Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - godzilly

Pages: [1] 2
1
Tech Clinic / Infected - Please Help
« on: January 08, 2007, 07:08:59 PM »
Done everything you suggested and the 6 items seem to be gone

Thanks

2
Tech Clinic / Infected - Please Help
« on: January 04, 2007, 10:37:39 PM »
Deleted the items and Spybot asked for confirmation  for all six which I allowed

Rebooted and they are still there

A full sysmantec scan was done yesterday and nothing was found

There are no signs of any problem anywhere

Thanks

3
Tech Clinic / Infected - Please Help
« on: January 02, 2007, 05:53:59 PM »
questelo

I've been logged in at work all day and so far everything is OK. No sign of any problems with virus, popup or connection

Many thanks for all your help

B.

4
Tech Clinic / Infected - Please Help
« on: December 31, 2006, 11:40:04 AM »
The symantec removal tool found nothing

I will remove the various infected items

Everything seems OK exept for the connectivity issue

I'm beginning to wonder if it's related to a security download from my IT department. When I logged in voa VPN a few days ago They pushed some security updates to the laptop. If I still have the problems when get back to the office and connect at my desk then I'll seel if the have any idea

Thanks for all your help

Happy New Year

Brian

5
Tech Clinic / Infected - Please Help
« on: December 28, 2006, 02:54:04 PM »
My weekly Symantec scan found the following and quarantined it. The previous scan was on 12/20:

Date,Filename,Threat,Original Location,Status
12/28/2006 12:20:30 AM,qef13B.tmp,Infostealer,C:\WINNT\Temp\,Infected


LATEST KASPERSKY ONLINE SCAN BELOW


-------------------------------------------------------------------------------
 KASPERSKY ONLINE SCANNER REPORT
 Thursday, December 28, 2006 11:50:04 AM
 Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
 Kaspersky Online Scanner version: 5.0.83.0
 Kaspersky Anti-Virus database last update: 28/12/2006
 Kaspersky Anti-Virus database records: 240359
-------------------------------------------------------------------------------

Scan Settings:
   Scan using the following antivirus database: standard
   Scan Archives: true
   Scan Mail Bases: true

Scan Target - My Computer:
   C:\
   D:\
   E:\
   H:\
   J:\

Scan Statistics:
   Total number of scanned objects: 67921
   Number of viruses found: 10
   Number of infected objects: 33 / 0
   Number of suspicious objects: 2
   Duration of the scan process: 04:06:13

