files\CTDevSrv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\svchost.exec:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Java\jre1.6.0_02\bin\jusched.exeC:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exec:\windows\system\hpsysdrv.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Alwil Software\Avast4\ashSimpl.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings\Compaq_Owner\My Documents\HiJackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dllO2 - BHO: (no name) - {fd52bc30-fb90-4b8f-bcae-77b3906e9600} - C:\WINDOWS\system32\fonnth.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /runO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeO4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quietO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.htmlO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cabO16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cabO20 - Winlogon Notify: fonnth - fonnth.dll (file missing)O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Edited September 10, 2007 by Maisel59 Link to post Share on other sites
jwbirdsong Posted September 10, 2007 Report Share Posted September 10, 2007 Did AVAST give you file location for the Decompression Bombs?? BTW they are just what they sound like files that when you unzip/decompress them copy LARGE amount of junk to your system. Not necessarily malicious but no fun none the less.Download and scan with SUPERAntiSpyware Free for Home UsersDouble-click SUPERAntiSpyware.exe and use the default settings for installation.An icon will be created on your desktop. Double-click that icon to launch the program.If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)Under "Configuration and Preferences", click the Preferences button.Click the Scanning Control tab.Under Scanner Options make sure the following are checked (leave all others unchecked):Close browsers before scanning.Scan for tracking cookies.Terminate memory threats before quarantining.[*]Click the "Close" button to leave the control center screen.[*]Back on the main screen, under "Scan for Harmful Software" click Scan your computer.[*]On the left, make sure you check C:\Fixed Drive.[*]On the right, under "Complete Scan", choose Perform Complete Scan.[*]Click "Next" to start the scan. Please be patient while it scans your computer.[*]After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".[*]Make sure everything has a checkmark next to it and click "Next".[*]A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.[*]If asked if you want to reboot, click "Yes".[*]To retrieve the removal information after reboot, launch SUPERAntispyware again.Click Preferences, then click the Statistics/Logs tab.Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.Please copy and paste the Scan Log results in your next reply.[*]Click Close to exit the program.Please go HERE to run Panda's ActiveScanOnce you are on the Panda site click the Scan your PC buttonA new window will open...click the Check Now buttonEnter your CountryEnter your State/ProvinceEnter your e-mail address and click sendSelect either Home User or CompanyClick the big Scan Now buttonIf it wants to install an ActiveX component allow itIt will start downloading the files it requires for the scan (Note: It may take a couple of minutes)When download is complete, click on My Computer to start the scanWhen the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report and a fresh HijackThis log and the SuperAntiSpyware log Link to post Share on other sites
Maisel59 Posted September 11, 2007 Author Report Share Posted September 11, 2007 Hello again,Thank you very much for your response Jwbirdsong! Glad to hear about the decompression bombs not being malicious. The approximate locations of the decompression bombs (now there are 3) from my last Avast! scan: C:\DocumentsAndSettings\...\konalibBaseRM[1], D:\SystemVolumeInformation\..\nsis1.bin, D:\1386\Apps25990\src\install\...\nsis1.bins.I was able to follow your directions until I got to Panda's Active Scan. My computer told me that the download contained samples of Win32:CTX and refused to finish the download process. I retried that numerous times but no luck So I have included in this reply theSuperAntiSpyware log and a fresh HijackThis log, as per your request. ****************************************SUPERAntiSpyware Scan Loghttp://www.superantispyware.comGenerated 09/11/2007 at 00:48 AMApplication Version : 3.9.1008Core Rules Database Version : 3303Trace Rules Database Version: 1309Scan type : Quick ScanTotal Scan Time : 02:25:46Memory items scanned : 496Memory threats detected : 0Registry items scanned : 680Registry threats detected : 4File items scanned : 42167File threats detected : 241Adware.Tracking Cookie C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@statcounter[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@redorbit[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@soundtrack[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@serving-sys[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@direct[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adbrite[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@fastclick[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@valueclick[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@xiti[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@23818417[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@r[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@event[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@nextag[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@trafficmp[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@2o7[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adserver[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adrevolver[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adrevolver[3].