Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
06-May-2008, 11:48 AM
#1 | |||||
 C:\windows\svchost.exe...:( Hi, I have Vista on my laptop and am getting the error: could not load or run c:\windows\svchost.exe specified in registry. make sure the file exists on your computer or remove the reference to it in the registry. I'm quite sure it's a virus from googleing it...I ran AVG and delete some trojans but the message still comes up when I start. Here is my hijackthis log file: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:38:36 AM, on 06/05/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Toshiba\Power Saver\TPwrMain.exe C:\Program Files\Synaptics\SynTP\SynTPStart.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\AVG\AVG8\avgui.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\AVG\AVG8\avgscanx.exe C:\Program Files\Mozilla Firefox 3 Beta 4\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.shoptoshiba.ca/welcome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shoptoshiba.ca/welcome R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) F3 - REG:win.ini: load=C:\Windows\svchost.exe O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O13 - Gopher Prefix: O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.photolab.ca/Upload/ImageUploader4.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\Windows\system32\rpcnet.exe -- End of file - 6646 bytes I hope you can help...thank you. |
| |
10-May-2008, 07:20 PM
#2 | |||||
| A belated welcome to TSG jbaic, The log shows a infection startup there. If you have not yet resolved the issues let's get a more current and detailed look, and then start some repairs. To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Download Deckard's System Scanner (dss.exe) to your Desktop. Note: You must be logged onto an account with administrator privileges. Making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK): "%userprofile%\desktop\dss.exe" /config When the DSS Configuration display opens click the "Check All" button (if the "Uncheck All" button shows, click that, then click "Check All"). Next, Under Main Log, uncheck the following: System Restore Temp Cleanup Process Modules Then under Options, place a check next to the following: Backup Registry Hives Don't make any other changes at this time. Then click the "Scan!" button to start the scan. Once the scan has completed a textbox will appear - copy/paste those contents back here (main.txt). Also a second text file, extra.txt, will show as minimized in your Task Bar. Maximize/Open this, and copy/paste those contents back here along with the main.txt please. (The logs can also be found in the C:\Deckard\System Scanner folder) You can use extra posts here if needed for that. |
11-May-2008, 10:22 PM
#3 | |||||
| thanks! thank you so much for your reply..since I posted this thread I have found more infections and deleted them, I also did a system restore and things seem to be back to normal. I did as you asked and here is the first log file, main.txt: Deckard's System Scanner v20071014.68 Run by Janet on 2008-05-11 22:07:45 Computer is in Normal Mode. -------------------------------------------------------------------------------- Backed up registry hives. -- HijackThis (run as Janet.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:08:19 PM, on 11/05/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Toshiba\Power Saver\TPwrMain.exe C:\Program Files\Synaptics\SynTP\SynTPStart.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Toshiba\ConfigFree\NDSTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Mozilla Firefox 3 Beta 4\firefox.exe C:\Windows\system32\conime.exe C:\Users\Janet\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Janet.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.shoptoshiba.ca/welcome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shoptoshiba.ca/welcome R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O13 - Gopher Prefix: O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.photolab.ca/Upload/ImageUploader4.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\Windows\system32\rpcnet.exe O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7874 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- All drivers whitelisted. -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > R2 CFSvcs (ConfigFree Service) - c:\program files\toshiba\configfree\cfsvcs.exe <Not Verified; TOSHIBA CORPORATION; ConfigFree(TM)> R2 rpcnet (Remote Procedure Call (RPC) Net) - c:\windows\system32\rpcnet.exe <Not Verified; Absolute Software Corp.; Installation/Management Application> R2 TNaviSrv (TOSHIBA Navi Support Service) - c:\program files\toshiba\toshiba dvd player\tnavisrv.exe <Not Verified; TOSHIBA Corporation; TOSHIBA DVD Player> R2 TODDSrv (TOSHIBA Optical Disc Drive Service) - c:\windows\system32\toddsrv.exe <Not Verified; TOSHIBA Corporation; TDCSrv Application> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2008-04-11 and 2008-05-11 ----------------------------- 2008-05-07 09:21:40 0 d-------- C:\Windows\pss 