Comments on: Is Your System Infected with a Virus / Spyware / Adware / Trojan? – Part II http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/ Technology News, Internet, Tips-n-Tricks, Tutorials, Software Reviews, Themes, Skins, Wallpapers Sun, 08 Nov 2009 04:48:30 +0500 http://wordpress.org/?v=2.8.5 hourly 1 By: VG http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19710 VG Wed, 18 Feb 2009 14:01:13 +0000 http://www.askvg.com/?p=1096#comment-19710 ^^ Fix following: <blockquote> F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe, O2 - BHO: worldadmarketplace browser enhancer - {4FBBDF56-8AB7-2ED3-FFE2-97B4B83FAB9B} - C:\WINDOWS\system32\vdstfcgyupiv.dll O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\llguvcfo.dll O2 - BHO: (no name) - {9f719a05-a752-4d29-8817-8ca9c970071a} - C:\WINDOWS\system32\mihamake.dll O2 - BHO: worldadmarketplace - {c965dd6c-702b-c604-fcd9-af5dc15d53ab} - C:\WINDOWS\system32\nsoB.dll O2 - BHO: HelloWorldBHO - {D88E1558-7C2D-407A-953A-C044F5607CEA} - C:\Program Files\Mjcore\Mjcore.dll O4 - HKLM\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s O4 - HKLM\..\Run: [txctjwgzrmci] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\vdstfcgyupiv.dll" O4 - HKLM\..\Run: [5cfa2258] rundll32.exe "C:\WINDOWS\system32\fisalunu.dll",b O4 - HKLM\..\Run: [CPM5fc911c4] Rundll32.exe "c:\windows\system32\dojisino.dll",a O4 - HKCU\..\Run: [cogad] "C:\Documents and Settings\Ahz\Application Data\cogad\cogad.exe" 61A847B5BBF72813338B2B27128065E9C084320161C4661227A755E9C2933154389A O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Ahz\Application Data\Twain\Twain.exe O4 - HKCU\..\Run: [GetPack30] "C:\Program Files\GetPack\GetPack30.exe" O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe O4 - HKCU\..\Run: [PoliceAV] C:\Program Files\XPPoliceAntivirus\xppolice.exe O4 - HKCU\..\Policies\Explorer\Run: [svcho] C:\WINDOWS\svcho.exe O4 - HKUS\S-1-5-19\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'NETWORK SERVICE') O20 - AppInit_DLLs: zudwwn.dll dhfblh.dll rsbahc.dll C:\WINDOWS\system32\bufufodu.dll kebyqb.dll ikxgqj.dll anokrj.dll hiogfv.dll mffjqj.dll bjvllo.dll uhsxwg.dll mowgml.dll c:\windows\system32\dojisino.dll </blockquote> @Saoirse Did you try to fix the entry in Safe Mode? @Eric Fix following: <blockquote> O4 - HKLM\..\Run: [Windows Updates] update.exe O4 - HKLM\..\RunServices: [Windows Updates] update.exe </blockquote> @The Champ Following entry looks suspicious to me. Fix following if you don't know the app: <blockquote> O4 - HKCU\..\Run: [ThetaWall] D:\Downloads\Pictures\Bollywood\ThetaWall.exe </blockquote> ^^ Fix following:

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,
O2 - BHO: worldadmarketplace browser enhancer - {4FBBDF56-8AB7-2ED3-FFE2-97B4B83FAB9B} - C:\WINDOWS\system32\vdstfcgyupiv.dll
O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\llguvcfo.dll
O2 - BHO: (no name) - {9f719a05-a752-4d29-8817-8ca9c970071a} - C:\WINDOWS\system32\mihamake.dll
O2 - BHO: worldadmarketplace - {c965dd6c-702b-c604-fcd9-af5dc15d53ab} - C:\WINDOWS\system32\nsoB.dll
O2 - BHO: HelloWorldBHO - {D88E1558-7C2D-407A-953A-C044F5607CEA} - C:\Program Files\Mjcore\Mjcore.dll
O4 - HKLM\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s
O4 - HKLM\..\Run: [txctjwgzrmci] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\vdstfcgyupiv.dll"
O4 - HKLM\..\Run: [5cfa2258] rundll32.exe "C:\WINDOWS\system32\fisalunu.dll",b
O4 - HKLM\..\Run: [CPM5fc911c4] Rundll32.exe "c:\windows\system32\dojisino.dll",a
O4 - HKCU\..\Run: [cogad] "C:\Documents and Settings\Ahz\Application Data\cogad\cogad.exe" 61A847B5BBF72813338B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Ahz\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [GetPack30] "C:\Program Files\GetPack\GetPack30.exe"
O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe
O4 - HKCU\..\Run: [PoliceAV] C:\Program Files\XPPoliceAntivirus\xppolice.exe
O4 - HKCU\..\Policies\Explorer\Run: [svcho] C:\WINDOWS\svcho.exe
O4 - HKUS\S-1-5-19\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'NETWORK SERVICE')
O20 - AppInit_DLLs: zudwwn.dll dhfblh.dll rsbahc.dll C:\WINDOWS\system32\bufufodu.dll kebyqb.dll ikxgqj.dll anokrj.dll hiogfv.dll mffjqj.dll bjvllo.dll uhsxwg.dll mowgml.dll c:\windows\system32\dojisino.dll

@Saoirse
Did you try to fix the entry in Safe Mode?

@Eric
Fix following:

O4 - HKLM\..\Run: [Windows Updates] update.exe
O4 - HKLM\..\RunServices: [Windows Updates] update.exe

@The Champ
Following entry looks suspicious to me. Fix following if you don't know the app:

O4 - HKCU\..\Run: [ThetaWall] D:\Downloads\Pictures\Bollywood\ThetaWall.exe

]]> By: DEN http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19667 DEN Tue, 17 Feb 2009 22:46:43 +0000 http://www.askvg.com/?p=1096#comment-19667 Been having serious problems with my computer. Task Manager is disabled by admin, etc. Had XP Police and managed to delete it manually, but I'm unable to do the same for Spyware Protect 2009 and whatever else I have. Been having serious problems with my computer. Task Manager is disabled by admin, etc. Had XP Police and managed to delete it manually, but I'm unable to do the same for Spyware Protect 2009 and whatever else I have.