Infected Object Name / Virus Name / Last Action
C:\WINNT\CSC0000001   Object is locked   skipped
C:\WINNT\Debug\ipsecpa.log   Object is locked   skipped
C:\WINNT\Debug\Netlogon.log   Object is locked   skipped
C:\WINNT\Debug\oakley.log   Object is locked   skipped
C:\WINNT\Debug\PASSWD.LOG   Object is locked   skipped
C:\WINNT\Internet Logs\5D1ZG61.ldb   Object is locked   skipped
C:\WINNT\Internet Logs\fwdbglog.txt   Object is locked   skipped
C:\WINNT\Internet Logs\fwpktlog.txt   Object is locked   skipped
C:\WINNT\Internet Logs\IAMDB.RDB   Object is locked   skipped
C:\WINNT\Internet Logs\tvDebug.log   Object is locked   skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\CcmExec.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\CertificateMaintenance.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\ClientIDManagerStartup.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\DataTransferService.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\execmgr.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\FileSystemFile.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\InventoryAgent.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\LocationServices.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\mtrmgr.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\PatchInstall.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\PatchUIMonitor.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\PolicyAgent.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\PolicyAgentProvider.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\PolicyEvaluator.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\Scheduler.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\SrcUpdateMgr.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\StatusAgent.log   Object is locked   skipped
C:\WINNT\system32\CCM\Logs\SWMTRReportGen.log   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\CertificateMaintenanceEndpoint000000E.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\CertificateMaintenanceEndpoint000000E.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\CTMDTSReply0000009.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\CTMDTSReply0000009.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\execmgr0000006.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\execmgr0000006.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\InventoryAgent0000003.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\InventoryAgent0000003.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ReplyLocations0000002.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ReplyLocations0000002.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ScheduledCleanup000000J.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ScheduledCleanup000000J.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\MtrMgr0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\MtrMgr0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PatchUIMonitor0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PatchUIMonitor0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_Cleanup0000006.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_Cleanup0000006.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyDownload0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyDownload0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyEvaluator000002I.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyEvaluator000002I.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReplyAssignments000000D.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReplyAssignments000000D.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_RequestAssignments000000V.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_RequestAssignments000000V.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReRequestPolicy0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReRequestPolicy0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\RemoteToolsAgent0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\RemoteToolsAgent0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\SrcUpdateMgr0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\SrcUpdateMgr0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\SWMTRReportGen0000002.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\SWMTRReportGen0000002.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\UpdatesInstallMgr0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\UpdatesInstallMgr0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\UploadProtocol0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\EndpointQueues\UploadProtocol0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\amp_[http]mp_locationmanager0000004.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\amp_[http]mp_locationmanager0000004.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_ddrendpoint0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_ddrendpoint0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_hinvendpoint0000002.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_hinvendpoint0000002.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_relayendpoint0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_relayendpoint0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_sinvendpoint0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_sinvendpoint0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_statusreceiver0000004.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_statusreceiver0000004.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_locationmanager0000001.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_locationmanager0000001.que   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_policymanager000000P.msg   Object is locked   skipped
C:\WINNT\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_policymanager000000P.que   Object is locked   skipped
C:\WINNT\system32\config\AppEvent.Evt   Object is locked   skipped
C:\WINNT\system32\config\default   Object is locked   skipped
C:\WINNT\system32\config\default.LOG   Object is locked   skipped
C:\WINNT\system32\config\SAM   Object is locked   skipped
C:\WINNT\system32\config\SAM.LOG   Object is locked   skipped
C:\WINNT\system32\config\SecEvent.Evt   Object is locked   skipped
C:\WINNT\system32\config\SECURITY   Object is locked   skipped
C:\WINNT\system32\config\SECURITY.LOG   Object is locked   skipped
C:\WINNT\system32\config\software   Object is locked   skipped
C:\WINNT\system32\config\software.LOG   Object is locked   skipped
C:\WINNT\system32\config\SysEvent.Evt   Object is locked   skipped
C:\WINNT\system32\config\system   Object is locked   skipped
C:\WINNT\system32\config\SYSTEM.ALT   Object is locked   skipped
C:\WINNT\system32\Perflib_Perfdata_5e4.dat   Object is locked   skipped
C:\WINNT\system32\Perflib_Perfdata_a4c.dat   Object is locked   skipped
C:\WINNT\system32\wbem\Repository\CIM.REP   Object is locked   skipped
C:\WINNT\Temp\ZLT02f52.TMP   Object is locked   skipped
C:\WINNT\Temp\ZLT02f55.TMP   Object is locked   skipped
C:\WINNT\WindowsUpdate.log   Object is locked   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat   Object is locked   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine1AC0000.VBN   Infected: Trojan-PSW.Win32.OnLineGames.dc   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7440000.VBN   Infected: Trojan.Win32.Agent.abf   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7440001.VBN   Infected: Trojan-PSW.Win32.OnLineGames.bs   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7440002.VBN   Infected: Trojan-PSW.Win32.OnLineGames.bs   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7A00000.VBN   Infected: Trojan-PSW.Win32.OnLineGames.dc   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7A00001.VBN   Infected: Trojan-PSW.Win32.OnLineGames.dc   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7A00002.VBN   Infected: Trojan-PSW.Win32.OnLineGames.bs   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7CC0000.VBN   Infected: Trojan-PSW.Win32.OnLineGames.cx   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7CC0001.VBN   Infected: Trojan.Win32.Agent.abf   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7CC0002.VBN   Infected: Trojan-PSW.Win32.Nilage.apy   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7CC0003.VBN   Infected: Trojan-PSW.Win32.WOW.md   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0000.VBN   Infected: Trojan-PSW.Win32.OnLineGames.cx   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0001.VBN   Infected: Trojan-PSW.Win32.OnLineGames.db   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0002.VBN   Infected: Trojan-PSW.Win32.OnLineGames.db   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0004.VBN   Infected: Trojan.Win32.Agent.abf   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0005.VBN   Infected: Trojan-PSW.Win32.OnLineGames.bs   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0006.VBN   Infected: Trojan-PSW.Win32.Nilage.apy   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0007.VBN   Infected: Trojan-PSW.Win32.OnLineGames.cj   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7DC0008.VBN   Infected: Trojan-PSW.Win32.OnLineGames.cx   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7E00000.VBN   Infected: Trojan-PSW.Win32.OnLineGames.dc   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7E00001.VBN   Infected: Trojan-PSW.Win32.OnLineGames.dc   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7F00000.VBN   Infected: Trojan-PSW.Win32.OnLineGames.db   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7F00001.VBN   Infected: Trojan.Win32.Agent.abf   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7F00002.VBN   Infected: Trojan-PSW.Win32.OnLineGames.bs   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine7F00003.VBN   Infected: Trojan-PSW.Win32.Nilage.apy   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine8D40000.VBN   Infected: Trojan.Win32.Agent.abf   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine8D40001.VBN   Infected: Trojan-PSW.Win32.OnLineGames.bs   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine8D40002.VBN   Infected: Trojan-PSW.Win32.Nilage.apy   skipped
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine8D40003.VBN   Infected: Trojan-PSW.Win32.OnLineGames.cx   skipped
D:\Documents and Settings\Default User\Cookies\index.dat   Object is locked   skipped
D:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat   Object is locked   skipped
D:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat   Object is locked   skipped
D:\Documents and Settings\murphyb\Application Data\Microsoft\Internet Explorer\UserData\index.dat   Object is locked   skipped
D:\Documents and Settings\murphyb\Cookies\index.dat   Object is locked   skipped
D:\Documents and Settings\murphyb\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat   Object is locked   skipped
D:\Documents and Settings\murphyb\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG   Object is locked   skipped
D:\Documents and Settings\murphyb\Local Settings\History\History.IE5\index.dat   Object is locked   skipped
D:\Documents and Settings\murphyb\Local Settings\Temporary Internet Files\Content.IE5\index.dat   Object is locked   skipped
D:\Documents and Settings\murphyb\My Documents\Outlook\2003.pst/2003/Inbox/19 Sep 2003 15:43 from Inet Email System:Failure Advice.html   Suspicious: Exploit.HTML.Iframe.FileDownload   skipped
D:\Documents and Settings\murphyb\My Documents\Outlook\2003.pst/2003/Inbox/19 Sep 2003 15:43 from Inet Email System:Failure Advice.rtf   Suspicious: Exploit.HTML.Iframe.FileDownload   skipped
D:\Documents and Settings\murphyb\My Documents\Outlook\2003.pst/2003/Sent Items/17 Jan 2001 02:27 to 'The Malkow Family':RE: IT'S BEEN A LONG TI.rtf   Infected: Email-Worm.VBS.KakWorm   skipped
D:\Documents and Settings\murphyb\My Documents\Outlook\2003.pst   Mail MS Mail: infected - 1, suspicious - 2   skipped
D:\Documents and Settings\murphyb\My Documents\Outlook\murphyb.pst/Personal Folders/KEEP/07 Jul 2000 10:55 from The Malkow Family:IT'S BEEN A LONG TIME!.rtf   Infected: Email-Worm.VBS.KakWorm   skipped
D:\Documents and Settings\murphyb\My Documents\Outlook\murphyb.pst   Mail MS Mail: infected - 1   skipped
D:\Documents and Settings\murphyb\NTUSER.DAT   Object is locked   skipped
D:\Documents and Settings\murphyb\NTUSER.DAT.LOG   Object is locked   skipped

Scan process completed.