2008-05-07 02:12:01 0 d-------- C:\Windows\system32\drivers\Avg 2008-05-06 11:38:04 0 d-------- C:\Program Files\Trend Micro 2008-05-05 13:43:05 0 d--h----- C:\$AVG8.VAULT$ 2008-05-05 13:41:40 0 d-------- C:\Program Files\AVG 2008-05-05 13:41:39 0 d-------- C:\Users\All Users\avg8 2008-04-30 23:38:23 0 d-------- C:\Program Files\Google 2008-04-22 23:47:12 2560 --a------ C:\Windows\system32\bitcometres.dll <Not Verified; BitComet; BitComet BCTP Helper> 2008-04-18 10:31:51 0 d-------- C:\Program Files\Common Files\Adobe -- Find3M Report --------------------------------------------------------------- 2008-05-11 21:53:31 0 d-------- C:\Program Files\Mozilla Firefox 3 Beta 4 2008-05-11 21:50:39 0 d-------- C:\Users\Janet\AppData\Roaming\Skype 2008-05-11 16:09:40 0 d-------- C:\Users\Janet\AppData\Roaming\skypePM 2008-05-11 11:49:11 17408 --a------ C:\Windows\system32\rpcnetp.exe 2008-05-11 11:49:09 47104 --a------ C:\Windows\system32\rpcnet.dll <Not Verified; Absolute Software Corp.; Installation/Management Application> 2008-05-10 01:19:58 0 d-------- C:\Users\Janet\AppData\Roaming\OpenOffice.org2 2008-05-10 01:04:50 0 d-------- C:\Users\Janet\AppData\Roaming\LimeWire 2008-05-07 01:12:43 0 d-------- C:\Program Files\BitComet 2008-05-07 01:01:02 0 d-------- C:\Program Files\Common Files 2008-05-07 01:01:02 0 d-------- C:\Program Files\Common Files\Accent Shared 2008-05-07 01:01:02 0 d-------- C:\Program Files\Accent 2008-05-07 01:00:59 0 d-------- C:\Program Files\Yahoo! 2008-05-07 01:00:59 0 d-------- C:\Program Files\QuickTime 2008-05-07 01:00:59 0 d-------- C:\Program Files\LimeWire 2008-05-07 01:00:59 0 d-------- C:\Program Files\Lavasoft 2008-05-07 01:00:59 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-05-07 01:00:58 0 d-------- C:\Program Files\Western Digital Technologies 2008-05-07 01:00:58 0 d-------- C:\Program Files\iTunes 2008-05-07 01:00:58 0 d-------- C:\Program Files\iPod 2008-05-07 01:00:58 0 d-------- C:\Program Files\Common Files\InstallShield 2008-05-07 01:00:58 0 d-------- C:\Program Files\Common Files\Canon 2008-05-07 01:00:58 0 d-------- C:\Program Files\Canon 2008-05-07 01:00:57 0 d-------- C:\Program Files\Skype 2008-05-07 01:00:56 0 d-------- C:\Users\Janet\AppData\Roaming\Winamp 2008-05-07 01:00:56 0 d-------- C:\Program Files\Windows Live 2008-05-07 01:00:56 0 d-------- C:\Program Files\Winamp 2008-05-07 01:00:56 0 d-------- C:\Program Files\OpenOffice.org 2.4 2008-05-07 01:00:56 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-05-07 01:00:55 0 d-------- C:\Program Files\Toshiba 2008-05-07 01:00:55 0 d-------- C:\Program Files\REALTEK RTL8187B Wireless LAN Driver 2008-05-07 01:00:54 0 d-------- C:\Program Files\MSECache 2008-05-07 01:00:11 0 d-------- C:\Program Files\Windows Sidebar 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows Photo Gallery 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows NT 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows Media Components 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows Mail 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows Journal 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows Defender 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows Collaboration 2008-05-07 01:00:10 0 d-------- C:\Program Files\Windows Calendar 2008-05-07 01:00:08 0 d-------- C:\Program Files\Ulead Systems 2008-05-07 01:00:08 0 d-------- C:\Program Files\Reference Assemblies 2008-05-07 01:00:08 0 d-------- C:\Program Files\Realtek 2008-05-07 01:00:08 0 d-------- C:\Program Files\MSBuild 2008-05-07 01:00:07 0 d-------- C:\Program Files\Movie Maker 2008-05-07 01:00:07 0 d-------- C:\Program Files\Microsoft SQL Server 2008-05-07 01:00:07 0 d-------- C:\Program Files\Microsoft Games 2008-05-07 01:00:07 0 d-------- C:\Program Files\Java 2008-05-07 01:00:07 0 d-------- C:\Program Files\InterVideo 2008-05-07 01:00:07 0 d-------- C:\Program Files\Common Files\Ulead Systems 2008-05-07 01:00:06 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-05-07 01:00:06 0 d-------- C:\Program Files\Common Files\Java 2008-05-07 01:00:05 0 d-------- C:\Program Files\ATI 2008-05-07 01:00:05 0 d-------- C:\Program Files\ATI Technologies 2008-04-30 23:39:46 0 d-------- C:\Users\Janet\AppData\Roaming\Google 2008-04-05 02:39:58 17408 --a------ C:\Windows\system32\rpcnetp.dll 2008-04-01 20:29:10 0 d-------- C:\Users\Janet\AppData\Roaming\ZoomBrowser EX 2008-04-01 20:26:55 0 d-------- C:\Users\Janet\AppData\Roaming\Canon 2008-03-30 15:19:00 0 d-------- C:\Program Files\Open Office 2008-03-23 18:58:47 174 --ahs---- C:\Program Files\desktop.ini 2008-03-18 22:03:36 0 d-------- C:\Users\Janet\AppData\Roaming\Mozilla 2008-03-18 18:00:49 0 d-------- C:\Users\Janet\AppData\Roaming\toshiba 2008-03-18 16:56:00 0 d-------- C:\Program Files\Common Files\Skype 2008-03-18 16:14:01 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-03-18 16:01:38 0 d-------- C:\Program Files\CCleaner 2008-03-18 15:33:22 47104 --a------ C:\Windows\system32\rpcnet.exe <Not Verified; Absolute Software Corp.; Installation/Management