Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
09-May-2008, 12:56 PM
#1 | |||||
| Trouble with random window pop ups Hi, I've been having trouble with random windows popping up & slow or no loading windows. I ran a Malwarebytes scan a few days ago & I quarantined what they showed. Well it's acting up again, only this time I'm afraid to delete something I should have, because when I quarantined things the last time my antivirus program wasn't running properly. I ran both a HJT & Malwarebytes scan. Below is the part 1 of the Malwarebytes scan. It won't let me add all the text on here. I will post the HJT scan on a new 3rd thread. (sorry) Thanks in advance for looking. Iciesangel Malwarebytes' Anti-Malware 1.11 Database version: 720 Scan type: Full Scan (C:\|) Objects scanned: 291243 Time elapsed: 3 hour(s), 3 minute(s), 23 second(s) Memory Processes Infected: 1 Memory Modules Infected: 7 Registry Keys Infected: 159 Registry Values Infected: 9 Registry Data Items Infected: 0 Folders Infected: 26 Files Infected: 173 Memory Processes Infected: C:\Program Files\MyWebSearch\bar\c.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> No action taken. Memory Modules Infected: C:\WINDOWS\system32\khfFYSiF.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\lntouwul.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\efcBsTKE.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\hgGxUlmL.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\fcccyArO.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\khfFUMDs.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\khfGawVP.dll (Trojan.Vundo) -> No action taken. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{33625135-d62d-4985-a000-6f850906c65e} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{33625135-d62d-4985-a000-6f850906c65e} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{07b18ea3-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{b813095c-81c0-4e40-aa14-67520372b987} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.datacontrol (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{a9571378-68a1-443d-b082-284f960c6d17} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{d778513b-1c40-4819-b0c5-49e40b39afd0} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApprove d\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{2763e333-b168-41a0-a112-d35f96f410c0} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{621feacd-8857-43a6-ae26-451d670d5370} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus (Rogue.Antivirus2008) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{3713f9ee-c059-4540-b697-987ef263a088} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efcbstke (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWe bSearch bar Uninstall (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.Out lookAddin (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.Outloo kAddin (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\Software\Fun Web Products (Adware.MyWebSearch) -> No action taken. |
| |
09-May-2008, 12:59 PM
#2 | |||||
| Malwarebytes log cont. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Email Plugin (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyWebSearc h Email Plugin (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My Web Search Bar Search Scope Monitor (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM4fc18a60 (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell ExecuteHooks\{3713f9ee-c059-4540-b697-987ef263a088} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> No action taken. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\2.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\9.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Message (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Search (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\SrchAstt\11.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\SrchAstt\4.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Installr (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\PopSwatr (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Installr\2.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\PopSwatr\History (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> No action taken. Files Infected: C:\WINDOWS\system32\khfFYSiF.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\FiSYFfhk.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\FiSYFfhk.ini2 (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\lntouwul.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\luwuotnl.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\yayyXNEv.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\vENXyyay.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\vENXyyay.ini2 (Trojan.Vundo) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\SrchAstt\11.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\MWSBAR.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3SHLLVW.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3HTML.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3SKIN.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3BROVLY.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3MSG.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Installr\2.bin\F3EZSETP.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\Internet Explorer\msimg32.dll (Adware.MyWebSearch) -> No action taken. C:\Program Files\MSN Messenger\msimg32.dll (Adware.MyWebSearch) -> No action taken. C:\Program Files\MSN Messenger\riched20.dll (Adware.MyWeb.FunWeb) -> No action taken. C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL.vir (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\9.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\9.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3IMSTUB.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3REPROX.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3RESTUB.DLL (Adware.MyWeb.FunWeb) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3SCHMON.EXE (Adware.MyWeb.FunWeb) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3IDLE.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> No action taken. C:\System Volume Information\_restore{BABF27AF-98B1-46AD-8AEE-3507E0DEE2FA}\RP609\A0271909.dll (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{BABF27AF-98B1-46AD-8AEE-3507E0DEE2FA}\RP613\A0274026.dll (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{BABF27AF-98B1-46AD-8AEE-3507E0DEE2FA}\RP613\A0274028.dll (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{BABF27AF-98B1-46AD-8AEE-3507E0DEE2FA}\RP613\A0274029.dll (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{BABF27AF-98B1-46AD-8AEE-3507E0DEE2FA}\RP613\A0274030.vxd (Adware.Winad) -> No action taken. C:\WINDOWS\system32\byXPJAqn.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3SPACER.WMV (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3FFXTBR.JAR (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3FFXTBR.MANIFEST (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3NTSTBR.JAR (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3NTSTBR.MANIFEST (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\c.