| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 56426 | 2005-04-04 10:45:00 | Please Help, this spyware is relentless!!! | MasturJeff (7803) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 341669 | 2005-04-05 09:11:00 | The next step id to boot to a command prompt and type: format c: I been kinda keeping an eye on this post I think a good option would be to do what pctek said but add /y after it (e.g. format c: /y) As far as backing up by ghosting, forget it, as you will end up ghosting the same problem you currently have. Just back up your programmes, apps, docs etc by saving to disc Full commendation to Speedy for your patience :D |
Myth (110) | ||
| 341670 | 2005-04-05 09:18:00 | ta :D Umm, you cant really back up programs, (if theyre already installed),expecting to copy them to the same hdd later (if u format) to work later coz they wont work. XP doesnt work that way. Copying douments, small things ie: email addresses, favourites in the browser...are OK. BUT not programs after they've been installed. If u still have the original exe files sure, thats not a prob. |
Speedy Gonzales (78) | ||
| 341671 | 2005-04-05 09:21:00 | ta :D Umm, you cant really back up programs, (if theyre already installed),expecting to copy them to the same hdd later (if u format) to work later coz they wont work . XP doesnt work that way . Copying douments, small things ie: email addresses, favourites in the browser . . . are OK . BUT not programs after they've been installed . If u still have the original exe files sure, thats not a prob . Speedy, i'm going to run another l2mfix log, followed by another hijackthis . . . do you mind examining it yet again? :p |
MasturJeff (7803) | ||
| 341672 | 2005-04-05 09:22:00 | i'm running PC TOOL's Registry Mechanic, to see if I can find anything. BTW: Speedy would you happen to have like an instant messenger program or something we can continously talk on? |
MasturJeff (7803) | ||
| 341673 | 2005-04-05 09:23:00 | Go for it Jeff. You've got till 8.30 before i go to bed lol | Speedy Gonzales (78) | ||
| 341674 | 2005-04-05 09:25:00 | i'm running PC TOOL's Registry Mechanic, to see if I can find anything. BTW: Speedy would you happen to have like an instant messenger program or something we can continously talk on? I HAD MSN messenger. I'll get it again tomorrow. I'll pm u the email so I can add u.. |
Speedy Gonzales (78) | ||
| 341675 | 2005-04-05 09:28:00 | Go for it Jeff. You've got till 8.30 before i go to bed lol Is that 8:30 AM eastern time? it's 4:23 AM eastern time where I'm at. :@@: |
MasturJeff (7803) | ||
| 341676 | 2005-04-05 09:29:00 | here's the hijack log Logfile of HijackThis v1 . 99 . 1 Scan saved at 4:19:53 AM, on 4/5/2005 Platform: Windows XP SP2 (WinNT 5 . 01 . 2600) MSIE: Internet Explorer v6 . 00 SP2 (6 . 00 . 2900 . 2180) Running processes: C:\WINDOWS\System32\smss . exe C:\WINDOWS\system32\winlogon . exe C:\WINDOWS\system32\services . exe C:\WINDOWS\system32\lsass . exe C:\WINDOWS\system32\svchost . exe C:\WINDOWS\System32\svchost . exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr . exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr . exe C:\WINDOWS\system32\spoolsv . exe C:\WINDOWS\Explorer . EXE C:\WINDOWS\system32\rundll32 . exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr . exe C:\PROGRA~1\mcafee . com\vso\mcvsshld . exe C:\PROGRA~1\mcafee . com\agent\mcagent . exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc . exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent . exe c:\progra~1\mcafee . com\vso\mcvsescn . exe C:\PROGRA~1\McAfee . com\Agent\mcupdmgr . exe C:\Program Files\Logitech\MouseWare\system\em_exec . exe c:\PROGRA~1\mcafee . com\vso\mcvsrte . exe C:\WINDOWS\SYSTEM\DRIVER\ntuser . exe C:\WINDOWS\System32\nvsvc32 . exe C:\WINDOWS\System32\svchost . exe C:\WINDOWS\wanmpsvc . exe C:\WINDOWS\system32\svchost . exe C:\Program Files\Stardock\ObjectDock\ObjectDock . exe c:\PROGRA~1\mcafee . com\vso\mcshield . exe C:\WINDOWS\System32\svchost . exe C:\WINDOWS\system32\NOTEPAD . EXE C:\Documents and Settings\Owner\My Documents\Install Programs\Zip Files\hijackthis\HijackThis . exe R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O4 - HKLM\ . . \Run: [NvCplDaemon] RUNDLL32 . EXE C:\WINDOWS\System32\NvCpl . dll,NvStartup O4 - HKLM\ . . \Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck . exe O4 - HKLM\ . . \Run: [Logitech Utility] Logi_MwX . Exe O4 - HKLM\ . . \Run: [VSOCheckTask] "c:\PROGRA~1\mcafee . com\vso\mcmnhdlr . exe" /checktask O4 - HKLM\ . . \Run: [VirusScan Online] "c:\PROGRA~1\mcafee . com\vso\mcvsshld . exe" O4 - HKLM\ . . \Run: [MCAgentExe] c:\PROGRA~1\mcafee . com\agent\mcagent . exe O4 - HKLM\ . . \Run: [MCUpdateExe] C:\PROGRA~1\mcafee . com\agent\McUpdate . exe O4 - HKLM\ . . \Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent . exe O4 - HKLM\ . . \Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct . exe /startup O4 - HKLM\ . . \Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ . exe" O4 - HKLM\ . . \Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan . exe O4 - HKLM\ . . \Run: [second] C:\Documents and Settings\Owner\Desktop\l2mfix\second . bat O4 - HKCU\ . . \Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent . exe O4 - Startup: Stardock ObjectDock . lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock . exe O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb . dll O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - . g . akamai . net/7/840/537/2004061001/housecall . trendmicro . com/housecall/xscan53 . cab" target="_blank">a840 . g . akamai . net O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s . r . o . - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr . exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s . r . o . - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc . exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr . exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc . exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr . exe O23 - Service: McAfee . com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee . com\vso\mcshield . exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr . exe) - McAfee, Inc - C:\PROGRA~1\McAfee . com\Agent\mcupdmgr . exe O23 - Service: McAfee . com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee . com\vso\mcvsrte . exe O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc . exe (file missing) O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc . - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr . exe O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntuser . exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32 . exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12 . exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ . exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc . exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc . - C:\WINDOWS\wanmpsvc . exe Going to post the other log in 60 seconds |
MasturJeff (7803) | ||
| 341677 | 2005-04-05 09:31:00 | here's the log from the L2MFIX program. L2MFIX find log 1.03 These are the registry keys present ************************************************** ******************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] ************************************************** ******************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform] "{011C8C30-CFF9-986F-018A-F6F560BA8614}"="" ************************************************** ******************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}"="SampleView" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1" "{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter" "{1E2CDF40-419B-11D2-A5A1-002018648BA7}"="AVG Shell Extension" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{6E3C607A-B99C-4FA8-98F5-1AC1ADF7F5B9}"="MediaFace extension" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension" "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{415103ED-C662-4A6E-8E32-EF9F69C3898B}"="" "{52B87208-9CCF-42C9-B88E-069281105805}"="Trojan Remover Shell Extension" ************************************************** ******************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{415103ED-C662-4A6E-8E32-EF9F69C3898B}] @="" [HKEY_CLASSES_ROOT\CLSID\{415103ED-C662-4A6E-8E32-EF9F69C3898B}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{415103ED-C662-4A6E-8E32-EF9F69C3898B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{415103ED-C662-4A6E-8E32-EF9F69C3898B}\InprocServer32] @="C:\\WINDOWS\\system32\\rQsdlg.dll" "ThreadingModel"="Apartment" ************************************************** ******************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ browseui.dll Thu Jan 27 2005 1:13:16p A.... 1,016,832 993.00 K cdfview.dll Thu Jan 27 2005 1:13:16p A.... 151,040 147.50 K gccoll~1.dll Thu Feb 10 2005 10:32:20p A.... 119,520 116.72 K gcmd5q~1.dll Sun Apr 3 2005 9:16:56p A.... 10,752 10.50 K gcunco~1.dll Thu Feb 10 2005 10:32:20p A.... 130,272 127.22 K gwfspi~1.dll Fri Jan 28 2005 3:37:58p A.... 23,304 22.76 K hashlib.dll Thu Feb 10 2005 10:32:18p A.... 81,120 79.22 K hwtpapi.dll Mon Apr 4 2005 9:54:02p ..S.R 234,049 228.56 K iepeers.dll Thu Jan 27 2005 1:13:16p A.... 249,856 244.00 K inseng.dll Thu Jan 27 2005 1:13:16p A.... 96,256 94.00 K j0l4la~1.dll Mon Apr 4 2005 4:55:48a ..S.R 234,678 229.18 K j0p00a~1.dll Tue Apr 5 2005 12:21:12a ..S.R 234,119 228.63 K jtp607~1.dll Tue Apr 5 2005 12:10:50a ..S.R 233,248 227.78 K micr0st.dll Sun Feb 27 2005 8:13:28p A.... 4 0.00 K mshtml.dll Thu Jan 27 2005 1:13:18p A.... 3,006,976 2.87 M ole32.dll Fri Jan 14 2005 4:55:50a A.... 1,285,120 1.22 M olecli32.dll Fri Jan 14 2005 4:55:50a A.... 74,752 73.00 K olecnv32.dll Fri Jan 14 2005 4:55:50a A.... 37,888 37.00 K p28q0c~1.dll Mon Apr 4 2005 4:45:10a ..S.R 233,248 227.78 K pndx5016.dll Sun Feb 27 2005 5:21:56a A.... 6,656 6.50 K pndx5032.dll Sun Feb 27 2005 5:21:56a A.... 5,632 5.50 K rmoc3260.dll Sun Feb 27 2005 5:22:18a A.... 176,167 172.04 K rpcss.dll Fri Jan 14 2005 4:55:50a A.... 395,776 386.50 K rqsdlg.dll Tue Apr 5 2005 12:21:12a ..S.R 234,049 228.56 K shdocvw.dll Thu Jan 27 2005 1:13:18p A.... 1,483,264 1.41 M shlwapi.dll Thu Jan 27 2005 1:13:18p A.... 473,600 462.50 K udrdpa.dll Tue Apr 5 2005 4:06:34a ..S.R 234,049 228.56 K urlmon.dll Thu Jan 27 2005 1:13:18p A.... 607,744 593.50 K wininet.dll Thu Jan 27 2005 1:13:18p A.... 656,896 641.50 K 29 items found: 29 files (7 H/S), 0 directories. Total of file sizes: 11,726,867 bytes 11.18 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ guard.tmp Tue Apr 5 2005 4:04:14a ..S.R 234,049 228.56 K trj_nt~1.tmp Tue Apr 5 2005 4:08:48a A.... 1,688 1.65 K 2 items found: 2 files (1 H/S), 0 directories. Total of file sizes: 235,737 bytes 230.21 K ************************************************** ******************************** Directory Listing of system files: Volume in drive C is PRESARIO Volume Serial Number is C052-63FF Directory of C:\WINDOWS\System32 04/05/2005 04:06 AM 234,049 udrdpa.dll 04/05/2005 04:04 AM 234,049 guard.tmp 04/05/2005 12:21 AM 234,049 rQsdlg.dll 04/05/2005 12:21 AM 234,119 j0p00a7med.dll 04/05/2005 12:10 AM 233,248 jtp6077se.dll 04/04/2005 09:54 PM 234,049 hwtpapi.dll 04/04/2005 04:55 AM 234,678 j0l4la3q1d.dll 04/04/2005 04:45 AM 233,248 p28q0cl5efq.dll 04/04/2005 03:29 AM 10,022 KGyGaAvL.sys 03/13/2005 04:04 AM <DIR> dllcache 04/12/2004 05:24 AM <DIR> Microsoft 03/19/2003 01:17 PM 32 {B12F4FE3-893D-4750-9C34-320B34E138BF}.dat 10 File(s) 1,881,543 bytes 2 Dir(s) 39,292,653,568 bytes free |
MasturJeff (7803) | ||
| 341678 | 2005-04-05 09:48:00 | 8 . 30 pm NZ time . (now 8 . 39 pm) . Try this do a scan (if trojan remover didnt do anything) . . paretologic . com/xoftspy/" target="_blank">www . paretologic . com It isnt free but see if it detects any nasties anyway . Altho u may not be able to delete it . BUT at least u may know what the nasty files are . These still look a bit suss O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb . dll O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntuser . exe (Leave this entry for now) [HKEY_CLASSES_ROOT\CLSID\{415103ED-C662-4A6E-8E32-EF9F69C3898B}\InprocServer32] @="C:\\WINDOWS\\system32\\rQsdlg . dll" "ThreadingModel"="Apartment" gccoll~1 . dll Thu Feb 10 2005 10:32:20p A . . . . 119,520 116 . 72 K gcmd5q~1 . dll Sun Apr 3 2005 9:16:56p A . . . . 10,752 10 . 50 K gcunco~1 . dll Thu Feb 10 2005 10:32:20p A . . . . 130,272 127 . 22 K gwfspi~1 . dll Fri Jan 28 2005 3:37:58p A . . . . 23,304 22 . 76 K hashlib . dll Thu Feb 10 2005 10:32:18p A . . . . 81,120 79 . 22 K hwtpapi . dll Mon Apr 4 2005 9:54:02p . . S . R 234,049 228 . 56 K j0l4la~1 . dll Mon Apr 4 2005 4:55:48a . . S . R 234,678 229 . 18 K j0p00a~1 . dll Tue Apr 5 2005 12:21:12a . . S . R 234,119 228 . 63 K jtp607~1 . dll Tue Apr 5 2005 12:10:50a . . S . R 233,248 227 . 78 K micr0st . dll Sun Feb 27 2005 8:13:28p A . . . . 4 0 . 00 K p28q0c~1 . dll Mon Apr 4 2005 4:45:10a . . S . R 233,248 227 . 78 K pndx5016 . dll Sun Feb 27 2005 5:21:56a A . . . . 6,656 6 . 50 K pndx5032 . dll Sun Feb 27 2005 5:21:56a A . . . . 5,632 5 . 50 K udrdpa . dll Tue Apr 5 2005 4:06:34a . . S . R 234,049 228 . 56 K guard . tmp Go here this looks like X2 whatever this is . 2-spyware . com/remove-vx2-cc . html" target="_blank">www . 2-spyware . com And these dont look like XP files Directory of C:\WINDOWS\System32 04/05/2005 04:06 AM 234,049 udrdpa . dll 04/05/2005 04:04 AM 234,049 guard . tmp 04/05/2005 12:21 AM 234,049 rQsdlg . dll 04/05/2005 12:21 AM 234,119 j0p00a7med . dll 04/05/2005 12:10 AM 233,248 jtp6077se . dll 04/04/2005 09:54 PM 234,049 hwtpapi . dll 04/04/2005 04:55 AM 234,678 j0l4la3q1d . dll 04/04/2005 04:45 AM 233,248 p28q0cl5efq . dll I'll come back tomorrow and add u Jeff . |
Speedy Gonzales (78) | ||
| 1 2 3 4 5 6 7 8 9 10 11 | |||||