]]> By: DEN http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19666 DEN Tue, 17 Feb 2009 22:45:14 +0000 http://www.askvg.com/?p=1096#comment-19666 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:43:49 PM, on 2/17/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\sm56hlpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\ZSSnp211.exe C:\WINDOWS\Domino.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\program files\steam\steam.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Documents and Settings\Ahz\Application Data\Twain\Twain.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\Wtablet\TabUserW.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe C:\Program Files\Furcadia\Furcadia.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\regsvr32.exe C:\Program Files\Furcadia\winopen.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe C:\Documents and Settings\Ahz\Desktop\sdsetup.exe C:\Documents and Settings\Ahz\Desktop\sdsetup.exe C:\Documents and Settings\Ahz\Desktop\sdsetup.exe C:\Documents and Settings\Ahz\Desktop\sdsetup.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe C:\WINDOWS\svcho.exe C:\Documents and Settings\Ahz\Desktop\sdsetup.exe C:\Documents and Settings\Ahz\Desktop\sdsetup.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe C:\Documents and Settings\Ahz\Desktop\mbam-setup(2).exe C:\DOCUME~1\Ahz\LOCALS~1\Temp\is-A1VUU.tmp\mbam-setup(2).tmp C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Documents and Settings\Ahz\Desktop\HJTInstall.exe C:\Documents and Settings\Ahz\Desktop\HJTInstall.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe, O1 - Hosts: 195.245.119.131 browser-security.microsoft.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: WinGDI Class - {12c7290a-157b-4f43-b109-97e792c598ed} - C:\WINDOWS\iehost.dll O2 - BHO: CPV - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\WebShow\WebShow.dll O2 - BHO: WTBho Class - {348FE907-249E-4C65-A838-F34A193FE1D1} - C:\Program Files\WinTask\Bin\TaskBHO.dll O2 - BHO: worldadmarketplace browser enhancer - {4FBBDF56-8AB7-2ED3-FFE2-97B4B83FAB9B} - C:\WINDOWS\system32\vdstfcgyupiv.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\llguvcfo.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {9f719a05-a752-4d29-8817-8ca9c970071a} - C:\WINDOWS\system32\mihamake.dll O2 - BHO: worldadmarketplace - {c965dd6c-702b-c604-fcd9-af5dc15d53ab} - C:\WINDOWS\system32\nsoB.dll O2 - BHO: BHO - {C9C42510-9B21-41c1-9DCD-8382A2D07C61} - C:\WINDOWS\system32\iehelper.dll O2 - BHO: HelloWorldBHO - {D88E1558-7C2D-407A-953A-C044F5607CEA} - C:\Program Files\Mjcore\Mjcore.dll O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [WTIndicator] \Bin\SchedInd.exe O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\winvnc.exe" -servicehelper O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe O4 - HKLM\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s O4 - HKLM\..\Run: [txctjwgzrmci] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\vdstfcgyupiv.dll" O4 - HKLM\..\Run: [5cfa2258] rundll32.exe "C:\WINDOWS\system32\fisalunu.dll",b O4 - HKLM\..\Run: [CPM5fc911c4] Rundll32.exe "c:\windows\system32\dojisino.dll",a O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [GetModule35] C:\Program Files\GetModule\GetModule35.exe O4 - HKCU\..\Run: [cogad] "C:\Documents and Settings\Ahz\Application Data\cogad\cogad.exe" 61A847B5BBF72813338B2B27128065E9C084320161C4661227A755E9C2933154389A O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Ahz\Application Data\Twain\Twain.exe O4 - HKCU\..\Run: [GetPack30] "C:\Program Files\GetPack\GetPack30.exe" O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe O4 - HKCU\..\Run: [PoliceAV] C:\Program Files\XPPoliceAntivirus\xppolice.exe O4 - HKCU\..\Policies\Explorer\Run: [svcho] C:\WINDOWS\svcho.exe O4 - HKUS\S-1-5-19\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'NETWORK SERVICE') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: zudwwn.dll dhfblh.dll rsbahc.dll C:\WINDOWS\system32\bufufodu.dll kebyqb.dll ikxgqj.dll anokrj.dll hiogfv.dll mffjqj.dll bjvllo.dll uhsxwg.dll mowgml.dll c:\windows\system32\dojisino.dll O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dojisino.dll O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dojisino.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\winvnc.exe (file missing) -- End of file - 10796 bytes Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:43:49 PM, on 2/17/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\program files\steam\steam.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Documents and Settings\Ahz\Application Data\Twain\Twain.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Furcadia\Furcadia.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\regsvr32.exe
C:\Program Files\Furcadia\winopen.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe
C:\Documents and Settings\Ahz\Desktop\sdsetup.exe
C:\Documents and Settings\Ahz\Desktop\sdsetup.exe
C:\Documents and Settings\Ahz\Desktop\sdsetup.exe
C:\Documents and Settings\Ahz\Desktop\sdsetup.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe
C:\WINDOWS\svcho.exe
C:\Documents and Settings\Ahz\Desktop\sdsetup.exe
C:\Documents and Settings\Ahz\Desktop\sdsetup.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup.exe
C:\Documents and Settings\Ahz\Desktop\mbam-setup(2).exe
C:\DOCUME~1\Ahz\LOCALS~1\Temp\is-A1VUU.tmp\mbam-setup(2).tmp
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Ahz\Desktop\HJTInstall.exe
C:\Documents and Settings\Ahz\Desktop\HJTInstall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WinGDI Class - {12c7290a-157b-4f43-b109-97e792c598ed} - C:\WINDOWS\iehost.dll
O2 - BHO: CPV - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\WebShow\WebShow.dll
O2 - BHO: WTBho Class - {348FE907-249E-4C65-A838-F34A193FE1D1} - C:\Program Files\WinTask\Bin\TaskBHO.dll
O2 - BHO: worldadmarketplace browser enhancer - {4FBBDF56-8AB7-2ED3-FFE2-97B4B83FAB9B} - C:\WINDOWS\system32\vdstfcgyupiv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\llguvcfo.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9f719a05-a752-4d29-8817-8ca9c970071a} - C:\WINDOWS\system32\mihamake.dll
O2 - BHO: worldadmarketplace - {c965dd6c-702b-c604-fcd9-af5dc15d53ab} - C:\WINDOWS\system32\nsoB.dll
O2 - BHO: BHO - {C9C42510-9B21-41c1-9DCD-8382A2D07C61} - C:\WINDOWS\system32\iehelper.dll
O2 - BHO: HelloWorldBHO - {D88E1558-7C2D-407A-953A-C044F5607CEA} - C:\Program Files\Mjcore\Mjcore.dll
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WTIndicator] \Bin\SchedInd.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s
O4 - HKLM\..\Run: [txctjwgzrmci] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\vdstfcgyupiv.dll"
O4 - HKLM\..\Run: [5cfa2258] rundll32.exe "C:\WINDOWS\system32\fisalunu.dll",b
O4 - HKLM\..\Run: [CPM5fc911c4] Rundll32.exe "c:\windows\system32\dojisino.dll",a
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [GetModule35] C:\Program Files\GetModule\GetModule35.exe
O4 - HKCU\..\Run: [cogad] "C:\Documents and Settings\Ahz\Application Data\cogad\cogad.exe" 61A847B5BBF72813338B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Ahz\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [GetPack30] "C:\Program Files\GetPack\GetPack30.exe"
O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe
O4 - HKCU\..\Run: [PoliceAV] C:\Program Files\XPPoliceAntivirus\xppolice.exe
O4 - HKCU\..\Policies\Explorer\Run: [svcho] C:\WINDOWS\svcho.exe
O4 - HKUS\S-1-5-19\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [punovefupi] Rundll32.exe "C:\WINDOWS\system32\tijevufi.dll",s (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: zudwwn.dll dhfblh.dll rsbahc.dll C:\WINDOWS\system32\bufufodu.dll kebyqb.dll ikxgqj.dll anokrj.dll hiogfv.dll mffjqj.dll bjvllo.dll uhsxwg.dll mowgml.dll c:\windows\system32\dojisino.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dojisino.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dojisino.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\winvnc.exe (file missing)