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0008484C (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\000C4F5E (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\001562F9 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\002A31B2.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\002A33A6.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\002A377E.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\00317E3A.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\006E3002.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\006E31C7.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\006E32C1.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\006E338C.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0088F893.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0088F99C.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0088FB42.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\00B2A1FB.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\00B2A3EF.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\00B2A611.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\00B2A74A.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\00B2A91F.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\00BCCC27 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\01228961 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\018840FE (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\019E4623 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\022ABD8C.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0283269B (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\02A3433F.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\02AEAE58.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\03293D48 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0347DC36 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\05049F38 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0567D700 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\05B800F9.bin (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\0778D3F5 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\History\search (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\array.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\bottom.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\common.css (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\common.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\connect.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\editcmn.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\emailcmn.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\emlauth.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\enot_dog.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\htmlutil.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\index.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\inet.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\mmn_logo.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\pbuttond.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\pbuttonu.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\properts.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\rside.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\setup.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\spacer.swf (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\splash.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\splash.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\string.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\tab1.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\tab2.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\tab3.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\COMMON\types.js (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\clip_1.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\clip_2.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\corner.gif (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\demo.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\index.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\mailbx_1.swf (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\mailbx_2.swf (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\mailbx_e.swf (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX\mailbx_i.swf (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Search\COMMON.F3S (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\setting2.htm.bak (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\settings.dat.bak (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\settings.htm (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken. C:\Program Files\MyWebSearch\SrchAstt\4.bin\MWSSRCAS.DLL.vir (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\PopSwatr\History\allowed (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\PopSwatr\History\notallow (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\ScreenSaver\Images\01D3A6B0.urr (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn-new.html (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html (Adware.MyWebSearch) -> No action taken. C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html (Adware.MyWebSearch) -> No action taken. C:\WINDOWS\system32\tfdqrjxv.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\efcBsTKE.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\hgGxUlmL.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\fcccyArO.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\khfFUMDs.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\khfGawVP.dll (Trojan.Vundo) -> No action taken. |
09-May-2008, 01:00 PM
#3 | |||||
| HJT log (sorry so long) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:40:47 PM, on 5/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Verizon\Verizon Internet Security Suite\Fws.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\zHotkey.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\PROGRA~1\MYWEBS~2\bar\c.bin\m3SrchMn.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Verizon\VSP\VerizonServicepoint.exe C:\Program Files\Verizon\Verizon Internet Security Suite\Rps.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\BigFix\BigFix.exe C:\Program Files\Ocucom\PreCast\tmon.exe C:\Program Files\Desktop Alert\desktopalert_1874163.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe C:\Program Files\Raxco\PerfectDisk\PDAgent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Raxco\PerfectDisk\PDEngine.exe C:\WINDOWS\security\explorer.exe C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\FraudEliminator\2.4.0\FraudEliminator Helper.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\11.bin\MWSSRCAS.DLL N2 - Netscape 6: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\USER 1\Application Data\Mozilla\Profiles\default\kxlmcknu.slt\prefs.js) O3 - Toolbar: FraudEliminator - {A5181F8A-0B9D-43AC-8BE5-EB61651DB685} - C:\Program Files\FraudEliminator\2.4.0\FETB.