1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

help removing DLLs

Discussion in 'Virus & Other Malware Removal' started by mmbc_voltron, Jul 6, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. mmbc_voltron

    mmbc_voltron Thread Starter

    Joined:
    Jul 13, 2004
    Messages:
    421
    I was hit hard by winantivirus pro. I ran active scan and SmitfraudFix.exe and still can't get rid of the dlls. any ideas?

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 12:00:17 PM, on 7/6/2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    Boot mode: Safe mode

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Owner\Desktop\Tools of the Trade\HiJackThis_v2.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\System32\aoikrwmx.dll
    O2 - BHO: (no name) - {7066E898-3923-40EC-8EAD-032B690D50CB} - (no file)
    O2 - BHO: H - {70C872E5-69F5-456f-B809-484106881B7B} - q24m.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: (no name) - {868865EC-0295-4C7D-B25D-9F65314145E9} - C:\WINDOWS\System32\iiffecd.dll
    O2 - BHO: (no name) - {a0b40993-ef21-4de5-a8bb-594ec7fc8731} - C:\WINDOWS\system32\cewwav.dll (file missing)
    O2 - BHO: (no name) - {CD5195F4-7CF0-4B81-A379-FAF892DC0A7F} - C:\WINDOWS\System32\awtst.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
    O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,[email protected]
    O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\System32\dwcwtthc.dll",realset
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F94DAFEB-98BA-47BE-80B0-2176E49D4F47}: NameServer = 10.1.10.1
    O20 - AppInit_DLLs:
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: awtst - C:\WINDOWS\System32\awtst.dll
    O20 - Winlogon Notify: cewwav - cewwav.dll (file missing)
    O20 - Winlogon Notify: iiffecd - C:\WINDOWS\SYSTEM32\iiffecd.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\System32\rubhhgmb.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: lxct_device - - C:\WINDOWS\System32\lxctcoms.exe

    --
    End of file - 4311 bytes





    Incident Status Location

    Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
    Adware:Adware/IST Not disinfected C:\Documents and Settings\Owner\Desktop\spamblockerutility.exe[SBTVSetup.exe][SBTVHelper.dll]
    Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Owner\Desktop\Tools of the Trade\SmitfraudFix\Process.exe
    Virus:Trj/KillAV.FG Disinfected C:\Program Files\Alwil Software\Avast4\DATA\moved\[UPX].vir
    Adware:Adware/WinAntivirus2006 Not disinfected C:\Program Files\Common Files\Companion Wizard\WapCHK.dll
    Potentially unwanted tool:Application/DriveCleaner Not disinfected C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
    Virus:Generic Malware Disinfected C:\Program Files\poolsv\svhost.exe
    Virus:W32/Tobecho.AB.worm Disinfected C:\Program Files\poolsv\wr-1-0000077.exe
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBClientSinkPS.dll
    Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbCoreSrv.dll
    Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbHostOE.dll
    Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbHostOL.dll
    Virus:Generic Malware Disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbInstIE.dll
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExp.dll
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExt.dll
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBSrvPS.dll
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbToolbar.dll
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBTrayAppPS.dll
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUIRes.dll
    Adware:Adware/IST Not disinfected C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUISkin.dll
    Virus:W32/Tobecho.AB.worm Disinfected C:\Program Files\svhost\wr-1-0000077.exe
    Hacktool:Rootkit/Spyforms.H Not disinfected C:\WINDOWS\new_drv.sys
    Adware:Adware/WinAntiSpyware Not disinfected C:\WINDOWS\poolsv.exe
    Virus:Generic Malware Disinfected C:\WINDOWS\svhost.exe
    Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\agugehbc.dll
    Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\aoikrwmx.dll
    Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\awtst.dll
    Virus:Trj/Downloader.PCQ Disinfected C:\WINDOWS\system32\bhfpleif.exe
    Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\bkyyomvu.dll
    Adware:Adware/WinAntivirus2006 Not disinfected C:\WINDOWS\system32\cdxvdsts.dll
    Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\dwcwtthc.dll
    Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\gmxcmppd.exe
    Virus:Trj/Lowzones.TP Disinfected C:\WINDOWS\system32\igmgalho.exe
    Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\ iiffecd.dll
    Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
    Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\rubhhgmb.exe
    Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\sagxughx.dll
    Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\uhcmvfda.exe
    Virus:Trj/Downloader.OZB Disinfected C:\WINDOWS\system32\vndtjooi.exe
    Virus:Trj/Downloader.PCQ Disinfected C:\WINDOWS\system32\ydlbxufk.exe
    Virus:Trj/Lowzones.TP Disinfected C:\WINDOWS\system32\yihvdvvw.exe
    Virus:Trj/Lowzones.TP Disinfected C:\WINDOWS\system32\yvimepah.exe
     