--
End of file - 10796 bytes

]]> By: Saoirse http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19653 Saoirse Tue, 17 Feb 2009 17:15:09 +0000 http://www.askvg.com/?p=1096#comment-19653 Hey Vishal, thank you for your help and sorry for the very late reply, I've been very busy with school. Anyways, I followed your suggestions and fixed the lines you said but my problem is this line still appears everytime I reboot: F2 - REG:system.ini: Shell=Explorer.exe rundll.exe And even though I fix it in HijackThis it still resurfaces every time I turnon the computer. What should I do? :( Thanks! Hey Vishal, thank you for your help and sorry for the very late reply, I've been very busy with school. Anyways, I followed your suggestions and fixed the lines you said but my problem is this line still appears everytime I reboot:

F2 - REG:system.ini: Shell=Explorer.exe rundll.exe

And even though I fix it in HijackThis it still resurfaces every time I turnon the computer. What should I do? :(

Thanks!

]]> By: Eric http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19626 Eric Mon, 16 Feb 2009 20:08:21 +0000 http://www.askvg.com/?p=1096#comment-19626 Hello VG, do you mind checking my log, I uploaded it on sendspace because I cant seem to post it. http://www.sendspace.com/file/gur0js Hello VG, do you mind checking my log, I uploaded it on sendspace because I cant seem to post it.

http://www.sendspace.com/file/gur0js

]]> By: The Champ http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19621 The Champ Mon, 16 Feb 2009 17:29:22 +0000 http://www.askvg.com/?p=1096#comment-19621 <a href="http://www.mediafire.com/?duuzwzmdmtm" rel="nofollow">http://www.mediafire.com/?duuzwzmdmtm</a> http://www.mediafire.com/?duuzwzmdmtm

]]> By: The Champ http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19620 The Champ Mon, 16 Feb 2009 17:28:35 +0000 http://www.askvg.com/?p=1096#comment-19620 As u said but due to some problem I don't know i can't upload that log file here,so pls if u can check for that search engine called Yoog ,Thanks http://www.mediafire.com/?duuzwzmdmtm As u said but due to some problem I don't know i can't upload that log file here,so pls if u can check for that search engine called Yoog ,Thanks

http://www.mediafire.com/?duuzwzmdmtm

]]> By: VG http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19600 VG Mon, 16 Feb 2009 09:15:50 +0000 http://www.askvg.com/?p=1096#comment-19600 ^^ Your log file is absolutely clean. ^^ Your log file is absolutely clean.

]]> By: JLB http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19588 JLB Mon, 16 Feb 2009 03:59:24 +0000 http://www.askvg.com/?p=1096#comment-19588 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:55:02 PM, on 2/15/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\VistaDrive\VistaDrive.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\RocketDock\RocketDock.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\WTablet\TabUserW.exe C:\Program Files\Rainmeter\Rainmeter.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\WINDOWS\system32\taskmgr.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe C:\Program Files\The KMPlayer\KMPlayer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\ViOrb\ViOrb.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: Explorer Breadcrumbs - {A3EB65EC-D9B4-4DC1-88AF-0C7A21EBE5F9} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll O3 - Toolbar: QT TabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - mscoree.dll (file missing) O3 - Toolbar: QT Tab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - mscoree.dll (file missing) O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [ViOrb] C:\Program Files\ViOrb\ViOrb.exe O4 - Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221940586875 O17 - HKLM\System\CCS\Services\Tcpip\..\{E64886BD-E7EC-47A2-980C-2DAA5B992C22}: NameServer = 66.174.95.44 69.78.96.14 O20 - AppInit_DLLs: C:\WINDOWS\system32\karna.dat O21 - SSODL: aplsysact - {17751DBA-2EC7-CCAA-9E0B-04DF64A74E5B} - (no file) O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe O24 - Desktop Component 0: (no name) - (no file) -- End of file - 6722 bytes Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:02 PM, on 2/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\system32\taskmgr.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
C:\Program Files\The KMPlayer\KMPlayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ViOrb\ViOrb.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Explorer Breadcrumbs - {A3EB65EC-D9B4-4DC1-88AF-0C7A21EBE5F9} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: QT TabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - mscoree.dll (file missing)
O3 - Toolbar: QT Tab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - mscoree.dll (file missing)
O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ViOrb] C:\Program Files\ViOrb\ViOrb.exe
O4 - Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221940586875
O17 - HKLM\System\CCS\Services\Tcpip\..\{E64886BD-E7EC-47A2-980C-2DAA5B992C22}: NameServer = 66.174.95.44 69.78.96.14
O20 - AppInit_DLLs: C:\WINDOWS\system32\karna.dat
O21 - SSODL: aplsysact - {17751DBA-2EC7-CCAA-9E0B-04DF64A74E5B} - (no file)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 6722 bytes

]]> By: tt http://www.askvg.com/is-your-system-infected-with-a-virus-spyware-adware-trojan-2/comment-page-59/#comment-19586 tt Mon, 16 Feb 2009 00:14:38 +0000 http://www.askvg.com/?p=1096#comment-19586 Thank you, but I did try to fix the file while in safe mode. Not sure what to do. And unfortunately I can not find my setup disc. Thanks for all your help, I might just re install windows. I think I have an extra copy. Thank you, but I did try to fix the file while in safe mode. Not sure what to do. And unfortunately I can not find my setup disc. Thanks for all your help, I might just re install windows. I think I have an extra copy.

]]>