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\c.bin\MWSBAR.DLL O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [CHotkey] zHotkey.exe O4 - HKLM\..\Run: [showicon2k] "C:\Program Files\\eM\Bay Reader\Shwicon2k.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~2\bar\c.bin\m3SrchMn.exe" /m=0 O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~2\bar\c.bin\mwsoemon.exe O4 - HKLM\..\Run: [ImInstaller_IncrediMail] C:\DOCUME~1\USER1~1\LOCALS~1\Temp\ImInstaller\IncrediMail\incredimail_insta ll.exe -startup -product IncrediMail O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN O4 - HKLM\..\Run: [Verizon Internet Security Suite] "C:\Program Files\Verizon\Verizon Internet Security Suite\Rps.exe" O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Verizon\Verizon Internet Security Suite\ZkRunOnceR.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [4cf2b9fc] rundll32.exe "C:\WINDOWS\system32\lntouwul.dll",b O4 - HKLM\..\Run: [BM4fc18a60] Rundll32.exe "C:\WINDOWS\system32\tfdqrjxv.dll",s O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Verizon\Verizon Internet Security Suite\IdxClnR.exe" O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c O4 - HKCU\..\Run: [SFP] "C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.EXE" /s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~2\bar\c.bin\mwsoemon.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Desktop Alert.lnk = C:\Program Files\Desktop Alert\desktopalert_1874163.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Startup: WKCALREM.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: APC UPS Status.lnk = ? O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O4 - Global Startup: PreCast Monitor.lnk = C:\Program Files\Ocucom\PreCast\tmon.exe O4 - Global Startup: Verizon Online Dialer.lnk = C:\Program Files\Common Files\Verizon Online\ConnMgr\Verizon Online.exe O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZNfox000 O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} - http://survey.otxresearch.com/Preloader.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47...amesLoader.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab O16 - DPF: {21BB8360-F943-447E-98F3-3C22345375A7} (CPlayFirstChocolatierControl Object) - http://games.bigfishgames.com/en_cho...b.1.0.0.13.cab O16 - DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} (CPlayFirstmsiControl Object) - http://aolsvc.aol.com/onlinegames/fr...eb.1.0.0.8.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/def...x.1.0.0.67.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {38A5F6F0-0B64-421B-A553-3D49A76ECDCD} (CPlayFirstMythicMarblesControl Object) - http://games.bigfishgames.com/en_myt...es.1.0.0.2.cab O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} - http://zone.msn.com/bingame/pacz/def...andaonline.cab O16 - DPF: {4773AC35-5EC9-4C86-82AA-78F3BE563194} (AtlBoxWordCtlAttrib Class) - http://playgames.comcast.net/online2...e/aquacade.cab O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} - http://www.otxresearch.com/OTXMedia/OTXMedia.dll O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/din...2.1.0.0.53.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136571703812 O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://aolsvc.aol.com/onlinegames/fr...ouseplayer.cab O16 - DPF: {775879E2-7309-4619-BB02-AADE41F4B690} (CPlayFirstdreamControl Object) - http://games.bigfishgames.com/en_dre...eb.1.0.0.9.cab O16 - DPF: {7BB30A04-A6AC-480C-BB18-5A18D79F4455} (GenimoWebGames Control) - http://games.bigfishgames.com/en_but...mesControl.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://verizon.oberon-media.com/onli...jolauncher.cab O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {8FA2192F-B95D-40E3-898F-8D7ABB8E00D0} (SpinTop Games Launcher) - http://download-games.pogo.com/onlin...esLauncher.cab O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installengine.com/engine/isetup.cab O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} (Cubis Control) - http://www.worldwinner.com/games/v57/cubis/cubis.cab O16 - DPF: {988E213A-89C7-4C4E-B15F-5B7EDA2C34C0} (GenimoWebGames Control) - http://www.shockwave.com/content/but...mesControl.cab O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframewor...r.cab31267.cab O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yaho...ymmapi_416.dll O16 - DPF: {A219C6A1-B503-42A9-95DC-A84B2CC1231F} (AtlAsianataCtlAttrib Class) - http://playgames.comcast.net/online2...a/asianata.cab O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) - http://www.worldwinner.com/games/v49/luxor/luxor.cab O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinner.com/games/v67/swapit/swapit.cab O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://games.bigfishgames.com/en_bur...sPlayer_v4.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} (Tilecity Control) - http://www.worldwinner.com/games/v42...y/tilecity.cab O16 - DPF: {BAC761D3-DFFD-4DB4-A01D-173346E090A7} (CPlayFirstzenerchiControl Object) - http://games.bigfishgames.com/en_zen...b.1.0.0.10.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/fr...ylomplayer.cab O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {D410AFBD-4E26-4D5F-840F-0412D6F6BB8D} (CPlayFirstSandScriptControl Object) - http://www.shockwave.com/content/san...t.1.0.0.21.cab O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/fee...utLauncher.cab O16 - DPF: {DBA8E419-0D5F-439B-A3CC-D01C768D9B51} (DVCDownloaderControl Object) - http://atlantis9.bigfishgames.com/Re...derControl.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://games.pogo.com/online2/pogo/m...meLauncher.cab O16 - DPF: {FC4CAF5F-91BD-4DD9-ADC1-F3C737E37BC4} (CPlayFirstSweetopiaControl Object) - http://zone.msn.com/bingame/swet/def...a.1.0.0.46.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E0DC90D-C1C0-431D-8BB2-49E0C50F30AF}: NameServer = 71.252.0.12 71.242.0.12 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe (file missing) O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe O23 - Service: DirectX Service (Gafav) - Unknown owner - C:\WINDOWS\system32\directx.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: Verizon Internet Security Suite (Radialpoint Security Services) - Radialpoint Inc. - C:\Program Files\Verizon\Verizon Internet Security Suite\RpsSecurityAware.exe O23 - Service: Verizon Internet Security Suite Update Service (RPSUpdaterR) - Verizon - C:\Program Files\Verizon\Verizon Internet Security Suite\rpsupdaterR.exe O23 - Service: Verizon Internet Security Suite Firewall (RP_FWS) - Verizon - C:\Program Files\Verizon\Verizon Internet Security Suite\Fws.exe -- End of file - 16208 bytes |
10-May-2008, 09:07 AM
#4 | ||||||
| Welcome to TSG  Go ahead and click on the Remove Selected Tab to let MalwareBytes remove the infection. If asked to reboot, please do. Then post a fresh Hijackthis log. Thanks |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 03:12 AM. Copyright © 1996 - 2008 TechGuy, Inc. All rights reserved. Powered by vBulletin, Copyright © 2000 - 2008, Jelsoft Enterprises Ltd. Search Engine Optimization by vBSEO 3.1.0 |  |