Application> 2008-03-17 20:21:30 0 d-------- C:\Users\Janet\AppData\Roaming\Apple Computer 2008-03-15 11:42:39 0 d-------- C:\Users\Janet\AppData\Roaming\Macromedia 2008-03-15 11:42:38 0 d-------- C:\Users\Janet\AppData\Roaming\Adobe 2008-03-15 10:26:57 0 d-------- C:\Users\Janet\AppData\Roaming\Ulead Systems 2008-03-15 09:41:56 0 d-------- C:\Program Files\ltmoh 2008-03-15 09:41:23 0 d-------- C:\Program Files\Synaptics 2008-03-15 09:40:37 0 d-------- C:\Program Files\Toshiba Registration 2008-03-15 09:40:33 0 d-------- C:\Program Files\OnlinePlay 2008-03-15 06:59:32 0 d-------- C:\Program Files\Common Files\Toshiba Shared 2008-03-15 06:58:07 0 d-------- C:\Users\Janet\AppData\Roaming\InstallShield 2008-03-15 06:56:25 0 d-------- C:\Users\Janet\AppData\Roaming\ATI 2008-03-15 06:55:33 0 d-------- C:\Users\Janet\AppData\Roaming\Identities -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [23/08/2007 02:44 PM] "RtHDVCpl"="RtHDVCpl.exe" [09/08/2007 07:26 AM C:\Windows\RtHDVCpl.exe] "TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [29/03/2007 10:39 AM] "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [15/08/2007 03:31 AM] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [07/05/2008 02:11 AM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [14/06/2007 09:32 PM] "SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [15/06/2007 09:01 PM] "NDSTray.exe"="NDSTray.exe" [] "HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [07/12/2006 04:49 PM] "00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [22/05/2007 04:32 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [16/03/2008 03:53 AM] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [02/11/2006 08:35 AM] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [01/02/2008 05:22 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawser vice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInf o] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSv c] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Tablet InputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Truste dInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr .sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr x.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5 B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1 FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D4817 9BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE 5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Janet^AppData^Roaming^Microsoft^Windo ws^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk] path=C:\Users\Janet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk backup=C:\Windows\pss\OpenOffice.org 2.4.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\284961391] C:\Program Files\Toshiba Registration\Registration.exe /r "C:\Program Files\Toshiba Registration\Registration.rpd" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh] C:\Program Files\ltmoh\Ltmoh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\F] AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\G] AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{a39cfcbc-f37c-11dc-8d4a-0016449d38f8}] AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{a39cfd37-f37c-11dc-8d4a-0016449d38f8}] AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{b831b745-fdac-11dc-8d9b-0016449d38f8}] AutoRun\command- G:\LaunchU3.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-05-11 22:09:17 ------------ |
11-May-2008, 10:23 PM
#4 | |||||
| 2nd log, extra.txt... Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft® Windows Vista™ Home Premium (build 6000) Architecture: X86; Language: English CPU 0: AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57 Percentage of Memory in Use: 50% Physical Memory (total/avail): 1917.44 MiB / 953.41 MiB Pagefile Memory (total/avail): 4057.18 MiB / 2910.5 MiB Virtual Memory (total/avail): 2047.88 MiB / 1956.46 MiB C: is Fixed (NTFS) - 173.27 GiB total, 100.63 GiB free. D: is Fixed (NTFS) - 6.01 GiB total, 5.44 GiB free. E: is CDROM (No Media) \\.\PHYSICALDRIVE0 - Hitachi HTS542520K9SA00 ATA Device - 186.31 GiB - 4 partitions \PARTITION0 - Unknown - 1500 MiB \PARTITION1 (bootable) - Installable File System - 173.27 GiB - C: \PARTITION2 - Installable File System - 6.01 GiB - D: \PARTITION3 - Unknown - 5.56 GiB -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. FW: AVG Firewall v8.0 (AVG Technologies CZ, s.r.o.) AV: AVG Internet Security v8.0 (AVG Technologies) AS: AVG Internet Security v8.0 (AVG Technologies) Disabled AS: AVG Anti-Spyware v7, 5, 1, 43 (GRISOFT s.r.o.) Disabled Outdated AS: Windows Defender v1.1.1505.0 (Microsoft Corporation) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPoli cy\DomainProfile\AuthorizedApplications\List] [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPoli cy\StandardProfile\AuthorizedApplications\List] -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\Janet\AppData\Roaming CLASSPATH=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=JANET ComSpec=C:\Windows\system32\cmd.exe