  2. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    If you have vundofix, remove it and get the current version

    Please download http://www.atribune.org/ccount/click.php?id=4 to C:\
    Double-click VundoFix.exe to run it.
    click the Scan for Vundo button.
    Once it's done scanning, click the Remove Vundo button.
    You will receive a prompt asking if you want to remove the files, click YES.
    Once you click yes, your desktop will go blank as it starts removing Vundo.
    When completed, it will prompt that it will shutdown your computer, click OK.
    Turn your computer back on.
    Please post the contents of C:\vundofix.txt
    Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears at reboot.

    Please let Vundo finish its thing, sometimes it can take multiple passes
    ====================
    Download Superantispyware (SAS)

    http://www.superantispyware.com/superantispywarefreevspro.html

    Install it and double-click the icon on your desktop to run it.
    · It will ask if you want to update the program definitions, click Yes.
    · Under Configuration and Preferences, click the Preferences button.
    · Click the Scanning Control tab.
    · Under Scanner Options make sure the following are checked:
    o Close browsers before scanning
    o Scan for tracking cookies
    o Terminate memory threats before quarantining.
    o Please leave the others unchecked.
    o Click the Close button to leave the control center screen.
    · On the main screen, under Scan for Harmful Software click Scan your computer.
    · On the left check C:\Fixed Drive.
    · On the right, under Complete Scan, choose Perform Complete Scan.
    · Click Next to start the scan. Please be patient while it scans your computer.
    · After the scan is complete a summary box will appear. Click OK.
    · Make sure everything in the white box has a check next to it, then click Next.
    · It will quarantine what it found and if it asks if you want to reboot, click Yes.
    · To retrieve the removal information for me please do the following:
    o After reboot, double-click the SUPERAntispyware icon on your desktop.
    o Click Preferences. Click the Statistics/Logs tab.
    o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    o It will open in your default text editor (such as Notepad/Wordpad).
    o Please highlight everything in the notepad, then right-click and choose copy.
    · Click close and close again to exit the program.
    · Please paste that information here for me with a new HijackThis log.
     
  3. mmbc_voltron

    mmbc_voltron Thread Starter

    Joined:
    Jul 13, 2004
    Messages:
    421
    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 07/06/2007 at 03:58 PM

    Application Version : 3.9.1008

    Core Rules Database Version : 3228
    Trace Rules Database Version: 1239

    Scan type : Complete Scan
    Total Scan Time : 00:17:00

    Memory items scanned : 285
    Memory threats detected : 0
    Registry items scanned : 4664
    Registry threats detected : 134
    File items scanned : 20338
    File threats detected : 2162

    Trojan.WinFixer
    HKLM\Software\Classes\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}
    HKCR\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}
    HKCR\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}\InprocServer32
    HKCR\CLSID\{153E13B4-C939-4D7A-88E9-2EE1619B7829}\InprocServer32#ThreadingModel
    C:\WINDOWS\SYSTEM32\AWTST.DLL
    HKLM\Software\Classes\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}
    HKCR\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}
    HKCR\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}\InprocServer32
    HKCR\CLSID\{4EBD643D-C5C3-4F62-ABDE-39ADA5BE578C}\InprocServer32#ThreadingModel
    C:\WINDOWS\SYSTEM32\VTSTT.DLL
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{153E13B4-C939-4D7A-88E9-2EE1619B7829}

