|
|||||||
| Malware Removal Discussion about Trojans, viruses, hoaxes, firewalls, spyware, and general Security issues. If you suspect your PC is infected with a virus, trojan or spyware app please include any supporting documentation or logs |
 |
|
|
Topic Tools |
|
#1
October 15th, 2006, 05:28 AM
|
|||
|
|||
|
System Restore Volume infected with Trojan.Downloader.Zlob.OV
Um, Hi there. I was wonder what can I do to clean my computer since I have been attacked by a Trojan Downloader Zlob OV? Can anyone help me on this problem? Thank you a lot CyberHelp and I appreciate your time. So, here is my hijack this.
Logfile of HijackThis v1.99.1 Scan saved at 9:28:24 PM, on 10/14/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5450.0004) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\AIM\aim.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\BitComet\BitComet.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\msiexec.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID} O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [zzGBK] D:\setup.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing) O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe 
|
|
#2
October 15th, 2006, 07:19 AM
|
||||
|
||||
|
Hi Xiver. That infected file is in your System Restore Folder and is not active on your drive now. It will not be reactivated, unless you restore your PC to an earlier time. To get rid of it, you will have to disable System Restore and then re-enable it. See instructions here.
Before you do this, it would be a good idea to make sure that nothing else is lurking. Download the trial version of AVG Anti-Spyware from here to your Desktop and doubleclick on the executable to install it. Launch AVG Anti-Spyware (there should be an icon on your desktop doubleclick it). The program will now go to the main screen. You will need to update AVG Anti-Spyware to the latest definition files. On the left hand side of the main screen click update and then click on Start Update. The update will start and a progress bar will show the updates being installed. Do not run a scan yet. When you have done this, boot into Safe Mode (see here for help if you need it). Run AVG Anti-Spyware now. Click Scanner, then click on the Scan tab. Click Complete System Scan to begin scanning. When the scan is complete click Recommended Action and change it to Quarantine. Then click Apply all actions. When the scan is finished, click the Save report button at the bottom of the screen. Save the report to your desktop and close AVG Anti-Spyware. Reboot and post a new Hijack This log and your AVG Anti-Spyware report. Also go here and download Silent Runners.vbs to a new folder on your Desktop (Clicking the the download link works if you use IE. If you use FireFox, rightclick on the link and choose "Save Link As") and run it. It generates a log too. It takes a minute or two and it will notify you with a popup when your log is ready. Please post the information back in this thread too (you may need to make a couple of posts). If your antivirus program queries the script, allow it to run. It's not malicious.
|
|
#3
October 21st, 2006, 09:03 PM
|
|||
|
|||
|
hijack this log
Logfile of HijackThis v1.99.1 Scan saved at 12:54:46 PM, on 10/21/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5450.0004) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\AIM\aim.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID} O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [zzGBK] D:\setup.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing) O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
|
|
#4
October 21st, 2006, 09:07 PM
|
|||
|
|||
|
---------------------------------------------------------
AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 12:45:20 PM 10/21/2006 + Scan result: :mozilla.36:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.375:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.37:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.38:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.41:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.435:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.436:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.437:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.438:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.439:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.640:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Addcontrol : Cleaned. :mozilla.148:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Admarketplace : Cleaned. :mozilla.133:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.134:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.135:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.136:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.137:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.138:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.498:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Burstbeacon : Cleaned. :mozilla.298:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.299:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.302:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.262:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.263:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.264:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.265:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.266:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.267:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.268:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.269:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.270:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.271:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.46:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.47:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.940:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.941:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Clickzs : Cleaned. :mozilla.568:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Com : Cleaned. :mozilla.570:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Com : Cleaned. :mozilla.571:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Com : Cleaned. :mozilla.572:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Com : Cleaned. :mozilla.303:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.304:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.305:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.306:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.625:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.208:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.209:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.210:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.211:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.283:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.284:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.285:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.286:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.287:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.288:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.289:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.51:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.52:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.53:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.54:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.892:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.893:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.894:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.898:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.899:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.204:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.205:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.206:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.552:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.553:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.554:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.555:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.556:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.557:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.414:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Starware : Cleaned. :mozilla.517:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Starware : Cleaned. :mozilla.518:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Starware : Cleaned. :mozilla.519:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Starware : Cleaned. :mozilla.389:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.390:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.391:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.392:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.393:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.394:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.395:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.396:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.397:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.398:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.399:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.400:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.401:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.402:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.403:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.404:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.405:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.406:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.407:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.408:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.409:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.410:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.411:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.412:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.191:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.192:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.193:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.194:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.348:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.756:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.27:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.28:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.29:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.30:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.31:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.32:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.33:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.34:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.35:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.195:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.196:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.197:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.198:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.199:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\yrbpblpb.default\coo kies.txt -> TrackingCookie.Zedo : Cleaned. ::Report end
|
|
#5
October 21st, 2006, 09:09 PM
|
|||
|
|||
|
"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ {++} "AIM" = "C:\Program Files\AIM\aim.exe -cnetwait.odl" ["America Online, Inc."] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"" ["Nero AG"] "PeerGuardian" = "C:\Program Files\PeerGuardian2\pg2.exe" ["Methlabs"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run \ {++} "zzGBK" = "D:\setup.exe" [file not found] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "NWEReboot" = "(empty string)" [file not found] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"] "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"" [null data] "Windows Defender" = ""C:\Program Files\Windows Defender\MSASCui.exe" -hide" [MS] "Adobe Version Cue CS2" = ""C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"" ["Adobe Sytems Incorporated"] "Acrobat Assistant 7.0" = ""C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"" ["Adobe Systems Inc."] "(Default)" = "(empty string)" [file not found] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."] "IMJPMIG8.1" = ""C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32" [MS] "MSPY2002" = "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC" [null data] "PHIME2002ASync" = "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC" [MS] "PHIME2002A" = "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName" [MS] "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Conversion Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension" -> {HKLM...CLSID} = "Display Panning CPL Extension" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "My Sharing Folders" \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0812.00.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellExecuteHooks\ <<!>> "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}" = "Microsoft AntiMalware ShellExecuteHook" -> {HKLM...CLSID} = "Microsoft AntiMalware ShellExecuteHook" \InProcServer32\(Default) = "C:\PROGRA~1\WIFD1F~1\MpShHook.dll" [MS] <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\She llServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandler s\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandler s\ Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] HKLM\Software\Classes\Directory\shellex\ContextMen uHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
|
|
#6
October 21st, 2006, 09:10 PM
|
|||
|
|||
|
contuined....
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] HKLM\Software\Classes\Folder\shellex\ContextMenuHa ndlers\ Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Loca l Settings\Application Data\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Desktop Background.bmp" Startup items in "user" & "All Users" startup folders: ------------------------------------------------------ C:\Documents and Settings\All Users\Start Menu\Programs\Startup "Adobe Acrobat Speed Launcher" -> shortcut to: "C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe" [null data] "Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."] Enabled Scheduled Tasks: ------------------------ "MP Scheduled Scan" -> launches: "C:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges" [MS] "Norton AntiVirus - Scan my computer - user" -> launches: "C:\PROGRA~1\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Pa rameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 32 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{F2CF5485-4E02-4F68-819C-B92DE9277049}" -> {HKLM...CLSID} = "&Links" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Research" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\ "ButtonText" = "AIM" "Exec" = "C:\Program Files\AIM\aim.exe" ["America Online, Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Automatic LiveUpdate Scheduler, Automatic LiveUpdate Scheduler, ""C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared files\RichVideo.exe"" [empty string] Norton AntiVirus Auto-Protect Service, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] Norton AntiVirus Firewall Monitor Service, NPFMntor, ""C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe"" ["Symantec Corporation"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Symantec Core LC, Symantec Core LC, "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"] Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"] Symantec SPBBCSvc, SPBBCSvc, ""C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Symantec Corporation"] Windows Defender Service, WinDefend, ""C:\Program Files\Windows Defender\MsMpEng.exe"" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monito rs\ Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."] LIDIL Language Monitor\Driver = "hpzll3xu.dll" ["Hewlett-Packard Company"] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 84 seconds. ---------- (total run time: 133 seconds)
|
|
#7
October 21st, 2006, 11:18 PM
|
||||
|
||||
|
Hi Xiver. Your logs look fine. Go ahead and disable and then re-enable System Restore as per the instructions in the link I posted and let us know if this fixed your problem.
|
|
| Bookmarks |
«
Previous Topic
|
Next Topic
»
|
|
Similar Topics
|
||||
| Topic | Topic Starter | Forum | Replies | Last Post |
| Trojan Horse Downloader.Zlob.AKVW | Triplj | Malware Removal | 14 | April 29th, 2009 01:38 AM |
| HJThis Log: Trojan, downloader and logger.banker in C:\System Volume Information... | linzer_kay | Malware Removal | 19 | October 26th, 2007 01:39 AM |
| Trojan horse Downloader zlob.fyt | macloud76 | Malware Removal | 3 | December 24th, 2006 02:02 PM |
| trojan downloader zlob | oranges311 | Windows XP | 1 | December 10th, 2006 05:09 AM |
| Trojan.Downloader.Zlob.WG | dudeking | Malware Removal | 31 | August 21st, 2006 04:56 PM |
All times are GMT +1. The time now is 04:37 PM.