configsetroot=C:\Windows\ConfigSetRoot FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\Janet LOCALAPPDATA=C:\Users\Janet\AppData\Local LOGONSERVER=\\JANET NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 104 Stepping 2, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=6802 ProgramData=C:\ProgramData ProgramFiles=C:\Program Files PROMPT=$P$G PUBLIC=C:\Users\Public QTJAVA=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\Windows TEMP=C:\Users\Janet\AppData\Local\Temp TMP=C:\Users\Janet\AppData\Local\Temp USERDOMAIN=JANET USERNAME=Janet USERPROFILE=C:\Users\Janet windir=C:\Windows -- User Profiles --------------------------------------------------------------- Janet (admin) -- Add/Remove Programs --------------------------------------------------------- --> "C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72} --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,Launch Setup "C:\Program Files\InstallShield Installation Information\{622E6F16-0904-49B6-BBE1-4CC836314CCF}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,Launch Setup "C:\Program Files\InstallShield Installation Information\{697AFC77-F318-4CD4-BF16-F50F4C1072DA}\setup.exe" -l0x9 Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} AVG 8.0 --> C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL BitComet 0.99 --> C:\Program Files\BitComet\uninst.exe Bluetooth Stack for Windows by Toshiba --> MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6} Canon Camera Access Library --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\CAL\Uninst.ini" Canon Camera Support Core Library --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\CSCLIB\Uninst.ini" Canon Camera Window DC_DV 5 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC\Uninst.ini" Canon Camera Window DC_DV 6 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini" Canon Camera Window MC 6 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowMC\Uninst.ini" Canon RAW Image Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini" Canon RemoteCapture Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini" Canon Utilities Digital Photo Professional 2.2 --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\Digital Photo Professional\Uninst.ini" Canon Utilities EOS Utility --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini" Canon Utilities PhotoStitch --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini" Canon Utilities ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.1.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini" Catalyst Control Center - Branding --> MsiExec.exe /I{22543949-70E8-45D0-A938-F38143EB8BF8} CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" CD/DVD Drive Acoustic Silencer --> C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\SETUP.exe -runfromtemp -l0x0009 -removeonly DVD MovieFactory for TOSHIBA --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,Launch Setup "C:\Program Files\InstallShield Installation Information\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}\SETUP.EXE" -l0x9 HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall iPod for Windows 2006-06-28 --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BD57EA4D-026E-4F08-9B93-080E282B81FE} /l1033 iTunes --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{54C0D94A-F467-4ABC-9D02-6E58748668D4} /l1033 Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} LimeWire 4.16.7 --> "C:\Program Files\LimeWire\uninstall.exe" Microsoft SQL Server Native Client --> MsiExec.exe /I{50A0893D-47D8-48E0-A7E8-44BCD7E4422E} Microsoft SQL Server Setup Support Files (English) --> MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE} Microsoft SQL Server VSS Writer --> MsiExec.exe /I{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8} Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Mozilla Firefox (3.0b5) --> C:\Program Files\Mozilla Firefox 3 Beta 4\uninstall\helper.exe MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} OnlinePlay 1.0 --> C:\Program Files\OnlinePlay\uninst.exe OpenOffice.org 2.4 --> MsiExec.exe /I{2BB8FBB4-CFF9-434E-AA0A-40F5379C1602} QuickTime --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{C21D5524-A970-42FA-AC8A-59B8C7CDCA31} /l1033 Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista --> C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\SETUP.exe -runfromtemp -l0x0009 -removeonly Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,Launc hSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.exe" -l0x9 -removeonly REALTEK RTL8187B Wireless LAN Driver --> C:\Program Files\InstallShield Installation Information\{7095FD27-37F0-4750-9DE8-D37DC0043706}\Install.exe -uninst -l0x9 RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,Launch Setup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\SETUP.EXE" -l0x9 anything Skype™ 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall TOSHIBA Assist --> C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\SETUP.exe -runfromtemp -l0x0009 -removeonly TOSHIBA ConfigFree --> C:\Program