    Adware.HotBar/SpamBlockerUtility (Low Risk)
    HKLM\Software\Classes\CLSID\{4B18DD50-C996-44fc-AC52-0FECFF82ED58}
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\Control
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\InprocServer32
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\InprocServer32#ThreadingModel
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\MiscStatus
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\MiscStatus\1
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\ProgID
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\Programmable
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\ToolboxBitmap32
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\Version
    HKCR\CLSID\{4B18DD50-C996-44FC-AC52-0FECFF82ED58}\VersionIndependentProgID
    C:\PROGRAM FILES\SPAMBLOCKERUTILITY\SBTV\SBTVHELPER.DLL
    HKLM\Software\Classes\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\InprocServer32
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\InprocServer32#ThreadingModel
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\ProgID
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\Programmable
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\TypeLib
    HKCR\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\VersionIndependentProgID
    C:\PROGRAM FILES\SPAMBLOCKERUTILITY\BIN\4.8.4.0\SBHOSTIE.DLL
    HKLM\Software\Classes\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Control
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Implemented Categories
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Implemented Categories\{00021494-0000-0000-C000-000000000046}
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\InprocServer32
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\InprocServer32#ThreadingModel
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance#CLSID
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance\InitPropertyBag
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Instance\InitPropertyBag#Url
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\MiscStatus
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\MiscStatus\1
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\ProgID
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Programmable
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\ToolboxBitmap32
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\TypeLib
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\Version
    HKCR\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}\VersionIndependentProgID
    HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
    HKU\S-1-5-21-1547161642-842925246-839522115-1003\Software\Microsoft\Internet Explorer\Explorer Bars\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\3_Shot Gun.wav
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\ASAPCom.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\Cml.exe
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\dBenderC.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\Redemption.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBClientSinkPS.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbGuard.exe
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbOEAddOn.exe
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExp.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBOLExt.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbSrv.exe
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBSrvPS.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbToolbar.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBTrayAppPS.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUIRes.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SBUISkin.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbWallpaper.dll
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0\SbWeatherOnTray.exe
    C:\Program Files\SpamBlockerUtility\Bin\4.8.4.0
    C:\Program Files\SpamBlockerUtility\Bin\SbUninst.exe
    C:\Program Files\SpamBlockerUtility\Bin
    C:\Program Files\SpamBlockerUtility\SBTV\SBTV.exe
    C:\Program Files\SpamBlockerUtility\SBTV\sbtvau.dat
    C:\Program Files\SpamBlockerUtility\SBTV\sbtv_gdf.dat
    C:\Program Files\SpamBlockerUtility\SBTV\sbtv_kyf.dat
    C:\Program Files\SpamBlockerUtility\SBTV\uninstaller.exe
    C:\Program Files\SpamBlockerUtility\SBTV
    C:\Program Files\SpamBlockerUtility
    C:\Documents and Settings\Owner\Application Data\SpamBlocker
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\eskin\empty_bg_st.htm
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\eskin\FileManager.txt
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\eskin
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\IESkins
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility.log
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility_1172962312.log
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility_1174249477.log
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\SpamBlockerUtility_1176267184.log
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOI\dynamic
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOI\static
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOI
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOL\dynamic
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOL\static