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediachannel[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@apmebf[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adinterax[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@atwola[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@porntube[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@revsci[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tribalfusion[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@jamster[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@39162387[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@youporn[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@burstnet[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@questionmarket[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@kmpads[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@casalemedia[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@enhance[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@atdmt[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@sextracker[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@pornotube[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@optimost[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@realmedia[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@bluestreak[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tacoda[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@overture[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@bannerads[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@56597277[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@20070607021435[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tradedoubler[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@zedo[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@doubleclick[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediaplex[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@specificclick[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@ad[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@hitbox[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@fortunecity[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@247realmedia[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@LPBofA1[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@advertising[3].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@s[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adultadworld[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adultdating-reviews[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@handbag[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@exitexchange[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@caloriecounterr[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@porninspector[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adtech[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediaonenetwork[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[4].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cgi-bin[3].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@drivecleaner[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@smileycentral[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adultfriendfinder[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@handbag[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@pornfidelity[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@direct;wi.728;hi[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@goclick[2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@azjmp[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@gostats[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@mediabistro[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@cpvfeed[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@adlegend[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@nextstat[2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@20070707033418[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@revenue[1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@nandomedia[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@tripod[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@a[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@findwhat[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@keywordmax[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\compaq_owner@1068010739[1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][1].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Documents and Settings\Compaq_Owner\cookies\[email protected][2].txt C:\Deckard\System Scanner\20070909213704\backup\WINDOWS\temp\Cookies\compaq_owner@advertising[2].txt C:\Deckard\System Scanner\20070909213704\backup\WINDOWS\temp\Cookies\compaq_owner@atdmt[1].txtAdware.MyWebSearch HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D} HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32 HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable***********************************Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:15:11 AM, on 9/11/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.6.0_02\bin\jusched.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Creative\Shared Files\CTDevSrv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeC:\Program Files\Messenger\msmsgs.exec:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\WINDOWS\system32\msiexec.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exec:\windows\system\hpsysdrv.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\notepad.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dllO2 - BHO: (no name) - {fd52bc30-fb90-4b8f-bcae-77b3906e9600} - C:\WINDOWS\system32\fonnth.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /runO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeO4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quietO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.htmlO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cabO16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cabO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO20 - Winlogon Notify: fonnth - fonnth.dll (file missing)O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO24 - Desktop Component 0: (no name) - http://thumbp2.mail.re2.yahoo.com/tn?sid=1...9&fid=Inbox--End of file - 11810 bytes Link to post Share on other sites
jwbirdsong Posted September 11, 2007 Report Share Posted September 11, 2007 Sorry I should have noticed that you were using Avast...The panda detection is a known False Positive..not sure why they won't fix it.I can assure you the Panda download is completely safe to do. But if you are uncomfortable with it please do the Kaspersky scan below.Please do an online scan with Kaspersky WebScannerClick on Kaspersky Online ScannerYou will be promted to install an ActiveX component from Kaspersky, Click Yes.The program will launch and then begin downloading the latest definition files:Once the files have been downloaded click on NEXTNow click on Scan SettingsIn the scan settings make that the following are selected:Scan using the following Anti-Virus database:Extended (if available otherwise Standard)Scan Options:Scan ArchivesScan Mail Bases[*]Click OK[*]Now under select a target to scan:Select My Computer[*]This will program will start and scan your system.[*]The scan will take a while so be patient and let it run.[*]Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:[*]Save the file to your desktop.[*]Copy and paste that information in your next post.When done post the Kaspersky log and a fresh HijackThis log. Link to post Share on other sites
Maisel59 Posted September 12, 2007 Author Report Share Posted September 12, 2007 Hi again,I couldn't run the Panda Active scan was because Avast would automatically stop the download process (I tried again today). So, thank you very much for the Kaspersky link. That worked out well Below, you'll find the Kaspersky log and a fresh HijackThis log.------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT September 12, 2007 12:49:41 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 12/09/2007 Kaspersky Anti-Virus database records: 412489-------------------------------------------------------------------------------Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: trueScan Target - My Computer: C:\ D:\ E:\ G:\ H:\ I:\ J:\ K:\Scan Statistics: Total number of scanned objects: 90219 Number of viruses found: 3 Number of infected objects: 4 Number of suspicious objects: 0 Duration of the scan process: 01:41:37Infected Object Name / Virus Name / Last ActionC:\Deckard\System Scanner\20070909213704\backup\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skippedC:\Documents and Settings\Compaq_Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skippedC:\Documents and Settings\Compaq_Owner\Cookies\index.dat Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\History\History.IE5\index.dat Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Temp\WCESCOMM.LOG Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF906E.tmp Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DFCB01.tmp Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DFD93.tmp Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~WRS0000.tmp Object is locked skippedC:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\Compaq_Owner\NTUSER.DAT Object is locked skippedC:\Documents and Settings\Compaq_Owner\ntuser.dat.LOG Object is locked skippedC:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skippedC:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skippedC:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skippedC:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skippedC:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skippedC:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skippedC:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\chandir.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\chandir.idx Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\chn.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\chn.idx Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\D0000000.FCS Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\inuse.txt Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\L0000015.FCS Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\main.log Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs.idx Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_die.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_die.idx Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_dnd.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_dnd.idx Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_ext.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_ext.idx Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_rcv.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_rcv.idx Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\storydb.dat Object is locked skippedC:\Program Files\Compaq Connections\5577497\Users\Default\Data\storydb.idx Object is locked skippedC:\Program Files\Internet Explorer\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skippedC:\Program Files\Microsoft Office\Templates\Normal.dot Object is locked skippedC:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch skippedC:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skippedC:\System Volume Information\_restore{A2578CBA-012A-4EE9-9E3D-27D3F494A2B6}\RP22\change.log Object is locked skippedC:\WINDOWS\$_hpcst$.hpc Object is locked skippedC:\WINDOWS\Debug\PASSWD.LOG Object is locked skippedC:\WINDOWS\SchedLgU.Txt Object is locked skippedC:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skippedC:\WINDOWS\Sti_Trace.log Object is locked skippedC:\WINDOWS\system32\CatRoot2\edb.log Object is locked skippedC:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skippedC:\WINDOWS\system32\config\Antivirus.Evt Object is locked skippedC:\WINDOWS\system32\config\AppEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\default Object is locked skippedC:\WINDOWS\system32\config\default.LOG Object is locked skippedC:\WINDOWS\system32\config\SAM Object is locked skippedC:\WINDOWS\system32\config\SAM.LOG Object is locked skippedC:\WINDOWS\system32\config\SecEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\SECURITY Object is locked skippedC:\WINDOWS\system32\config\SECURITY.LOG Object is locked skippedC:\WINDOWS\system32\config\software Object is locked skippedC:\WINDOWS\system32\config\software.LOG Object is locked skippedC:\WINDOWS\system32\config\SysEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\system Object is locked skippedC:\WINDOWS\system32\config\system.LOG Object is locked skippedC:\WINDOWS\system32\f3PSSavr.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skippedC:\WINDOWS\system32\h323log.txt Object is locked skippedC:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skippedC:\WINDOWS\Temp\Perflib_Perfdata_4bc.dat Object is locked skippedC:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skippedC:\WINDOWS\wiadebug.log Object is locked skippedC:\WINDOWS\wiaservc.log Object is locked skippedC:\WINDOWS\WindowsUpdate.log Object is locked skippedK:\MISC Writings\~WRL0002.tmp Object is locked skippedK:\MISC Writings\Always liked your name.doc Object is locked skippedScan process completed.************************Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:52:52 AM, on 9/12/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Creative\Shared Files\CTDevSrv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\QuickTime\qttask.exec:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Java\jre1.6.0_02\bin\jusched.exeC:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeC:\Program Files\Microsoft Office\Office\WINWORD.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exec:\windows\system\hpsysdrv.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dllO2 - BHO: (no name) - {fd52bc30-fb90-4b8f-bcae-77b3906e9600} - C:\WINDOWS\system32\fonnth.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /runO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeO4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.htmlO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cabO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cabO16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cabO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO20 - Winlogon Notify: fonnth - fonnth.dll (file missing)O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO24 - Desktop Component 0: (no name) - http://thumbp2.mail.re2.yahoo.com/tn?sid=1...9&fid=Inbox--End of file - 11863 bytes Link to post Share on other sites