Files\InstallShield Installation Information\{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}\setup.exe -runfromtemp -l0x0009 uninstall TOSHIBA Disc Creator --> MsiExec.exe /X{5DA0E02F-970B-424B-BF41-513A5018E4C0} TOSHIBA DVD PLAYER --> C:\Program Files\InstallShield Installation Information\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}\setup.exe -runfromtemp -l0x0009 -ADDREMOVE -removeonly TOSHIBA Extended Tiles for Windows Mobility Center --> C:\Program Files\InstallShield Installation Information\{617C36FD-0CBE-4600-84B2-441CEB12FADF}\SETUP.EXE -runfromtemp -l0x0409 TOSHIBA Hardware Setup --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,Launc hSetup "C:\Program Files\InstallShield Installation Information\{BFC85CDC-BD7C-4FDD-9507-8D74B5A79404}\setup.exe" -l0x9 TOSHIBA Recovery Disc Creator --> MsiExec.exe /X{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF} Toshiba Registration --> MsiExec.exe /I{C53D16CC-E56F-47B8-906E-70AAF8EABB4F} TOSHIBA SD Memory Utilities --> MsiExec.exe /X{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7} TOSHIBA Software Modem --> Tosmreg -U TOSHIBA Speech System Applications --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EE033C1F-443E-41EC-A0E2-559B539A4E4D}\Setup.exe" -l0x9 TOSHIBA Speech System SR Engine(U.S.) Version1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{008D69EB-70FF-46AB-9C75-924620DF191A}\Setup.exe" -l0x9 UNINSTALL TOSHIBA Speech System TTS Engine(U.S.) Version1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FBF6F99-8EC6-41B4-8527-0A32241B5496}\Setup.exe" -l0x9 TOSHIBA Supervisor Password --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,Launc hSetup "C:\Program Files\InstallShield Installation Information\{2BDF38E0-1A7F-4220-B4B7-118DD45E5E13}\setup.exe" -l0x9 TOSHIBA Value Added Package --> C:\Program Files\InstallShield Installation Information\{FEDD27A0-B306-45EF-BF58-B527406B42C8}\setup.exe -runfromtemp -l0x0409 WD Diagnostics --> MsiExec.exe /X{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B} Winamp --> "C:\Program Files\Winamp\UninstWA.exe" Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0} Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Media Encoder 9 Series --> msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} Windows Media Encoder 9 Series --> MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} WNW Dictionary v2.0 --> C:\Windows\uninst.exe -f"C:\Program Files\Accent\WNW\DeIsL1.isu" -- Application Event Log ------------------------------------------------------- Event Record #/Type4449 / Success Event Submitted/Written: 05/11/2008 00:05:19 PM Event ID/Source: 12001 / usnjsvc Event Description: The Messenger Sharing USN Journal Reader service started successfully. Event Record #/Type4441 / Error Event Submitted/Written: 05/11/2008 11:49:11 AM Event ID/Source: 5007 / WerSvc Event Description: The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9. Event Record #/Type4440 / Success Event Submitted/Written: 05/11/2008 11:49:11 AM Event ID/Source: 5617 / WinMgmt Event Description: Event Record #/Type4439 / Success Event Submitted/Written: 05/11/2008 11:49:10 AM Event ID/Source: 5615 / WinMgmt Event Description: Event Record #/Type4437 / Success Event Submitted/Written: 05/11/2008 11:48:54 AM Event ID/Source: 902 / Software Licensing Service Event Description: The Software Licensing service has started. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type37547 / Warning Event Submitted/Written: 05/11/2008 10:08:31 PM Event ID/Source: 3004 / WinDefend Event Description: %JANET27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %JANET27 can't undo changes that you allow. For more information please see the following: %JANET275 Scan ID: {AB786F94-E4BD-47C2-9734-7531668458B4} User: JANET\Janet Name: %JANET271 ID: %JANET272 Severity ID: %JANET273 Category ID: %JANET274 Path Found: %JANET276 Alert Type: %JANET278 Detection Type: 1.1.1505.02 Event Record #/Type37546 / Warning Event Submitted/Written: 05/11/2008 10:08:31 PM Event ID/Source: 3004 / WinDefend Event Description: %JANET27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %JANET27 can't undo changes that you allow. For more information please see the following: %JANET275 Scan ID: {59624AEA-DE1D-4B8C-9C25-99E9C9FF35F9} User: JANET\Janet Name: %JANET271 ID: %JANET272 Severity ID: %JANET273 Category ID: %JANET274 Path Found: %JANET276 Alert Type: %JANET278 Detection Type: 1.1.1505.02 Event Record #/Type37545 / Warning Event Submitted/Written: 05/11/2008 10:08:31 PM Event ID/Source: 3004 / WinDefend Event Description: %JANET27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %JANET27 can't undo changes that you allow. For more information please see the following: %JANET275 Scan ID: {71DD0C79-918F-42A6-AC43-30DD76B6541E} User: JANET\Janet Name: %JANET271 ID: %JANET272 Severity ID: %JANET273 Category ID: %JANET274 Path Found: %JANET276 Alert Type: %JANET278 Detection Type: 1.1.1505.02 Event Record #/Type37544 / Warning Event Submitted/Written: 05/11/2008 10:08:31 PM