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\HostOL
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1006428.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1007113.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1009003.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1012167.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1012458.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1016578.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\dynamic\1019216.sdf
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\top7.xip
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad\tsd_bg.xip
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static\DownLoad
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility\static
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0\SpamBlockerUtility
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility\v3.0
    C:\Documents and Settings\Owner\Application Data\SpamBlockerUtility
    HKCR\SpamBlockerConfig.Application
    HKCR\SpamBlockerConfig.Application\Clsid
    HKCR\SpamBlockerConfig.Application.1
    HKCR\SpamBlockerConfig.Application.1\Clsid
    HKCR\SpamBlockerUtility.CommBand
    HKCR\SpamBlockerUtility.CommBand\CLSID
    HKCR\SpamBlockerUtility.CommBand\CurVer
    HKCR\SpamBlockerUtility.CommBand.1
    HKCR\SpamBlockerUtility.CommBand.1\CLSID
    HKCR\SpamBlockerUtility.SbMain
    HKCR\SpamBlockerUtility.SbMain\CLSID
    HKCR\SpamBlockerUtility.SbMain\CurVer
    HKCR\SpamBlockerUtility.SbMain.1
    HKCR\SpamBlockerUtility.SbMain.1\CLSID
    HKU\S-1-5-21-1547161642-842925246-839522115-1003\Software\SpamBlockerUtility
    HKLM\Software\SpamBlockerUtility
    HKLM\Software\SpamBlockerUtility\Install
    HKLM\Software\SpamBlockerUtility\Install#IE
    HKLM\Software\SpamBlockerUtility\Install#OL
    HKLM\Software\SpamBlockerUtility\Install#WT
    HKLM\Software\SpamBlockerUtility\Install#WP
    HKLM\Software\SpamBlockerUtility\Install#Install_Dir
    HKLM\Software\SpamBlockerUtility\Install#Installed_From
    HKLM\Software\SpamBlockerUtility\Install\CmpMap
    HKLM\Software\SpamBlockerUtility\Install\CmpMap#IE
    HKLM\Software\SpamBlockerUtility\Install\CmpMap#OL
    HKLM\Software\SpamBlockerUtility\Install\CmpMap#WT
    HKLM\Software\SpamBlockerUtility\Install\CmpMap#WP
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#SearchAssistant
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#Use Custom Search URL
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#StartInstall
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/affid
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/bannerid
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/directInstall
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/iid
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/instPartner
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/requestor
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#instcklm/instdata/sp2user
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#IID
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#bannerid
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#reqid
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#affid
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#cookies_flag
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#IID_prv
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#HbHostOEPath
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#PrevVer
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#CurrentVer
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#FreeWeather
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#CreateDate
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Install#CreateDateDW
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\MachineInfo
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\MachineInfo#CID
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\MachineInfo#CID_prv
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Mail
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Mail#business_card_promo
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Mail#promo_file
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\PI
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\PI\3.2
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\PI\3.2#PID00
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Updates
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Updates#InstallDate
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Upgrade
    HKLM\Software\SpamBlockerUtility\SpamBlockerUtility\Upgrade#LastChecked
    HKLM\Software\Spam Blocker
    HKLM\Software\Spam Blocker#BuyNow
    HKLM\Software\Spam Blocker#State
    HKLM\Software\Spam Blocker#First start
    HKLM\Software\Spam Blocker\ASAP
    HKLM\Software\Spam Blocker\ASAP#ServerAddress
    HKLM\Software\Spam Blocker\ASAP#Hash
    HKLM\Software\Spam Blocker\ASAP#URI
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools#DisplayIcon
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerOutlookTools#UninstallString
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools#DisplayIcon
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpamBlockerWebTools#UninstallString
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001307.DLL
    C:\WINDOWS\Prefetch\SBTV.EXE-0F0EE786.pf

