crzymomo5 Posted January 7, 2008 Report Share Posted January 7, 2008 I have windows vista home premium. I figured I had better start with that. I am getting pop ups and also my computer is running really slow. I would really appreciate any help that you could give me. Thanks, ChristiLogfile of Trend Micro HijackThis v2.0.0 (BETA)Scan saved at 8:15:53 PM, on 1/6/2008Platform: Windows Vista (WinNT 6.00.1904)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\system32\taskeng.exeC:\Windows\Explorer.EXEC:\Windows\System32\rundll32.exeC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Windows\ehome\ehtray.exeC:\Windows\System32\rundll32.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\HP Connections\6811507\Program\HP Connections.exeC:\Windows\System\w98eject.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\HJT\hijackthis\HiJackThis_v2.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smnlikdat.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dllO1 - Hosts: ::1 localhostO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: {0b7bd7ba-9f2a-7f7a-dc74-9c382a210f23} - {32f012a2-83c9-47cd-a7f7-a2f9ab7db7b0} - (no file)O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dllO2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: (no name) - {7A5565EF-A594-46E4-AF56-FE71AEAFD7D5} - C:\Windows\system32\tuvvv.dll (file missing)O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: (no name) - {8BE8B8FC-BD38-46F3-8BB2-222F5DE84C49} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dllO2 - BHO: (no name) - {E454D3E1-0B5E-493C-BCA2-93E9F8294A00} - (no file)O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [KBD] D:\hp\Drv\APP14059\src\kbd.exeO4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStartO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuvvv.dll,#1O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exeO4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exeO4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunO4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exeO4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quietO4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exeO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: w98Eject.lnk = ?O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnkO9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnkO9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - (no file)O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cabO16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cabO16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/instal...osticsVista.cabO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dllO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXEO23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exeO23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exeO23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 10355 bytes Link to post Share on other sites
jwbirdsong Posted January 7, 2008 Report Share Posted January 7, 2008 Deckard's System ScannerDownload Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.Close all applications and windows.Double-click on dss.exe to run it, and follow the prompts.When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimizedCopy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt here.Please attach extra.txt to your post.To attach a file to a new post, simplyGo to the Atachments section on the post composition page.(just below the text entry window), andcopy and paste the following into the "Select a file" box: C:\Deckard\System Scanner\extra.txt Click Upload. What DSS will do: create a new System Restore point in Windows XP and Vista. clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives. check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed. Link to post Share on other sites
crzymomo5 Posted January 7, 2008 Author Report Share Posted January 7, 2008 Ok here are the scans you requested. Thanks for helping me.Deckard's System Scanner v20071014.68Run by Christi on 2008-01-07 08:09:52Computer is in Normal Mode.---------------------------------------------------------------------------------- Last 1 Restore Point(s) --1: 2008-01-07 06:37:05 UTC - RP362 - Scheduled CheckpointBacked up registry hives.Performed disk cleanup.Total Physical Memory: 894 MiB (1024 MiB recommended).-- HijackThis (run as Christi.exe) ---------------------------------------------Unable to find log (file not found); running clone.-- HijackThis Clone ------------------------------------------------------------Emulating logfile of Trend Micro HijackThis v2.0.2Scan saved at 2008-01-07 08:15:42Platform: Windows Vista (6.00.6000)MSIE: Internet Explorer (7.00.6000.16386)Boot mode: NormalRunning processes:C:\Windows\System32\dwm.exeC:\Windows\System32\taskeng.exeC:\Windows\explorer.exeC:\Windows\System32\rundll32.exeC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Windows\ehome\ehtray.exeC:\Windows\System32\rundll32.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\HP Connections\6811507\Program\HP Connections.exeC:\Windows\system\w98eject.exeC:\Users\Christi\Desktop\dss.exeC:\Program Files\Trend Micro\HijackThis\Christi.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smnlikdat.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ieR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dllO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: {0b7bd7ba-9f2a-7f7a-dc74-9c382a210f23} - {32f012a2-83c9-47cd-a7f7-a2f9ab7db7b0} - (no file)O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dllO2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: (no name) - {7A5565EF-A594-46E4-AF56-FE71AEAFD7D5} - C:\Windows\system32\tuvvv.dll (file missing)O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: (no name) - {8BE8B8FC-BD38-46F3-8BB2-222F5DE84C49} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dllO2 - BHO: (no name) - {E454D3E1-0B5E-493C-BCA2-93E9F8294A00} - (no file)O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar2.dllO3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [KBD] D:\hp\Drv\APP14059\src\kbd.exeO4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStartO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuvvv.dll,#1O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exeO4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exeO4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunO4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exeO4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exeO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: w98Eject.lnk = C:\Windows\System\w98eject.exeO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnkO9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnkO9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - (file missing)O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cabO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cabO16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock...director/sw.cabO16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cabO16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/instal...osticsVista.cabO16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flash...t/ultrashim.cabO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dllO18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dllO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dllO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXEO23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\System32\PSIService.exeO23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\System32\drivers\XAudio.exe--End of file - 11514 bytes-- File Associations -----------------------------------------------------------All associations okay.-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------S2 W55U01 (WINBOND W55U01 USB) - c:\windows\system32\drivers\w55u01.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver>-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>-- Device Manager: Disabled ----------------------------------------------------No disabled devices found.-- Scheduled Tasks -------------------------------------------------------------2008-01-07 01:45:05 422 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{4D12D675-671D-4859-9EC3-AC9D7E1E2070}.job2008-01-06 20:10:49 442 --a------ C:\Windows\Tasks\RegCure Program Check.job2008-01-06 15:15:21 376 --a------ C:\Windows\Tasks\RegCure.job2007-12-31 20:01:23 550 --a------ C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - Christi.job2007-12-31 12:19:10 324 --a------ C:\Windows\Tasks\Norton SystemWorks One Button Checkup.job2007-12-15 23:05:11 330 --a------ C:\Windows\Tasks\HPCeeScheduleForChristi.job-- Files created between 2007-12-07 and 2008-01-07 -----------------------------2008-01-07 08:12:33 0 d-------- C:\Program Files\Trend Micro2008-01-06 20:04:52 0 d-------- C:\HJT2008-01-06 15:53:25 0 d-------- C:\Program Files\fix vundo2008-01-06 13:12:13 0 d-------- C:\Program Files\RegCure2008-01-06 03:20:12 0 --a------ C:\ntuser.dat2008-01-04 15:15:09 6744 --ahs---- C:\Windows\system32\vwycf.ini22008-01-04 13:31:43 28041 --ahs---- C:\Windows\system32\lkjlm.ini22008-01-04 13:02:23 0 d-------- C:\Users\All Users\Spybot - Search & Destroy2008-01-04 12:15:38 319 --ahs---- C:\Windows\system32\jlkkj.ini22008-01-04 02:40:52 6583 --ahs---- C:\Windows\system32\ppsut.ini22008-01-04 02:07:05 0 d-------- C:\VundoFix Backups2008-01-03 11:26:16 75449 --ahs---- C:\Windows\system32\knoqr.ini22008-01-02 22:38:26 0 d-------- C:\Users\Christi\Victoria42007-12-31 11:28:17 0 d-------- C:\Users\Christi\Preset shapes2007-12-28 13:38:19 0 d-------- C:\Users\Christi\Christi2007-12-26 11:30:14 71774 --ahs---- C:\Windows\system32\gjmoq.ini22007-12-26 11:25:44 0 d-------- C:\Users\Christi\Bean's stuff2007-12-20 14:56:02 0 d-------- C:\Users\Christi\Aiko2007-12-18 15:54:02 0 d-------- C:\Users\Christi\christmas hair]2007-12-14 16:54:33 14560 --a------ C:\Windows\system32\drivers\Stums.sys <Not