Event ID/Source: 3004 / WinDefend Event Description: %JANET27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %JANET27 can't undo changes that you allow. For more information please see the following: %JANET275 Scan ID: {564BE601-A977-46C0-843C-9CD44DB56B1B} User: JANET\Janet Name: %JANET271 ID: %JANET272 Severity ID: %JANET273 Category ID: %JANET274 Path Found: %JANET276 Alert Type: %JANET278 Detection Type: 1.1.1505.02 Event Record #/Type37543 / Warning Event Submitted/Written: 05/11/2008 10:08:31 PM Event ID/Source: 3004 / WinDefend Event Description: %JANET27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %JANET27 can't undo changes that you allow. For more information please see the following: %JANET275 Scan ID: {0AC98EFC-9939-4616-A63A-33E94FCF83B2} User: JANET\Janet Name: %JANET271 ID: %JANET272 Severity ID: %JANET273 Category ID: %JANET274 Path Found: %JANET276 Alert Type: %JANET278 Detection Type: 1.1.1505.02 -- End of Deckard's System Scanner: finished at 2008-05-11 22:09:17 ------------ |
11-May-2008, 11:09 PM
#5 | |||||
| Looks good, but some worm infection autoload items showing. Lets repair, and then check with a scan after. To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Go here and download Flash_Disinfector.exe and save it to your desktop. Doubleclick on Flash_Disinfector.exe to run it and follow the prompts. Wait until it has finished scanning and then exit the program. The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well. -------------------------------------- Code: REGEDIT4
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a39cfcbc-f37c-11dc-8d4a-0016449d38f8}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a39cfd37-f37c-11dc-8d4a-0016449d38f8}] ---------------------------------------- Then although a reboot is in order, we just don't know what remains of active files there. So go here and run the Kaspersky online scan, and post back the log it creates (it requires IE). To use the scan, accept the agreement and make sure you allow the ActiveX object to download and install (check the "yellow bar" at the top of IE if needed to allow this). Once the download has completed click Next, then Scan Settings, then make sure the "extended option" is checked (leave all others as they are) and click OK. Then click "My Computer" to begin the scan. Save the Report as a text file and post that back here. To save it as a text file, still with the page in Internet Explorer, go to the top of the page and select File - Save As... Then make sure in the "Save as type" drop down you change it to "Text File(*.txt)". Just post back that log please. |
12-May-2008, 04:39 PM
#6 | |||||
| here is the report... ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, May 12, 2008 4:35:39 PM Operating System: Microsoft Windows Vista Home Edition, (Build 6000) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 12/05/2008 Kaspersky Anti-Virus database records: 763380 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ H:\ Scan Statistics: Total number of scanned objects: 87426 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 02:39:37 Infected Object Name / Virus Name / Last Action C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped C:\Boot\BCD Object is locked skipped C:\Boot\BCD.LOG Object is locked skipped C:\ProgramData\avg8\Antispam\scoffset.bin.incr Object is locked skipped C:\ProgramData\avg8\AvgAm\avgam.lck Object is locked skipped C:\ProgramData\avg8\emc\Log\emc.log Object is locked skipped C:\ProgramData\avg8\Log\avgam.log Object is locked skipped C:\ProgramData\avg8\Log\avgcore.log Object is locked skipped C:\ProgramData\avg8\Log\avgfw8u.log Object is locked skipped C:\ProgramData\avg8\Log\avgns.log Object is locked skipped C:\ProgramData\avg8\Log\avgrs.log Object is locked skipped C:\ProgramData\avg8\Log\avgsched.log Object is locked skipped C:\ProgramData\avg8\Log\avgui.log Object is locked skipped C:\ProgramData\avg8\Log\avgwd.log Object is locked skipped C:\ProgramData\avg8\Log\commonpriv.log Object is locked skipped C:\ProgramData\avg8\Log\commonpub.log Object is locked skipped C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0a3566ecf803f99a355bd55d2ad 2cfa3_252dd7e7-feea-49eb-b1a0-ac159bc135ef Object is locked skipped C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e041051ca4d27bdf7d793a5a00e b954d_252dd7e7-feea-49eb-b1a0-ac159bc135ef Object is locked skipped C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\System Index\SystemIndex.50.Crwl Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\System Index\SystemIndex.50.gthr Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010001.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010002.ci Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010002.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010002.wsb Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010003.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010004.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010005.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010006.