jwbirdsong Posted September 13, 2007 Report Share Posted September 13, 2007 Well the logs look pretty go. As you see in the Kaspersky log only thing coming up in MyWebSearch stuff. It's considered an optional fix but it looks like you no longer use it.I suggest going to ControlPanel>Add/Remove and uninstalling anything with MyWay. Then delete the entire C:\Program Files\MyWebSearch folder. may need to reboot 1st.You need to print this out or save a copy to Notepad for reading because you can NOT have IE/FF or any browser open while doing the fix.Open HijackThis and click on Do a system scan only. Place a check mark next to the following:NOTE the RED entries need to be removed.....the BLUE are all optional and NOT needed at startup. Unchecking them will help system performance. You can manually start any one of them as needed. O2 - BHO: (no name) - {fd52bc30-fb90-4b8f-bcae-77b3906e9600} - C:\WINDOWS\system32\fonnth.dll (fileO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present <-------- You can leave this IF you set it and know what it does.O20 - Winlogon Notify: fonnth - fonnth.dll (file missing) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"O4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeO4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeO4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE <<----- REALLY should uncheck this one. BIG resorce hogO4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE<<----- REALLY should uncheck this one. BIG resource hogClose ALL other open windows and programs and click Fix checkedReboot and post a final(?) HijackThis log. Also tell how the computer is behaving. Link to post Share on other sites
Maisel59 Posted September 19, 2007 Author Report Share Posted September 19, 2007 I'm sorry it took me so long to do a follow up here.The computer is about as fast as it used to be since I followed your instructions in the last post. Also, I can see some images that were only coming up as small red squares before (like the banner in your signature, for instance).Here is the final(?) HijackThis Log you requested....Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:35:31 PM, on 9/18/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\QuickTime\qttask.exeC:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Creative\Shared Files\CTDevSrv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeC:\Program Files\Messenger\msmsgs.exec:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeC:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\Hewlett-Packard\Smart Web Printing\SmartWebPrinting.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dllO4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /runO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Picasa Media Detector] C:\Documents and Settings\Compaq_Owner\Desktop\Picasa2\PicasaMediaDetector.exeO4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.htmlO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cabO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cabO16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cabO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO24 - Desktop Component 0: (no name) - http://thumbp2.mail.re2.yahoo.com/tn?sid=1...9&fid=Inbox--End of file - 11076 bytes Link to post Share on other sites
Maisel59 Posted October 4, 2007 Author Report Share Posted October 4, 2007 Is my scan okay? Link to post Share on other sites
Andro1d Posted October 9, 2007 Report Share Posted October 9, 2007 Hi,Sorry for the delay!Step 1Please re-open HijackThis and scan. Check the boxes next to all the entries listed below. O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cabNow close all windows other than Hijackthis, then click Fix Checked. Close HijackThis. Step 2Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to infect your system. Please follow these steps to remove older version Java components and update:Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.Scroll down to where it says "Java Runtime Environment (JRE)6 Update 3...allows end-users to run Java applications".Click the "Download" button to the right.Read the License Agreement and then check the box that says: "Accept License Agreement". The page will refresh.Click on the link to download Windows Offline Installation and save the file to your desktop.Close any programs you may have running - especially your web browser.Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.Click the Remove or Change/Remove button.Repeat as many times as necessary to remove each Java versions.Reboot your computer once all Java components are removed.Then from your desktop double-click on jre-6u3-windows-i586-p.exe to install the newest version.Step 3Lets run an F-Secure online scan for Viruses, Spyware and RootKits:Go to http://support.f-secure.com/enu/home/ols.shtmlScroll to the bottom of the page and click the Start scanning button. A window will pop up.Allow the Active X control to be installed on your computer, then click the Accept buttonClick Full System Scan and allow the components to download and the scan to complete.If malware is found, check Submit samples to F-Secure then select Automatic cleaningWhen cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this postIf Automatic cleaning with Submit samples hangs, click Cancel, then New ScanWhen the cleaning option is presented, Uncheck Submit samples to F-SecureClick Automatic cleaningWhen cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this postNotes: This scan will only work with Internet ExplorerYou must have administrator rights to run this scanThis scan can take several hours, so please be patient Link to post Share on other sites
Recommended Posts