Verified; Microsoft Corporation; >2007-12-14 16:54:33 61440 --a------ C:\Windows\system\w98eject.exe <Not Verified; Sigmatel; Sigmatel w98Eject>2007-12-14 16:54:25 0 d-------- C:\Windows\system\IOSUBSYS2007-12-14 16:54:25 0 d-------- C:\Program Files\Thomson2007-12-13 20:54:02 0 d-------- C:\temp2007-12-13 20:15:39 48128 --a------ C:\Windows\system32\hpz3l4pi.dll <Not Verified; Hewlett-Packard Company; Language Monitor>2007-12-13 11:21:43 0 d-------- C:\Users\Christi\Alanis hair2007-12-11 21:23:20 0 d-------- C:\Program Files\Norton SystemWorks Basic Edition-- Find3M Report ---------------------------------------------------------------2008-01-05 18:02:36 0 d-------- C:\Users\Christi\AppData\Roaming\Lavasoft2008-01-05 18:02:27 0 d-------- C:\Program Files\Lavasoft2008-01-03 20:01:13 5852 --ahs---- C:\Windows\system32\KGyGaAvL.sys2008-01-03 11:09:48 0 d-------- C:\Users\Christi\AppData\Roaming\LimeWire2007-12-26 22:13:02 0 d-------- C:\Users\Christi\AppData\Roaming\Adobe2007-12-26 11:30:47 0 d-------- C:\Program Files\QuickTime2007-12-24 12:18:25 0 d-------- C:\Users\Christi\AppData\Roaming\Symantec2007-12-21 10:29:18 0 d-------- C:\Program Files\Norton Internet Security2007-12-14 16:54:22 0 d--h----- C:\Program Files\InstallShield Installation Information2007-12-13 08:38:27 0 d-------- C:\Program Files\Common Files\Symantec Shared2007-12-13 00:34:03 0 d-------- C:\Program Files\Symantec2007-12-12 01:57:09 0 d-------- C:\Program Files\LimeWire2007-12-12 01:56:09 0 d-------- C:\Program Files\Java2007-12-11 22:16:00 0 d-------- C:\Program Files\Common Files2007-12-04 17:48:51 88 -r-hs---- C:\Windows\system32\FAD74EE12A.sys2007-12-04 17:45:18 0 d-------- C:\Users\Christi\AppData\Roaming\Corel2007-12-04 17:39:56 0 d-------- C:\Program Files\Common Files\Corel2007-12-04 17:38:14 0 d-------- C:\Program Files\Corel2007-12-04 16:25:49 0 d-------- C:\Users\Christi\AppData\Roaming\InstallShield2007-12-04 13:20:23 0 d-------- C:\Program Files\Google2007-12-04 01:09:02 0 d-------- C:\Program Files\DivX2007-12-03 20:33:18 802816 --a------ C:\Windows\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>2007-12-03 20:33:18 823296 --a------ C:\Windows\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>2007-12-03 20:33:18 823296 --a------ C:\Windows\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>2007-12-03 20:33:16 682496 --a------ C:\Windows\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>2007-12-01 10:17:28 0 d-------- C:\Program Files\Common Files\Cadsoft2007-12-01 10:17:19 0 d-------- C:\Program Files\Cadsoft2007-11-29 17:30:28 3596288 --a------ C:\Windows\system32\qt-dx331.dll2007-11-29 17:28:24 81920 --a------ C:\Windows\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>2007-11-28 16:52:32 12288 --a------ C:\Windows\system32\DivXWMPExtType.dll2007-11-14 03:01:40 0 d-------- C:\Program Files\Windows Mail2007-10-22 14:08:54 180224 --a------ C:\Windows\system32\dzwrapper.dll2007-10-22 14:08:54 32256 --a------ C:\Windows\system32\dzbryce6.dll2007-10-22 14:08:48 65536 --a------ C:\Windows\system32\dzcarrara.dll2007-10-22 14:04:58 8630272 --a------ C:\Windows\system32\dzcore.dll2007-10-22 13:48:22 6131712 --a------ C:\Windows\system32\daz-qt-mt.dll2007-10-22 13:48:22 1785856 --a------ C:\Windows\system32\daz-qsa.dll2007-10-22 13:38:00 2076672 --a------ C:\Windows\system32\dz3delight.dll2007-10-11 15:20:23 29420 --a------ C:\Users\Christi\AppData\Roaming\UserTile.png-- Registry Dump ---------------------------------------------------------------*Note* empty entries & legit default entries are not shown[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32f012a2-83c9-47cd-a7f7-a2f9ab7db7b0}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]08/24/2007 10:51 PM 316784 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]12/11/2007 10:16 PM 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7A5565EF-A594-46E4-AF56-FE71AEAFD7D5}] C:\Windows\system32\tuvvv.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8BE8B8FC-BD38-46F3-8BB2-222F5DE84C49}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E454D3E1-0B5E-493C-BCA2-93E9F8294A00}][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [08/24/2007 10:51 PM 316784][-HKEY_CLASSES_ROOT\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}][HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1][HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [04/11/2007 04:54 AM]"@"="" []"KBD"="D:\hp\Drv\APP14059\src\kbd.exe" [02/02/2005 10:44 AM]"NvSvc"="C:\Windows\system32\nvsvc.dll" [07/06/2007 07:15 PM]"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [07/06/2007 07:15 PM]"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [07/06/2007 07:15 PM]"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [08/25/2007 12:07 AM]"MSServer"="C:\Windows\system32\tuvvv.dll" []"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [11/02/2006 07:35 AM]"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [11/02/2006 07:35 AM]"@"="" []"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" []"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM]"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [11/02/2006 07:36 AM][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]"Launcher"=%WINDIR%\SMINST\launcher.exeC:\Users\Christi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 6:16:50 PM]C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Connections.lnk - C:\Program Files\HP Connections\6811507\Program\HP Connections.exe [12/6/2006 5:49:29 AM]Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 2:05:56 PM]w98Eject.lnk - C:\Windows\System\w98eject.exe [12/14/2007 4:54:33 PM][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"=2 (0x2)"EnableLUA"=0 (0x0)[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]"{7A5565EF-A594-46E4-AF56-FE71AEAFD7D5}"= C:\Windows\system32\tuvvv.dll [ ][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]@="Service"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]@="Driver"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]@="Driver"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]@="Volume shadow copy"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]@="IEEE 1394 Bus host controllers"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]@="SBP2 IEEE 1394 Devices"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]@="SecurityDevices"[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]backup=C:\Windows\pss\Google Updater.lnk.CommonStartupbackupExtension=.CommonStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]backup=C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartupbackupExtension=.CommonStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando]"C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]C:\Program Files\Macrogaming\SweetIM\SweetIM.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnumHPZ12 Pml Driver HPZ12 Net Driver HPZ12hpdevmgmt hpqcxs08 hpqddsvc*Newly Created Service* - COMHOST[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]C:\Windows\system32\unregmp2.exe /ShowWMP[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI-- Hosts -----------------------------------------------------------------------127.0.0.1 007guard.com127.0.0.1 www.007guard.com127.0.0.1 008i.com127.0.0.1 008k.com127.0.0.1 www.008k.com127.0.0.1 00hq.com127.0.0.1 www.00hq.com127.0.0.1 010402.com127.0.0.1 032439.com127.0.0.1 www.032439.com7822 more entries in hosts file.-- End of Deckard's System Scanner: finished at 2008-01-07 08:17:35 ------------extra.txt Link to post Share on other sites
jwbirdsong Posted January 7, 2008 Report Share Posted January 7, 2008 (edited) Open HijackThis and place a check next to the following:O2 - BHO: {0b7bd7ba-9f2a-7f7a-dc74-9c382a210f23} - {32f012a2-83c9-47cd-a7f7-a2f9ab7db7b0} - (no file)O2 - BHO: (no name) - {7A5565EF-A594-46E4-AF56-FE71AEAFD7D5} - C:\Windows\system32\tuvvv.dll (file missing)O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: (no name) - {8BE8B8FC-BD38-46F3-8BB2-222F5DE84C49} - (no file)O2 - BHO: (no name) - {E454D3E1-0B5E-493C-BCA2-93E9F8294A00} - (no file)O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuvvv.dll,#1Close ALL other windows and then cliick Fix Checked.Please download the OTMoveIt by OldTimer. Save it to your desktop. Please double-click OTMoveIt.exe to run it.Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):Put the bad files here Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.Click the red Moveit! button.Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.Close OTMoveIt*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.Click "Exit" to close OTMoveIt.Please download the OTMoveIt by OldTimer. Save it to your desktop. Please Right ClickOTMoveIt.exe and select Run as Administrator to run it.Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):C:\Windows\system32\vwycf.ini2C:\Windows\system32\lkjlm.ini2C:\Windows\system32\jlkkj.ini2C:\Windows\system32\ppsut.ini2C:\Windows\system32\knoqr.ini2C:\Windows\system32\gjmoq.ini2 Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.Click the red Moveit! button.Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.Close OTMoveIt*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.Click "Exit" to close OTMoveIt.After reboot start IE w/ Admin privileges. Right Click on Internet Explorer icon in the Start Menu and select Run as administrator then go HERE to run an online scan. Tick the box next to I Accept term then Start. Follow the promptsOnce it's done post C:\Program Files\EsetOnlineScanner\log.txt and a new HijackThis log also post C:\_OTMoveIt\MovedFiles\********_******.log(where "********_******" is the "date_time" you ran OTMoveit) Edited January 7, 2008 by jwbirdsong Link to post Share on other sites
crzymomo5 Posted January 7, 2008 Author Report Share Posted January 7, 2008 Ok that scan took some time. lol. Here are the files you requested.# version=4# OnlineScanner.ocx=1.0.0.56# OnlineScannerDLLA.dll=1, 0, 0, 51# OnlineScannerDLLW.dll=1, 0, 0, 51# OnlineScannerUninstaller.exe=1, 0, 0, 49# vers_standard_module=2770 (20080107)# vers_arch_module=1.060 (20071228)# vers_adv_heur_module=1.064 (20070717)# EOSSerial=f359617002f98949885bdf8f98b392cf# end=finished# remove_checked=true# unwanted_checked=false# utc_time=2008-01-07 06:49:37# local_time=2008-01-07 01:49:37 (-0500, Eastern Standard Time)# country="United States"# osver=6.0.6000 NT # scanned=743249# found=26# scan_time=12145C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00008c57 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00008ea7 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000980a Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00009848 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00009a3b Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00009fe6 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000a3ad Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000a61d Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000a65c Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000c199 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000c2b2 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000dc69 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000e197 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0000fc48 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00010cbc Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00017b18 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00018b0f Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0001a4b7 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0001a8fb Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0001c245 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0001cf20 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00029a1c Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00070138 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp0008642e Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\Deckard\System Scanner\backup\Users\Christi\AppData\Local\Temp\tmp00086c78 Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000C:\VundoFix Backups\tuvvv.dll.bad Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000Logfile of Trend Micro HijackThis v2.0.2Scan saved at 1:59:33 PM, on 1/7/2008Platform: Windows Vista (WinNT 6.00.1904)MSIE: Internet Explorer v7.00 (7.00.6000.16575)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\system32\taskeng.exeC:\Windows\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Windows\ehome\ehtray.exeC:\Windows\System32\rundll32.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\HP Connections\6811507\Program\HP Connections.exeC:\Windows\System\w98eject.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Pando Networks\Pando\pando.exeC:\Windows\system32\NOTEPAD.EXEC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smnlikdat.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dllO1 - Hosts: ::1 localhostO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dllO2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [KBD] D:\hp\Drv\APP14059\src\kbd.exeO4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStartO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exeO4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exeO4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunO4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exeO4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exeO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: w98Eject.lnk = ?O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnkO9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnkO9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - (no file)O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cabO16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cabO16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cabO16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/instal...osticsVista.cabO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXEO23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exeO23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exeO23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 10134 bytesAnd then the OtmoveitC:\Windows\system32\vwycf.ini2 moved successfully.C:\Windows\system32\lkjlm.ini2 moved successfully.C:\Windows\system32\jlkkj.ini2 moved successfully.C:\Windows\system32\ppsut.ini2 moved successfully.C:\Windows\system32\knoqr.ini2 moved successfully.C:\Windows\system32\gjmoq.ini2 moved successfully.Created on 01/07/2008 10:23:09 Link to post Share on other sites
crzymomo5 Posted January 8, 2008 Author Report Share Posted January 8, 2008 Does this look ok? Please let me know! Link to post Share on other sites
jwbirdsong Posted January 8, 2008 Report Share Posted January 8, 2008 Looks real good actually.Spend a day or two using the computer and post back with a final(?) HijackThis log and any comments about how the computer is running. Link to post Share on other sites
Recommended Posts