6
Tech Clinic / Infected - Please Help
« on: December 28, 2006, 02:36:15 AM »
Result of search.bat



Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"ACUMon"="\"C:\\Program Files\\Cisco Systems\\Aironet Client Monitor\\ACUMon.Exe\" -a"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~2\\VPTray.exe"
"AcronisÿTrueÿImage Monitor"="D:\\Program Files\\Acronis\\TrueImage\\TrueImageMonitor.exe"
"Acronis Scheduler2 Service"="C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe"
"Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe"
"FinePrint Dispatcher v4"="C:\\WINNT\\system32\\spool\\DRIVERS\\W32X86\\2\\fpdisp4.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"AnyDVD"="D:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
@="KHALMNPR.EXE"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="\"D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
  00
"Bounds"=hex:00,30,00,00,00,20,00,00
"Security Packages"=hex(7):6b,00,65,00,72,00,62,00,65,00,72,00,6f,00,73,00,00,\
  00,6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,73,00,63,00,68,00,61,00,6e,00,\
  6e,00,65,00,6c,00,00,00,00,00
"LsaPid"=dword:00000130
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"fullprivilegeauditing"=hex:01
"lmcompatibilitylevel"=dword:00000000
"restrictanonymous"=dword:00000000
"Notification Packages"=hex(7):73,00,63,00,65,00,63,00,6c,00,69,00,00,00,00,00
"enabledcom"="y"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders]
"ProviderOrder"=hex(7):57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,4e,00,\
  54,00,20,00,41,00,63,00,63,00,65,00,73,00,73,00,20,00,50,00,72,00,6f,00,76,\
  00,69,00,64,00,65,00,72,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  6e,00,74,00,6d,00,61,00,72,00,74,00,61,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data]
"Pattern"=hex:2a,d6,40,72,6d,d0,39,a2,e2,84,62,bd,20,ae,eb,18,34,66,31,32,32,\
  37,33,32,00,fd,06,00,01,00,00,00,a8,00,00,00,b4,00,00,00,58,fa,06,00,57,4c,\
  5a,78,04,00,00,00,b4,fd,06,00,ac,fd,06,00,77,c6,df,85

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG]
"GrafBlumGroup"=hex:d9,a8,72,28,1b,80,54,99,c7

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD]
"Lookup"=hex:dd,28,d6,5b,cd,16

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters]
"MaxPacketSize"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\SidCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
"Auth132"="IISSUBA"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1]
"SkewMatrix"=hex:97,e1,af,34,d8,71,ea,e6,dc,90,1d,ef,f4,b2,c9,52

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache]
"Time"=hex:b0,c7,1f,3b,40,18,c4,01

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"Capabilities"=dword:00004050
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:0000ffff
"Time"=hex:00,f0,8f,cb,6e,4f,c2,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000011
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,e0,48,68,b6,d7,c0,01
"Type"=dword:00000031

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000012
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:00,e0,48,68,b6,d7,c0,01
"Type"=dword:00000031

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,64,00,00,00,80,00,00,00,00,00,00,00,\
  14,00,00,00,02,00,50,00,03,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,\
  00,00,05,12,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,00,\
  00,05,04,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,\
  05,20,00,00,00,20,02,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,5f,84,1f,\
  5e,2e,6b,49,ce,12,03,03,f4,01,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,\
  5f,84,1f,5e,2e,6b,49,ce,12,03,03,f4,01,00,00
"EnableDCOM"="Y"

7
Tech Clinic / Infected - Please Help
« on: December 26, 2006, 02:27:29 PM »
Good Morning

I ran ipconfig /fushdns successfully

I ran RegSrech - here are the results:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "1A404685-7563-4d02-B0F6-58B308A406A9" 12/26/2006 11:08:31 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A404685-7563-4d02-B0F6-58B308A406A9}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A404685-7563-4d02-B0F6-58B308A406A9}\InProcServer32]


++++++++++++++++++++++++++++++++++++++++++++++

I couldn't open search.zip - winzip says it is an invalid archive. I tried on 2 different computers


As for Spyware doctor and spybot - I don't rememeber any popups about items being added to registry or startup

They both seem to be set up OK

In Spybot tools the following are NOT ticked: Bug Report, ActiveX, Browser Pages, Opt Out, Process List

In Spyware Doctor OnGuard is active and all options are ON

Thanks

Brian

8
Tech Clinic / Infected - Please Help
« on: December 24, 2006, 08:54:39 PM »
As you said - 'tis the season..

It may be tuesday before I can get to this. Is that OK?

Thanks once again and have a great holiday

9
Tech Clinic / Infected - Please Help
« on: December 24, 2006, 02:49:29 AM »
I'm experiencing some issues with connectivity

I can connect but a few minutes later if I try to go to a web page or refresh I get "page cannot be displayed"

I open a command wondow and do ipconfig /renew and the i can connect

I don't know if this is related to my virus or not. My laptop is configured for connecting at work and this may ne the issue, but I've never had this kind of problem before

I have 2 other home PC on the same router and they are connecting OK so I don't think it's ISP related

****UPDATE****

I've connected to my work via VPN and connectivity is OK.  intriguing...

**** END UPDATE ***

HJT log is attached - it looks like some of the things we deleted came back


HJT LOG


Logfile of HijackThis v1.99.1
Scan saved at 11:40:45 PM, on 12/23/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Cognos\ca1\bin\cfsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\RegSrvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Apoint\Apoint.exe
D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\stunnel\stunnel-4.04.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
D:\Documents and Settings\murphyb\Desktop\DOWNLOADS\Hi-Jack\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACUMon] "C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe" -a
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] D:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: STunnel to AIS.lnk = D:\Program Files\stunnel\stunnel-4.04.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -
O16 - DPF: {0C5CF442-582B-4357-B116-765DA99CAA8C} (CompositeView Control) - http://pfs-nas2/appxtender/client/IrcViewer.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {130F89DC-B772-4E02-AEFA-1BDDD8BD4E96} -
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://finance.ucsfmedicalcenter.org/ScriptX2/ScriptX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1124309989189
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134580203611
O16 - DPF: {80DC1772-21EF-11D4-B9DE-0008C7CB5F59} -
O16 - DPF: {816FE240-8F3B-460F-AA99-C53CC193807D} (CompositeView Control) - http://pfs-nas1/WX/Client/IrcViewer.cab
O16 - DPF: {89F1C7A1-B54C-406D-8CD6-901D277F6388} (Interactive Client Result Set Control) - http://pfs-nas2/appxtender/client/IrcResultSet.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {976C8ADC-0CEE-4440-9963-EA0199468D34} (Interactive Client Result Set Control) - http://pfs-nas1/WX/Client/IrcResultSet.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://hbscorp.webex.com/client/v_mywebex-...bex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\PROGRA~1\SQLNAV~1\RNetPin.dll
O20 - Winlogon Notify: EFS - C:\WINNT\SYSTEM32\sclgntfy.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cognos Finance Service (Cognos Finance) - Cognos - C:\Program Files\Cognos\ca1\bin\cfsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Cognos Ticket Server (DSTicketSrv) - Cognos Inc - C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - D:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\spool\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINNT\system32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe

10
Tech Clinic / Infected - Please Help
« on: December 24, 2006, 02:02:48 AM »
HJT log and Avenger.txt are below

Blacklight did not find anything

HJT LOG:

Logfile of HijackThis v1.99.1
Scan saved at 10:43:23 PM, on 12/23/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Cognos\ca1\bin\cfsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\RegSrvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Apoint\Apoint.exe
D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\stunnel\stunnel-4.04.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
D:\Documents and Settings\murphyb\Desktop\DOWNLOADS\Hi-Jack\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACUMon] "C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe" -a
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] D:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: STunnel to AIS.lnk = D:\Program Files\stunnel\stunnel-4.04.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0C5CF442-582B-4357-B116-765DA99CAA8C} (CompositeView Control) - http://pfs-nas2/appxtender/client/IrcViewer.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://finance.ucsfmedicalcenter.org/ScriptX2/ScriptX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1124309989189
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134580203611
O16 - DPF: {816FE240-8F3B-460F-AA99-C53CC193807D} (CompositeView Control) - http://pfs-nas1/WX/Client/IrcViewer.cab
O16 - DPF: {89F1C7A1-B54C-406D-8CD6-901D277F6388} (Interactive Client Result Set Control) - http://pfs-nas2/appxtender/client/IrcResultSet.cab
O16 - DPF: {976C8ADC-0CEE-4440-9963-EA0199468D34} (Interactive Client Result Set Control) - http://pfs-nas1/WX/Client/IrcResultSet.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://hbscorp.webex.com/client/v_mywebex-...bex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\PROGRA~1\SQLNAV~1\RNetPin.dll
O20 - Winlogon Notify: EFS - C:\WINNT\SYSTEM32\sclgntfy.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cognos Finance Service (Cognos Finance) - Cognos - C:\Program Files\Cognos\ca1\bin\cfsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Cognos Ticket Server (DSTicketSrv) - Cognos Inc - C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - D:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\spool\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINNT\system32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

avenger.txt



L o g f i l e   o f   T h e   A v e n g e r   v e r s i o n   1 ,   b y   S w a n d o g 4 6
 
 R u n n i n g   f r o m   r e g i s t r y   k e y :
 
 \ R e g i s t r y \ M a c h i n e \ S y s t e m \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ k e r l n k h j
 
 
 
 * * * * * * * * * * * * * * * * * * *
 
 
 
 S c r i p t   f i l e   l o c a t e d   a t :   \ ? ? \ C : \ P r o g r a m   F i l e s \ a r b v x t g i . t x t
 
 S c r i p t   f i l e   o p e n e d   s u c c e s s f u l l y .
 
 
 
 S c r i p t   f i l e   r e a d   s u c c e s s f u l l y
 
 
 
 B a c k u p s   d i r e c t o r y   o p e n e d   s u c c e s s f u l l y   a t   C : \ A v e n g e r
 
 
 
 * * * * * * * * * * * * * * * * * * *
 
 
 
 B e g i n n i n g   t o   p r o c e s s   s c r i p t   f i l e :
 
 
 
 F i l e   C : \ P r o g r a m   F i l e s \ E s e t \ r u n d 1 1 3 2 . e x e   d e l e t e d   s u c c e s s f u l l y .
 
 R e g i s t r y   v a l u e   H K E Y _ U S E R S \ . d e f a u l t \ s o f t w a r e \ m i c r o s o f t \ w i n d o w s \ c u r r e n t v e r s i o n \ r u n | a v p t a s k   d e l e t e d   s u c c e s s f u l l y .
 
 R e g i s t r y   v a l u e   H K E Y _ U S E R S \ . d e f a u l t \ s o f t w a r e \ m i c r o s o f t \ w i n d o w s \ c u r r e n t v e r s i o n \ r u n | m y Z t 2   d e l e t e d   s u c c e s s f u l l y .
 
 R e g i s t r y   v a l u e   H K E Y _ L O C A L _ M A C H I N E \ s o f t w a r e \ m i c r o s o f t \ w i n d o w s \ c u r r e n t v e r s i o n \ e x p l o r e r \ s h e l l e x e c u t e h o o k s | { 1 A 4 0 4 6 8 5 - 7 5 6 3 - 4 d 0 2 - B 0 F 6 - 5 8 B 3 0 8 A 4 0 6 A 9 }   d e l e t e d   s u c c e s s f u l l y .
 
 
 
 C o m p l e t e d   s c r i p t   p r o c e s s i n g .
 
 
 
 * * * * * * * * * * * * * * * * * * *
 
 
 
 F i n i s h e d !     T e r m i n a t e .

11
Tech Clinic / Infected - Please Help
« on: December 23, 2006, 11:52:13 PM »
guestolo

A couple of things:

1: Microsoft anti-spyware was out of date so I could not do anythinh except uninstall it  - which I did

2: When I log in normally I log in with an ID on my company's domain. In safe mode i had to log in as a user on the local machine. I hope this doesn't make any difference.

Thanks for all your help

Here are the various logs:

DR_WEB.csv

mona.exe;D:\Documents and Settings\murphyb\My Documents\OLD_01\userdata\eudora;Joke.Mona;Incurable.Deleted.;

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

HJT LOG

Logfile of HijackThis v1.99.1
Scan saved at 7:28:02 PM, on 12/23/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Cognos\ca1\bin\cfsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\RegSrvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
D:\Program Files\stunnel\stunnel-4.04.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\Documents and Settings\murphyb\Desktop\DOWNLOADS\Hi-Jack\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACUMon] "C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe" -a
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] D:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: STunnel to AIS.lnk = D:\Program Files\stunnel\stunnel-4.04.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -
O16 - DPF: {0C5CF442-582B-4357-B116-765DA99CAA8C} (CompositeView Control) - http://pfs-nas2/appxtender/client/IrcViewer.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {130F89DC-B772-4E02-AEFA-1BDDD8BD4E96} -
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://finance.ucsfmedicalcenter.org/ScriptX2/ScriptX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1124309989189
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134580203611
O16 - DPF: {80DC1772-21EF-11D4-B9DE-0008C7CB5F59} -
O16 - DPF: {816FE240-8F3B-460F-AA99-C53CC193807D} (CompositeView Control) - http://pfs-nas1/WX/Client/IrcViewer.cab
O16 - DPF: {89F1C7A1-B54C-406D-8CD6-901D277F6388} (Interactive Client Result Set Control) - http://pfs-nas2/appxtender/client/IrcResultSet.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {976C8ADC-0CEE-4440-9963-EA0199468D34} (Interactive Client Result Set Control) - http://pfs-nas1/WX/Client/IrcResultSet.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://hbscorp.webex.com/client/v_mywebex-...bex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\PROGRA~1\SQLNAV~1\RNetPin.dll
O20 - Winlogon Notify: EFS - C:\WINNT\SYSTEM32\sclgntfy.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cognos Finance Service (Cognos Finance) - Cognos - C:\Program Files\Cognos\ca1\bin\cfsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Cognos Ticket Server (DSTicketSrv) - Cognos Inc - C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - D:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\spool\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINNT\system32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

COMBOFIX LOG


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
 

C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEMDATA
C:\Documents and Settings\All Users\Application Data\Microsoft\Office\USERDATA
C:\Documents and Settings\brian\My Documents\mc-*-*.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\-20*.lnk
C:\Documents and Settings\brian\Xinstall.exe
C:\WINNT\system32\.exe
C:\Documents and Settings\brian\..\dapcon1.2.ini
C:\WINNT\system32\.exe
C:\WINNT\system32\drivers\npf.sys
C:\WINNT\Downloaded Program Files\WebEx

 
(((((((((((((((((((((((((((((((   Files Created from 2006-11-23 to 2006-12-23  ))))))))))))))))))))))))))))))))))
 
 
2006-12-23   12:06   669   --a------   C:\backup.reg
2006-12-23   12:06   669   --a------   C:\backup.reg
2006-12-23   12:06   <DIR>   d--------   C:\avenger
2006-12-23   12:06   <DIR>   d--------   C:\avenger
2006-12-23   11:59   126,976   --a------   C:\zip.exe
2006-12-23   11:59   126,976   --a------   C:\zip.exe
2006-12-23   11:56   662   --a------   C:\avexport.bat
2006-12-23   11:56   662   --a------   C:\avexport.bat
2006-12-23   11:38   <DIR>   d-ahs----   C:\Config.Msi
2006-12-23   11:38   <DIR>   d-ahs----   C:\Config.Msi
2006-12-20   22:53   <DIR>   d--------   C:\WINNT\KB921883
2006-12-15   09:20   51,072   --a------   C:\WINNT\system32\drivers\ikhlayer.sys
2006-12-15   09:20   30,592   --a------   C:\WINNT\system32\drivers\ikhfile.sys
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-13   14:46   <DIR>   d--------   C:\WINNT\system32\Kaspersky Lab
2006-12-08   10:58   <DIR>   d--------   C:\WINNT\interl
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-23 19:31    --------   d--------   C:\Program Files\Symantec AntiVirus
2006-12-23 19:31    --------   d--------   C:\Program Files\Symantec AntiVirus
2006-12-23 11:38    --------   d--------   C:\Program Files\Microsoft AntiSpyware
2006-12-23 11:38    --------   d--------   C:\Program Files\Microsoft AntiSpyware
2006-12-22 12:13    --------   d-a------   C:\Program Files\Common Files\System
2006-12-20 08:31    --------   d-a------   C:\Program Files\Common Files\Symantec Shared
2006-12-15 09:15    --------   d--------   C:\Program Files\Yahoo!
2006-12-15 09:15    --------   d--------   C:\Program Files\Yahoo!
2006-12-14 10:30    --------   d--------   C:\Program Files\QuickTime
2006-12-14 10:30    --------   d--------   C:\Program Files\QuickTime
2006-11-28 06:40    --------   d--------   C:\Program Files\Macromedia
2006-11-28 06:40    --------   d--------   C:\Program Files\Macromedia
2006-11-28 06:40    --------   d--------   C:\Program Files\Common Files
2006-11-28 06:40    --------   d--------   C:\Program Files\Common Files
2006-11-28 06:38    --------   d--h-----   C:\Program Files\InstallShield Installation Information
2006-11-28 06:38    --------   d--h-----   C:\Program Files\InstallShield Installation Information
2006-11-28 06:38    --------   d--------   C:\Program Files\Common Files\Adaptec Shared
2006-11-02 13:23    --------   d--------   C:\Program Files\SQL Navigator 5
2006-11-02 13:23    --------   d--------   C:\Program Files\SQL Navigator 5
2006-10-23 08:00    --------   d-a------   C:\Program Files\Adobe
2006-10-23 08:00    --------   d-a------   C:\Program Files\Adobe
2006-10-23 07:59    --------   d-a------   C:\Program Files\Common Files\Adobe
 
 
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"ACUMon"="\"C:\\Program Files\\Cisco Systems\\Aironet Client Monitor\\ACUMon.Exe\" -a"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~2\\VPTray.exe"
"Acronis True Image Monitor"="D:\\Program Files\\Acronis\\TrueImage\\TrueImageMonitor.exe"
"Acronis Scheduler2 Service"="C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe"
"Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe"
"FinePrint Dispatcher v4"="C:\\WINNT\\system32\\spool\\DRIVERS\\W32X86\\2\\fpdisp4.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"AnyDVD"="D:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000003
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00002002
"Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c4,01,00,00,00,\
  00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
  00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"disablecad"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"nodrivetypeautorun"=dword:000000ff

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=hex:95,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\EFS
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]   
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 
Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\$~$Sys0$.job
C:\WINNT\tasks\$~$Sys1$.job

Completion time: Sat 2006-12-23 19:58:17.26
C:\combofix.txt ... 06-12-23 19:58
C:\ComboFix2.txt ... 06-12-20 22:26

12
Tech Clinic / Infected - Please Help
« on: December 23, 2006, 11:48:11 PM »
guestolo

A couple of things:

1: Microsoft anti-spyware was out of date so I could not do anythinh except uninstall it  - which I did

2: When I log in normally I log in with an ID on my company's domain. In safe mode i had to log in as a user on the local machine. I hope this doesn't make any difference.

Thanks for all your help

Here are the various logs:

DR_WEB.csv

mona.exe;D:\Documents and Settings\murphyb\My Documents\OLD_01\userdata\eudora;Joke.Mona;Incurable.Deleted.;

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

HJT LOG

Logfile of HijackThis v1.99.1
Scan saved at 7:28:02 PM, on 12/23/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Cognos\ca1\bin\cfsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\RegSrvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\system32\ZCfgSvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
D:\Program Files\stunnel\stunnel-4.04.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\Documents and Settings\murphyb\Desktop\DOWNLOADS\Hi-Jack\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACUMon] "C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe" -a
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] D:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINNT\system32\spool\DRIVERS\W32X86\2\fpdisp4.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: STunnel to AIS.lnk = D:\Program Files\stunnel\stunnel-4.04.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -
O16 - DPF: {0C5CF442-582B-4357-B116-765DA99CAA8C} (CompositeView Control) - http://pfs-nas2/appxtender/client/IrcViewer.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {130F89DC-B772-4E02-AEFA-1BDDD8BD4E96} -
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://finance.ucsfmedicalcenter.org/ScriptX2/ScriptX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1124309989189
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134580203611
O16 - DPF: {80DC1772-21EF-11D4-B9DE-0008C7CB5F59} -
O16 - DPF: {816FE240-8F3B-460F-AA99-C53CC193807D} (CompositeView Control) - http://pfs-nas1/WX/Client/IrcViewer.cab
O16 - DPF: {89F1C7A1-B54C-406D-8CD6-901D277F6388} (Interactive Client Result Set Control) - http://pfs-nas2/appxtender/client/IrcResultSet.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {976C8ADC-0CEE-4440-9963-EA0199468D34} (Interactive Client Result Set Control) - http://pfs-nas1/WX/Client/IrcResultSet.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://hbscorp.webex.com/client/v_mywebex-...bex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ucsfmedicalcenter.org
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\PROGRA~1\SQLNAV~1\RNetPin.dll
O20 - Winlogon Notify: EFS - C:\WINNT\SYSTEM32\sclgntfy.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cognos Finance Service (Cognos Finance) - Cognos - C:\Program Files\Cognos\ca1\bin\cfsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Cognos Ticket Server (DSTicketSrv) - Cognos Inc - C:\Program Files\Cognos\ca1\TicketServer\bin\TicketServer.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - D:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\spool\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINNT\system32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

COMBOFIX LOG


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
 

C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEMDATA
C:\Documents and Settings\All Users\Application Data\Microsoft\Office\USERDATA
C:\Documents and Settings\brian\My Documents\mc-*-*.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\-20*.lnk
C:\Documents and Settings\brian\Xinstall.exe
C:\WINNT\system32\.exe
C:\Documents and Settings\brian\..\dapcon1.2.ini
C:\WINNT\system32\.exe
C:\WINNT\system32\drivers\npf.sys
C:\WINNT\Downloaded Program Files\WebEx

 
(((((((((((((((((((((((((((((((   Files Created from 2006-11-23 to 2006-12-23  ))))))))))))))))))))))))))))))))))
 
 
2006-12-23   12:06   669   --a------   C:\backup.reg
2006-12-23   12:06   669   --a------   C:\backup.reg
2006-12-23   12:06   <DIR>   d--------   C:\avenger
2006-12-23   12:06   <DIR>   d--------   C:\avenger
2006-12-23   11:59   126,976   --a------   C:\zip.exe
2006-12-23   11:59   126,976   --a------   C:\zip.exe
2006-12-23   11:56   662   --a------   C:\avexport.bat
2006-12-23   11:56   662   --a------   C:\avexport.bat
2006-12-23   11:38   <DIR>   d-ahs----   C:\Config.Msi
2006-12-23   11:38   <DIR>   d-ahs----   C:\Config.Msi
2006-12-20   22:53   <DIR>   d--------   C:\WINNT\KB921883
2006-12-15   09:20   51,072   --a------   C:\WINNT\system32\drivers\ikhlayer.sys
2006-12-15   09:20   30,592   --a------   C:\WINNT\system32\drivers\ikhfile.sys
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-15   09:20   <DIR>   d-a------   C:\Program Files\Spyware Doctor
2006-12-13   14:46   <DIR>   d--------   C:\WINNT\system32\Kaspersky Lab
2006-12-08   10:58   <DIR>   d--------   C:\WINNT\interl
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-08   10:52   <DIR>   d--------   C:\Program Files\Eset
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6
2006-12-04   09:13   <DIR>   d--------   C:\Program Files\SPORT6


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-23 19:31    --------   d--------   C:\Program Files\Symantec AntiVirus
2006-12-23 19:31    --------   d--------   C:\Program Files\Symantec AntiVirus
2006-12-23 11:38    --------   d--------   C:\Program Files\Microsoft AntiSpyware
2006-12-23 11:38    --------   d--------   C:\Program Files\Microsoft AntiSpyware
2006-12-22 12:13    --------   d-a------   C:\Program Files\Common Files\System
2006-12-20 08:31    --------   d-a------   C:\Program Files\Common Files\Symantec Shared
2006-12-15 09:15    --------   d--------   C:\Program Files\Yahoo!
2006-12-15 09:15    --------   d--------   C:\Program Files\Yahoo!
2006-12-14 10:30    --------   d--------   C:\Program Files\QuickTime
2006-12-14 10:30    --------   d--------   C:\Program Files\QuickTime
2006-11-28 06:40    --------   d--------   C:\Program Files\Macromedia
2006-11-28 06:40    --------   d--------   C:\Program Files\Macromedia
2006-11-28 06:40    --------   d--------   C:\Program Files\Common Files
2006-11-28 06:40    --------   d--------   C:\Program Files\Common Files
2006-11-28 06:38    --------   d--h-----   C:\Program Files\InstallShield Installation Information
2006-11-28 06:38    --------   d--h-----   C:\Program Files\InstallShield Installation Information
2006-11-28 06:38    --------   d--------   C:\Program Files\Common Files\Adaptec Shared
2006-11-02 13:23    --------   d--------   C:\Program Files\SQL Navigator 5
2006-11-02 13:23    --------   d--------   C:\Program Files\SQL Navigator 5
2006-10-23 08:00    --------   d-a------   C:\Program Files\Adobe
2006-10-23 08:00    --------   d-a------   C:\Program Files\Adobe
2006-10-23 07:59    --------   d-a------   C:\Program Files\Common Files\Adobe
 
 
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"PRONoMgr.exe"="C:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"ACUMon"="\"C:\\Program Files\\Cisco Systems\\Aironet Client Monitor\\ACUMon.Exe\" -a"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~2\\VPTray.exe"
"Acronis True Image Monitor"="D:\\Program Files\\Acronis\\TrueImage\\TrueImageMonitor.exe"
"Acronis Scheduler2 Service"="C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe"
"Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe"
"FinePrint Dispatcher v4"="C:\\WINNT\\system32\\spool\\DRIVERS\\W32X86\\2\\fpdisp4.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"AnyDVD"="D:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000003
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00002002
"Position"=hex:2c,00,00,00,80,00,00,00,00,00,00,00,00,02,00,00,c4,01,00,00,00,\
  00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
  00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"disablecad"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"nodrivetypeautorun"=dword:000000ff

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=hex:95,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\EFS
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]   
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 
Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\$~$Sys0$.job
C:\WINNT\tasks\$~$Sys1$.job

Completion time: Sat 2006-12-23 19:58:17.26
C:\combofix.txt ... 06-12-23 19:58
C:\ComboFix2.txt ... 06-12-20 22:26

13
Tech Clinic / Infected - Please Help
« on: December 21, 2006, 01:37:11 AM »
guestolo, I think I prefer your option http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/wink.gif\' class=\'bbc_emoticon\' alt=\';)\' />

Attached is combofix log

I'm also attaching the log from the Kaspersky On line scan

Thanks


[attachment=2176:ComboFix.txt]

[attachment=2177:kaspersky.txt]

14
Tech Clinic / Infected - Please Help
« on: December 20, 2006, 12:21:25 PM »
I've picked up what I think is a virus combo - dell laptop running Win 2000 Pro

Both Zonealarm firewall and Spybot S&D have been giving popups about

1.exe
1.ini
2.exe
4.exe
5.exe
8.exe
9.exe
rund1132.exe
z2ts.dll

Spyware Doctor found C:\WINNT\Temp\Zt2\SVCHOST.exe

I've run a couple of Kaspersky On-line scans
and found Trojan-PSW.Win32.OnLineGames and Infostealer on different scans as files get created and deleted

My corporate anti-virus is Symantec and it is finding nothing


Any help would be greatly appreciated


HJT log is attached

[attachment=2166:hijackthis.txt]

15
Tech Clinic / HELP- PAKES - DIALER.QY - DIALER.KOTU, Still INFECTED
« on: September 17, 2006, 09:48:12 PM »
SPYWARE DOCTOR 4.0 from PC TOOLS

sorry for any confusion

16
Tech Clinic / HELP- PAKES - DIALER.QY - DIALER.KOTU, Still INFECTED
« on: September 16, 2006, 09:08:57 PM »
questolo

So far so good - everything seems OK

I've installed spy doctor which seems to be doing a great job of keeping things clean

Thanks again for all your help

Brian

17
Tech Clinic / HELP- PAKES - DIALER.QY - DIALER.KOTU, Still INFECTED
« on: September 10, 2006, 01:21:49 PM »
Thanks

I'll let you know

Thanks again for all your help

18
Tech Clinic / HELP- PAKES - DIALER.QY - DIALER.KOTU, Still INFECTED
« on: September 09, 2006, 10:50:19 PM »
avenger log:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\wjfdalak

*******************

Script file located at: \??\C:\Documents and Settings\tcfhkbtp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\svvwa.bak1 deleted successfully.
File C:\WINDOWS\system32\awvvs.dll.vir deleted successfully.


File c:\windows\system32\yayvtrp.dll not found!
Deletion of file c:\windows\system32\yayvtrp.dll failed!

Could not process line:
c:\windows\system32\yayvtrp.dll
Status: 0xc0000034


Completed script processing.

*******************

Finished!  Terminate.

++++++++++++++++++++++++++++++++++++++++++++++++


HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:44:25 PM, on 9/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\WINDOWS\sm56hlpr.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\All Users\Desktop\DOWNLOADS\hijack\ANALYZE.EXE

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128798714328
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\PROGRA~1\QUESTS~1\SQLNAV~1\RNetPin.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar SG20 (LxrSG20s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSG20s.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Uninstall List

Acronis True Image
Ad-Aware SE Personal
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0.8
AnyDVD
ATI Control Panel
ATI Display Driver
Atomic Clock Sync
Audacity 1.2.3
Barnyard Invasion from Compaq (remove only)
Bejeweled 2 Deluxe from Compaq (remove only)
Big Kahuna Reef from Compaq (remove only)
BitTorrent 4.4.1
Blackhawk Striker 2 from Compaq (remove only)
Blasterball 2 from Compaq (remove only)
Blasterball 2 Holidays from Compaq (remove only)
Blaze Media Pro
Boggle Supreme from Compaq (remove only)
BookWorm Deluxe 1.03
Bounce Symphony from Compaq (remove only)
CC_ccProxyExt
ccCommon
ccPxyCore
Cisco Systems VPN Client  4.6.02.0011
Cole2k Media - Nero Audio Plugin Pack
Compaq Connections (remove only)
Compaq Game Console and games
Compaq Multimedia Keyboard Software
Compaq Organize
ConvertXtoDVD 2.0.12
Cool MP3 Splitter 2.05
Crystal Maze from Compaq (remove only)
Cucusoft MPEG to DVD Burner 3.21
dBpowerAMP DirectShow Decoder Codec
dBpowerAMP Music Converter
Digby's Donuts from Compaq (remove only)
Digital Media Converter 2.65
DiskPie 2.0
DivX
DivX Converter
DivX Player
DivX Web Player
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab Platinum 2.9.7.2
Easy Internet Sign-up
eMusic - 50 Free MP3 offer
ewido anti-spyware 4.0
Exact Audio Copy v0.9 beta 3
Express Burn Uninstall
Express Rip Uninstall
FairStars Audio Converter 1.54
FATE Demo from Compaq (remove only)
FLAC Installer 1.1.2a (remove only)
Flip Words from Compaq (remove only)
Google Earth
Google Toolbar for Internet Explorer
HBS TP Control
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
HP Boot Optimizer
HP Image Zone Express
HP Software Update
Insaniquarium Deluxe from Compaq (remove only)
InterVideo WinDVD Player
IsoBuster 1.9
iTunes
J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Jewel Quest from Compaq (remove only)
Kaspersky Online Scanner
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Mah Jong Quest from Compaq (remove only)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Money 2005
Microsoft Office Standard Edition 2003
Microsoft Office XP Professional with FrontPage
Microsoft Plus! Dancer LE
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Works
mkw Audio Compression Toolkit
Moonlight H.264 Player 1.0
Motorola SM56 Speakerphone Modem
Mozilla Thunderbird (1.5.0.5)
Mpeg2Decoder 1.3
MSRedist
Nero - Burning Rom
Nero 7 Ultra Edition
NetPerSec
Norton AntiSpam
Norton AntiSpam
Norton AntiVirus 2005
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security 2005 (Symantec Corporation)
Norton WMI Update
Norton WMI Update
Office 2003 Tour
Pavo DVD Express v1.0.0.326
PC-Doctor 5 for Windows
Polar Bowler from Compaq (remove only)
Polar Golfer from Compaq (remove only)
Project URL Snooper
PS2
Puzzle Express from Compaq (remove only)
Python 2.2 pywin32 extensions (build 203)
Python 2.2.3
Quicken 2006
QuickTime
Real Alternative 1.47
RecordPad Sound Recorder Uninstall
Ricochet Lost Worlds from Compaq (remove only)
SCRABBLE Blast from Compaq (remove only)
SCRABBLE from Compaq (remove only)
SCRABBLE Rack Attack from Compaq (remove only)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Shrek 2 Ogre Bowler from Compaq (remove only)
Skype 2.5
Slingo Deluxe from Compaq (remove only)
Slyder from Compaq (remove only)
Sonic Express Labeler
Sonic MyDVD Plus
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
SPBBC
SpywareBlaster v3.5.1
SQL Navigator 5
SSH Secure Shell
Streambox Vcr Suite 2
Super Granny from Compaq (remove only)
Swarm from Compaq (remove only)
Switch Uninstall
Symantec pcAnywhere
Symantec Script Blocking Installer
SymNet
Tradewinds from Compaq (remove only)
TurboTax Premier 2005
UltraEdit-32 Uninstall
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Viewpoint Media Player
WavePad Uninstall
WexTech AnswerWorks
WildTangent Web Driver
Winamp (remove only)
Windows Defender
Windows Defender Signatures
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB883667
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinPcap 2.3
WinRAR archiver
WinUHA 2.0 RC1 (2005.02.27)
WinZip
Wisecroft Ripper
x264 Revision 487 x264.nl (remove only)

19
Tech Clinic / HELP- PAKES - DIALER.QY - DIALER.KOTU, Still INFECTED
« on: September 09, 2006, 10:17:10 PM »
combofix log:

brian - 06-09-09 20:12:01.78
ComboFix 06.09.07 - Running from: C:\Documents and Settings\All Users\Desktop\DOWNLOADS\hijack

Microsoft Windows XP [Version 5.1.2600]

(((((((((((((((((((((((((((((((   Files Created from 2006-08-09 to 2006-09-09  ))))))))))))))))))))))))))))))))))
 

2006-09-01   22:01   699,232   ---hs----   C:\WINDOWS\system32\svvwa.bak1
2006-09-01   21:59   692,276   --ahs----   C:\WINDOWS\system32\awvvs.dll.vir
 

((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-09 12:21   --------   d--------   C:\Documents and Settings\brian\Application Data\Skype
2006-09-07 21:49   --------   d--------   C:\Program Files\Easy Internet signup
2006-09-06 21:24   --------   d--------   C:\Program Files\SpywareBlaster
2006-09-06 21:10   --------   d--------   C:\Program Files\Common Files\Symantec Shared
2006-09-06 06:22   --------   d--------   C:\Program Files\ewido anti-spyware 4.0
2006-09-05 22:04   --------   d--------   C:\Program Files\Mozilla Thunderbird
2006-09-05 20:37   --------   d--------   C:\Program Files\Norton Internet Security
2006-09-05 20:29   --------   d--------   C:\Program Files\WinUHA
2006-09-03 10:42   --------   d--------   C:\Program Files\Lavasoft
2006-09-03 10:42   --------   d--------   C:\Documents and Settings\brian\Application Data\Lavasoft
2006-09-01 22:04   --------   d--------   C:\Program Files\Common Files
2006-08-31 20:37   --------   d--------   C:\Program Files\Google
2006-08-27 09:46   --------   d--------   C:\Program Files\Common Files\Deterministic Networks
2006-08-13 09:57   --------   d--------   C:\Program Files\Winamp
2006-08-10 03:02   --------   d--------   C:\Program Files\Internet Explorer
2006-08-08 23:01   --------   d--------   C:\Program Files\UltraEdit
2006-08-01 17:16   20096   --a------   C:\WINDOWS\system32\drivers\AnyDVD.sys
2006-07-30 06:58   --------   d--------   C:\Documents and Settings\brian\Application Data\Google
2006-07-27 06:24   679424   --a------   C:\WINDOWS\system32\inetcomm.dll
2006-07-21 01:24   72704   --a------   C:\WINDOWS\system32\hlink.dll
 

((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCDrProfiler"=""
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run"
"SMSERIAL"="sm56hlpr.exe"
"LSBWatcher"="c:\\hp\\drivers\\hplsbwatcher\\lsburnwatcher.exe"
"HP Software Update"=hex(2):43,3a,5c,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,5c,\
  48,50,5c,48,50,20,53,6f,66,74,77,61,72,65,20,55,70,64,61,74,65,5c,48,50,77,\
  75,53,63,68,64,32,2e,65,78,65,00
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"Acronis True Image Monitor"="C:\\Program Files\\Acronis\\TrueImage\\TrueImageMonitor.exe"
"Acronis Scheduler2 Service"="C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"ISUSScheduler"="\"C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\issch.exe\" -start"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
@=""
"NWEReboot"=""
"InCD"="C:\\Program Files\\Nero\\Nero 7\\InCD\\InCD.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.4156\\GoogleToolbarNotifier.exe"
"AnyDVD"="C:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=hex:91,00,00,00

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=hex:91,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"
 
 

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Easy Internet Sign-up.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - brian.job
 
Completion time: Sat 09/09/2006 20:12:46.62
ComboFix.txt
ComboFix2.txt

20
Tech Clinic / HELP- PAKES - DIALER.QY - DIALER.KOTU, Still INFECTED
« on: September 09, 2006, 09:38:36 PM »
Vundofix didn't ask to be run as a task

I scanned anyway and it aid it dodn't find anything

vundofix.txt and HJT log are below
__________________________


VundoFix V6.1.4

Checking Java version...

Java version is 1.5.0.4

Java version is 1.5.0.6

Scan started at 7:28:00 PM 9/9/2006

Listing files found while scanning....

No infected files were found.


-------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 7:33:44 PM, on 9/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\sm56hlpr.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Documents and Settings\All Users\Desktop\DOWNLOADS\hijack\VundoFix.exe
C:\Documents and Settings\All Users\Desktop\DOWNLOADS\hijack\ANALYZE.EXE

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.4156\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128798714328
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\PROGRA~1\QUESTS~1\SQLNAV~1\RNetPin.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Pages: [1] 2