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010007.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010008.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010009.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\0001000A.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\0001000F.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010010.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010012.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010013.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010014.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010016.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\00010017.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\0001001B.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\0001001C.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\0001001D.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\0001001E.wid Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\Indexer\CiFiles\INDEX.000 Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\PropMap\CiPT0000.000 Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\PropMap\Used0000.000 Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\SecStore\CiST0000.000 Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\SystemIndex.chk1.gthr Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\SystemIndex.chk2.gthr Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIn dex\SystemIndex.Ntfy167.gthr Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\NtfE954.tmp Object is locked skipped C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\NtfE955.tmp Object is locked skipped C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-11022006-050241.log Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\History\History.IE5\index.da t Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\UsrClass.dat{21c1e4e4-f27e-11dc-b815-0016449d38f8}.TM.blf Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\UsrClass.dat{21c1e4e4-f27e-11dc-b815-0016449d38f8}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows\UsrClass.dat{21c1e4e4-f27e-11dc-b815-0016449d38f8}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows Defender\FileTracker\{97D26453-AA9A-454A-B3E6-80F3AAA37C9A} Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows Live Contacts\jrbaic@gmail.com\real\members.stg Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows Live Contacts\jrbaic@gmail.com\shadow\members.stg Object is locked skipped C:\Users\Janet\AppData\Local\Microsoft\Windows Sidebar\Settings.ini Object is locked skipped C:\Users\Janet\AppData\Local\Mozilla\Firefox\Profiles\fa5do2a4.default\Cach e\_CACHE_001_ Object is locked skipped C:\Users\Janet\AppData\Local\Mozilla\Firefox\Profiles\fa5do2a4.default\Cach e\_CACHE_002_ Object is locked skipped C:\Users\Janet\AppData\Local\Mozilla\Firefox\Profiles\fa5do2a4.default\Cach e\_CACHE_003_ Object is locked skipped C:\Users\Janet\AppData\Local\Mozilla\Firefox\Profiles\fa5do2a4.default\Cach e\_CACHE_MAP_ Object is locked skipped C:\Users\Janet\AppData\Local\Mozilla\Firefox\Profiles\fa5do2a4.default\urlc lassifier3.sqlite Object is locked skipped C:\Users\Janet\AppData\Local\Temp\~DF4D9E.tmp Object is locked skipped C:\Users\Janet\AppData\Local\Temp\~DF4DA3.tmp Object is locked skipped C:\Users\Janet\AppData\Local\Temp\~DF791D.tmp Object is locked skipped C:\Users\Janet\AppData\Local\Temp\~DF7922.tmp Object is locked skipped C:\Users\Janet\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\ce rt8.db Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\co ntent-prefs.sqlite Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\co okies.sqlite Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\do wnloads.sqlite Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\fo rmhistory.sqlite Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\ke y3.db Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\pa rent.lock Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\pe rmissions.sqlite Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\pl aces.sqlite Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\pl aces.sqlite-journal Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\pl aces.sqlite-stmtjrnl Object is locked skipped C:\Users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\fa5do2a4.default\se arch.sqlite Object is locked skipped C:\Users\Janet\ntuser.dat Object is locked skipped C:\Users\Janet\ntuser.dat.LOG1 Object is locked skipped C:\Users\Janet\ntuser.dat.LOG2 Object is locked skipped C:\Users\Janet\ntuser.dat{e480f4c3-1bf0-11dd-855b-00a0d19c61dd}.TM.blf Object is locked skipped C:\Users\Janet\ntuser.dat{e480f4c3-1bf0-11dd-855b-00a0d19c61dd}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Janet\ntuser.dat{e480f4c3-1bf0-11dd-855b-00a0d19c61dd}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\Debug\PASSWD.LOG Object is locked skipped C:\Windows\Debug\sam.log Object is locked skipped C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat Object is locked skipped C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat Object is locked skipped C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Win dowsUpdate.log Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT Object is locked skipped C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 Object is locked skipped C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\catroot2\edb.log Object is locked skipped C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\config\COMPONENTS Object is locked skipped C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped C:\Windows\System32\config\DEFAULT Object is locked skipped C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped C:\Windows\System32\config\RegBack\COMPONENTS Object is locked skipped C:\Windows\System32\config\RegBack\DEFAULT Object is locked skipped C:\Windows\System32\config\RegBack\SAM Object is locked skipped C:\Windows\System32\config\RegBack\SECURITY Object is locked skipped C:\Windows\System32\config\RegBack\SOFTWARE Object is locked skipped C:\Windows\System32\config\RegBack\SYSTEM Object is locked skipped C:\Windows\System32\config\SAM Object is locked skipped C:\Windows\System32\config\SAM.LOG1 Object is locked skipped C:\Windows\System32\config\SAM.LOG2 Object is locked skipped C:\Windows\System32\config\SECURITY Object is locked skipped C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped C:\Windows\System32\config\SOFTWARE Object is locked skipped C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped C:\Windows\System32\config\SYSTEM Object is locked skipped C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Hi story\History.IE5\index.dat Object is locked skipped C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Te mporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\ Cookies\index.dat Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{e480f4a6-1bf0-11dd-855b-00a0d19c61dd}.TxR.0.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{e480f4a6-1bf0-11dd-855b-00a0d19c61dd}.TxR.1.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{e480f4a6-1bf0-11dd-855b-00a0d19c61dd}.TxR.2.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{e480f4a6-1bf0-11dd-855b-00a0d19c61dd}.TxR.blf Object is locked skipped C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\Windows\System32\Msdtc\KtmRmTm.blf Object is locked skipped C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000001 Object is locked skipped C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000002 Object is locked skipped C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped C:\Windows\System32\wbem\repository\INDEX.BTR Object is locked skipped C:\Windows\System32\wbem\repository\MAPPING1.MAP Object is locked skipped C:\Windows\System32\wbem\repository\MAPPING2.MAP Object is locked skipped C:\Windows\System32\wbem\repository\OBJECTS.DATA Object is locked skipped C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.001 Object is locked skipped C:\Windows\System32\wfp\wfpdiag.etl Object is locked skipped C:\Windows\System32\winevt\Logs\ACEEventLog.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped C:\Windows\WindowsUpdate.log Object is locked skipped D:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped F:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped Scan process completed. Last edited by jbaic : 12-May-2008 05:50 PM. |
12-May-2008, 04:55 PM
#7 | |||||
| Looks good - all normally locked system functions. Although we usually prefer folks not edit posts made, to keep spambots or others from misusing the info go ahead in your last post and click the Edit command lower right corner and remove those log lines with the gmail address. Just normal metadata info embedded in those so no value now. Then go ahead and reboot now, and we'll just make sure our earlier changes took. After the reboot, still making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK): "%userprofile%\desktop\dss.exe" /config When the DSS Configuration display opens click the "Check All" button. Next, under Main Log, again uncheck the following: System Restore Temp Cleanup Process Modules Then under Extra Log, uncheck all the boxes. Don't make any other changes at this time. Then click the "Scan!" button to start the scan. Once the scan has completed a textbox will appear - copy/paste those contents back here please (main.txt). (The logs can also be found in the C:\Deckard\System Scanner folder) |
12-May-2008, 06:01 PM
#8 | |||||
| Here is main.txt... Deckard's System Scanner v20071014.68 Run by Janet on 2008-05-12 17:57:31 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Janet.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:57:41 PM, on 12/05/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Toshiba\Power Saver\TPwrMain.exe C:\Program Files\Synaptics\SynTP\SynTPStart.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Toshiba\ConfigFree\NDSTray.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox 3 Beta 4\firefox.exe C:\Users\Janet\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Janet.exe R1 - HKCU\Software\Microsoft\Internet Explorer\ |