    Adware.Tracking Cookie
    C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
    C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
    C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
    C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
    C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
    C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
    C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
    C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
    C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt

    Trojan.WinAntiSpyware/WinAntiVirus 2006
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001132.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001142.EXE

    Trojan.WinAntiSpyware/WinAntiVirus 2006/2007
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001141.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001151.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001180.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001181.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001189.EXE

    Trojan.Downloader-DriverA
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001196.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001197.EXE

    Trojan.Downloader-SpyTool
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001198.DLL
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001199.DLL
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP2\A0001200.DLL
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{40225FC9-18D9-42E5-B254-59F20619172C}\RP3\A0001469.DLL
    C:\VUNDOFIX BACKUPS\CDXVDSTS.DLL.BAD

    Trace.Known Threat Sources
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2DQHGTM9\styles[1].css
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6BCVC5MF\WinAntiVirusPro2007FreeInstall[1].exe
     
  4. mmbc_voltron

    mmbc_voltron Thread Starter

    Joined:
    Jul 13, 2004
    Messages:
    421
    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 4:17:24 PM, on 7/6/2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\lxctcoms.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Documents and Settings\Owner\Desktop\Tools of the Trade\HiJackThis_v2.exe

    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {7066E898-3923-40EC-8EAD-032B690D50CB} - (no file)
    O2 - BHO: H - {70C872E5-69F5-456f-B809-484106881B7B} - q24m.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: (no name) - {a0b40993-ef21-4de5-a8bb-594ec7fc8731} - C:\WINDOWS\system32\cewwav.dll (file missing)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
    O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,[email protected]
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F94DAFEB-98BA-47BE-80B0-2176E49D4F47}: NameServer = 10.1.10.1
    O20 - AppInit_DLLs:
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: cewwav - cewwav.dll (file missing)
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\System32\rubhhgmb.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: lxct_device - - C:\WINDOWS\System32\lxctcoms.exe

    --
    End of file - 4420 bytes
     
  5. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    You may want to print this or save it to notepad as we will go to safe mode.

    Fix these with HiJackThis – mark them, close IE, click fix checked

    O2 - BHO: (no name) - {7066E898-3923-40EC-8EAD-032B690D50CB} - (no file)

    O2 - BHO: H - {70C872E5-69F5-456f-B809-484106881B7B} - q24m.dll (file missing)

    O2 - BHO: (no name) - {a0b40993-ef21-4de5-a8bb-594ec7fc8731} - C:\WINDOWS\system32\cewwav.dll (file missing)

    O20 - AppInit_DLLs:

    O20 - Winlogon Notify: cewwav - cewwav.dll (file missing)

    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\System32\rubhhgmb.exe (file missing)
    ==============
    Click Start > Run > and type in:

    services.msc

    Click OK.

    In the services window find this exact name

    DomainService

    Rightclick and choose "Properties". Beside "Startup Type" in the dropdown menu select "Disabled". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Click Apply then OK. File-Exit the Services utility.

    =========
    DownLoad Killbox from one of these links

    http://www.downloads.subratam.org/KillBox.zip or
    http://www.thespykiller.co.uk/files/killbox.exe

    Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

    Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.



    Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

    START – RUN – type in %temp% - OK - Edit – Select all – File – Delete

    Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

    Not all temp files will delete and that is normal
    Empty the recycle bin
    Boot

    Click on http://noahdfear.geekstogo.com/FindAWF.exe to download FindAWF.exe and save it to your desktop.
    · Double-click on the FindAWF.exe file to run it.
    · It will open a command prompt and ask you to "Press any key to continue".
    · Press any key and the FindAWF tool will begin scanning your computer for the infected AWF files and the backups the trojan created.
    · It may take a few minutes to complete so be patient.
    · When it is complete, it will open a text file in notepad called AWF.txt which will automatically be saved to your desktop or whatever location you ran the file from.
    · Come back here to this thread and copy and paste the contents of the AWF.txt file in your next reply.


    Please give feedback on what worked/didn’t work and the current status of your system
     
  6. mmbc_voltron

    mmbc_voltron Thread Starter

    Joined:
    Jul 13, 2004
    Messages:
    421
    What file do I delete with Killbox?
     
  7. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    None, I meant to delete that portion

    Click on http://noahdfear.geekstogo.com/FindAWF.exe to download FindAWF.exe and save it to your desktop.
    · Double-click on the FindAWF.exe file to run it.
    · It will open a command prompt and ask you to "Press any key to continue".
    · Press any key and the FindAWF tool will begin scanning your computer for the infected AWF files and the backups the trojan created.
    · It may take a few minutes to complete so be patient.
    · When it is complete, it will open a text file in notepad called AWF.txt which will automatically be saved to your desktop or whatever location you ran the file from.
    · Come back here to this thread and copy and paste the contents of the AWF.txt file in your next reply.
     
  8. mmbc_voltron

    mmbc_voltron Thread Starter

    Joined:
    Jul 13, 2004
    Messages:
    421
    This is option 1

    Find AWF report by noahdfear ©2006


    bak folders found
    ~~~~~~~~~~~


    Directory of C:\PROGRA~1\ITUNES\BAK

    02/23/2006 03:45 PM 278,528 iTunesHelper.exe
    1 File(s) 278,528 bytes

    Directory of C:\PROGRA~1\MESSEN~1\BAK

    0 File(s) 0 bytes

    Directory of C:\PROGRA~1\QUICKT~1\BAK

    08/25/2006 08:58 PM 155,648 qttask.exe
    1 File(s) 155,648 bytes

    Directory of C:\WINDOWS\SYSTEM32\BAK

    07/16/2003 01:26 PM 13,312 ctfmon.exe
    04/07/2003 12:07 AM 114,688 hkcmd.exe
    04/07/2003 12:19 AM 155,648 igfxtray.exe
    07/09/2001 11:50 AM 155,648 NeroCheck.exe
    4 File(s) 439,296 bytes

    Directory of C:\PROGRA~1\ALWILS~1\AVAST4\BAK

    05/31/2006 03:02 AM 108,160 ashDisp.exe
    1 File(s) 108,160 bytes

    Directory of C:\PROGRA~1\ANALOG~1\CORE\BAK

    10/14/2004 02:42 PM 1,404,928 smax4pnp.exe
    1 File(s) 1,404,928 bytes

    Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK

    10/07/2006 05:20 AM 6,266,880 avgas.exe
    1 File(s) 6,266,880 bytes

    Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK

    07/26/2006 04:03 AM 49,263 jusched.exe
    1 File(s) 49,263 bytes


    Duplicate files of bak directory contents
    ~~~~~~~~~~~~~~~~~~~~~~~

    257088 Apr 27 2007 "C:\Program Files\iTunes\iTunesHelper.exe"
    278528 Feb 23 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
    102400 May 7 2007 "C:\WINDOWS\Installer\{3592F5CB-B524-43AA-92F2-2377268199CC}\iTunesIco.exe"
    116288 Apr 27 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.1.5\iTunesSetupAdmin.exe"
    282624 Apr 27 2007 "C:\Program Files\QuickTime\qttask.exe"
    155648 Aug 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
    13312 Jul 16 2003 "C:\WINDOWS\system32\ctfmon.exe"
    13312 Jul 16 2003 "C:\WINDOWS\system32\bak\ctfmon.exe"
    114688 Apr 7 2003 "C:\WINDOWS\system32\bak\hkcmd.exe"
    114688 Apr 7 2003 "C:\DELL\drivers\video\Graphics\Win2000\hkcmd.exe"
    114688 Apr 7 2003 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\hkcmd.exe"
    155648 Apr 7 2003 "C:\WINDOWS\system32\bak\igfxtray.exe"
    155648 Apr 7 2003 "C:\DELL\drivers\video\Graphics\Win2000\igfxtray.exe"
    155648 Apr 7 2003 "C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\igfxtray.exe"
    155648 Jul 9 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
    108160 Jan 15 2007 "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
    108160 May 31 2006 "C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe"
    1404928 Oct 14 2004 "C:\Program Files\Analog Devices\Core\bak\smax4pnp.exe"
    1404928 Oct 14 2004 "C:\DELL\drivers\sound\SMAXWDM\W2K_XP\SMax4PNP.exe"
    6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe"
    6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe"
    49263 Jul 26 2006 "C:\Program Files\Java\jre1.5.0_08\bin\bak\jusched.exe"


    end of report
     
  9. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    How are things now?
     
  10. mmbc_voltron

    mmbc_voltron Thread Starter

    Joined:
    Jul 13, 2004
    Messages:
    421
    they are much better.
    I had to remove winantivirus from the add and remove programs

    thanks for your help
     
  11. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/592526

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice