Forum Replies Created
-
Posts
-
I wasn’t able to find the first two they only appear in the logfile but I got rid of the rest.
Also I just ran the Norton Removal Tool and now I need to restart my comp. And yes I currently use Avira.
Logfile of HijackThis v1.99.1
Scan saved at 11:25:05 PM, on 3/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:PROGRA~1COMMON~1AOLACSacsd.exe
C:Program FilesComodoFirewallcmdagent.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32UStorSrv.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre1.5.0_10binjusched.exe
C:windowssystemhpsysdrv.exe
C:WINDOWSAGRSMMSG.exe
C:WINDOWSsystem32hphmon06.exe
C:HPKBDKBD.EXE
C:WINDOWSsystem32msxct.exe
C:Program FilesMicrosoft HardwareMousepoint32.exe
C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:WINDOWSsystem32rundll32.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesWinampwinampa.exe
C:Program FilesZuneZuneLauncher.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe
C:WINDOWSALCXMNTR.EXE
C:Program FilesComodoFirewallCPF.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesAIM6aim6.exe
C:Program FilesAIM6aolsoftware.exe
C:Program FilesImationImationFlashDetect.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:program filesaim6anotify.exe
C:Process Explorerprocexp.exe
C:Program FilesWinampwinamp.exe
C:Mozilla Firefox 2.0firefox.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesMSN Messengerusnsvc.exe
C:Program FilesHijackThisHijackThis.exeR1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = Sign In
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = MSN.com
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = Live Search
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = MSN.com
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 – BHO: Alcohol Toolbar Helper – {52D06F97-5511-43FA-8FDA-C481864FD26E} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O2 – BHO: SSVHelper Class – {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} – C:Program FilesJavajre1.5.0_10binssv.dll
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O2 – BHO: Google Toolbar Helper – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O2 – BHO: CNavExtBho Class – {BDF3E430-B101-42AD-A544-FADC6B084872} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: HP view – {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} – c:Program FilesHPDigital ImagingbinHPDTLK02.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: Alcohol Toolbar – {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O4 – HKLM..Run: [SunJavaUpdateSched] “C:Program FilesJavajre1.5.0_10binjusched.exe”
O4 – HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe
O4 – HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 – HKLM..Run: [AGRSMMSG] AGRSMMSG.exe
O4 – HKLM..Run: [HPHUPD06] c:Program FilesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}hphupd06.exe
O4 – HKLM..Run: [HPHmon06] C:WINDOWSsystem32hphmon06.exe
O4 – HKLM..Run: [KBD] C:HPKBDKBD.EXE
O4 – HKLM..Run: [Recguard] C:WINDOWSSMINSTRECGUARD.EXE
O4 – HKLM..Run: [URLLSTCK.exe] c:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 – HKLM..Run: [PS2] C:WINDOWSsystem32ps2.exe
O4 – HKLM..Run: [LSBWatcher] c:hpdrivershplsbwatcherlsburnwatcher.exe
O4 – HKLM..Run: [regcmdcons] c:hpbincloaker.exe c:hpbincmdcons.cmd
O4 – HKLM..Run: [hpfsched] C:WINDOWShpfsched.exe
O4 – HKLM..Run: [msxct] msxct.exe
O4 – HKLM..Run: [s7rg3nQ] ntstrl12.exe
O4 – HKLM..Run: [POINTER] point32.exe
O4 – HKLM..Run: [WorksFUD] C:Program FilesMicrosoft Workswkfud.exe
O4 – HKLM..Run: [Microsoft Works Portfolio] C:Program FilesMicrosoft WorksWksSb.exe /AllUsers
O4 – HKLM..Run: [Microsoft Works Update Detection] C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
O4 – HKLM..Run: [TkBellExe] “C:Program FilesCommon FilesRealUpdate_OBrealsched.exe” -osboot
O4 – HKLM..Run: [LogonStudio] “C:WinCustomizeLogonStudiologonstudio.exe” /RANDOM
O4 – HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [avgnt] “C:Program FilesAntiVir PersonalEdition Classicavgnt.exe” /min
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [FreePDF Assistant] C:Program FilesFreePDF_XPfpassist.exe
O4 – HKLM..Run: [Zune Launcher] “C:Program FilesZuneZuneLauncher.exe”
O4 – HKLM..Run: [ISUSPM] “C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe” -scheduler
O4 – HKLM..Run: [AlcxMonitor] ALCXMNTR.EXE
O4 – HKLM..Run: [UnlockerAssistant] “C:Documents and SettingsHP_OwnerDesktopMain BaseOther PlacesUnlockerUnlockerAssistant.exe”
O4 – HKLM..Run: [COMODO Firewall Pro] “C:Program FilesComodoFirewallCPF.exe” /background
O4 – HKCU..Run: [MsnMsgr] “C:Program FilesMSN MessengerMsnMsgr.Exe” /background
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [dm2launcher.exe] “C:PROGRA~1DESKTO~1.0dm2launcher.exe” -start
O4 – HKCU..Run: [dw0mRhcEi] ntmyerxp.exe
O4 – HKCU..Run: [MSMSGS] “C:Program FilesMessengerMsmsgs.exe” /background
O4 – HKCU..Run: [updateMgr] C:Program FilesAdobeAcrobat 7.0ReaderAdobeUpdateManager.exe AcRdB7_0_0
O4 – HKCU..Run: [BitTorrent] “C:Program FilesBitTorrentbittorrent.exe” –force_start_minimized
O4 – HKCU..Run: [Aim6] “C:Program FilesAIM6aim6.exe” /d locale=en-US ee://aol/imApp
O4 – Startup: ImationFlashDetect.lnk = C:Program FilesImationImationFlashDetect.exe
O4 – Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
O4 – Global Startup: InterVideo WinCinema Manager.lnk = C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O4 – Global Startup: SpySubtract.lnk = C:Program FilesInterMuteSpySubtractsslaunch.exe
O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra button: Research – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:PROGRA~1MI1933~1OFFICE11REFIEBAR.DLL
O9 – Extra button: AIM – {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} – C:Documents and SettingsHP_OwnerDesktopMain BaseInstant MessengersAIMaim.exe
O9 – Extra button: (no name) – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra button: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra ‘Tools’ menuitem: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O11 – Options group: [INTERNATIONAL] International*
O16 – DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) – http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 – DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) – https://activatemydsl.verizon.net/sdcCommon/download/tgctlcm.cab
O16 – DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 – DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) – http://musicmix.messenger.msn.com/Medialogic.CAB
O16 – DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) – http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 – DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} – http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 – DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) – http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136228466031
O16 – DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} – http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 – DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 – DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) – http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 – DPF: {BD393C14-72AD-4790-A095-76522973D6B8} – http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 – DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) – http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 – Protocol: livecall – {828030A1-22C1-4009-854F-8E305202313F} – C:PROGRA~1MSNMES~1MSGRAP~1.DLL
O18 – Protocol: msnim – {828030A1-22C1-4009-854F-8E305202313F} – C:PROGRA~1MSNMES~1MSGRAP~1.DLL
O18 – Filter: text/html – (no CLSID) – (no file)
O20 – AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GOEC62~1.DLL
O20 – Winlogon Notify: igfxcui – C:WINDOWSSYSTEM32igfxsrvc.dll
O20 – Winlogon Notify: WgaLogon – C:WINDOWSSYSTEM32WgaLogon.dll
O21 – SSODL: WPDShServiceObj – {AAA288BA-9A4C-45B0-95D7-94D524869DB5} – C:WINDOWSsystem32WPDShServiceObj.dll
O23 – Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) – Avira GmbH – C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 – Service: AntiVir PersonalEdition Classic Guard (AntiVirService) – AVIRA GmbH – C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 – Service: AOL Connectivity Service (AOL ACS) – America Online, Inc. – C:PROGRA~1COMMON~1AOLACSacsd.exe
O23 – Service: AOL Spyware Protection Service (AOLService) – Unknown owner – C:Program FilesCommon FilesAOLAOL Spyware Protection\aolserv.exe
O23 – Service: Comodo Application Agent (CmdAgent) – COMODO – C:Program FilesComodoFirewallcmdagent.exe
O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 – Service: ISSvc (ISSVC) – Symantec Corporation – c:Program FilesNorton Internet SecurityISSVC.exe
O23 – Service: IviRegMgr – InterVideo – C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
O23 – Service: MySQL – Unknown owner – C:Documents.exe (file missing)
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:WINDOWSsystem32nvsvc32.exe
O23 – Service: Pml Driver HPZ12 – HP – C:WINDOWSsystem32HPZipm12.exe
O23 – Service: SAVScan – Symantec Corporation – c:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
O23 – Service: StarWind iSCSI Service (StarWindService) – Rocket Division Software – C:Program FilesAlcohol SoftAlcohol 52StarWindStarWindService.exe
O23 – Service: SymWMI Service (SymWSC) – Symantec Corporation – c:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 – Service: UStorage Server Service – OTi – C:WINDOWSsystem32UStorSrv.exeAlso I tried CWShredder didn’t find anything.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:11:31 PM, on 3/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:PROGRA~1COMMON~1AOLACSacsd.exe
C:Program FilesComodoFirewallcmdagent.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32UStorSrv.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre1.5.0_10binjusched.exe
C:windowssystemhpsysdrv.exe
C:WINDOWSAGRSMMSG.exe
C:WINDOWSsystem32hphmon06.exe
C:HPKBDKBD.EXE
C:WINDOWSsystem32msxct.exe
C:Program FilesMicrosoft HardwareMousepoint32.exe
C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:WINDOWSsystem32rundll32.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesWinampwinampa.exe
C:Program FilesZuneZuneLauncher.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe
C:WINDOWSALCXMNTR.EXE
C:Program FilesComodoFirewallCPF.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesAIM6aim6.exe
C:Program FilesAIM6aolsoftware.exe
C:Program FilesImationImationFlashDetect.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:program filesaim6anotify.exe
C:Process Explorerprocexp.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and SettingsHP_OwnerLocal SettingsTemporary Internet FilesContent.IE5EVLT85JUHiJackThis_v2[1].exeR1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = Sign In
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = MSN.com
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = Live Search
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = MSN.com
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 – BHO: Alcohol Toolbar Helper – {52D06F97-5511-43FA-8FDA-C481864FD26E} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O2 – BHO: SSVHelper Class – {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} – C:Program FilesJavajre1.5.0_10binssv.dll
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O2 – BHO: Google Toolbar Helper – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O2 – BHO: CNavExtBho Class – {BDF3E430-B101-42AD-A544-FADC6B084872} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: HP view – {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} – c:Program FilesHPDigital ImagingbinHPDTLK02.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: Alcohol Toolbar – {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O4 – HKLM..Run: [SunJavaUpdateSched] “C:Program FilesJavajre1.5.0_10binjusched.exe”
O4 – HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe
O4 – HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 – HKLM..Run: [AGRSMMSG] AGRSMMSG.exe
O4 – HKLM..Run: [HPHUPD06] c:Program FilesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}hphupd06.exe
O4 – HKLM..Run: [HPHmon06] C:WINDOWSsystem32hphmon06.exe
O4 – HKLM..Run: [KBD] C:HPKBDKBD.EXE
O4 – HKLM..Run: [Recguard] C:WINDOWSSMINSTRECGUARD.EXE
O4 – HKLM..Run: [URLLSTCK.exe] c:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 – HKLM..Run: [PS2] C:WINDOWSsystem32ps2.exe
O4 – HKLM..Run: [LSBWatcher] c:hpdrivershplsbwatcherlsburnwatcher.exe
O4 – HKLM..Run: [regcmdcons] c:hpbincloaker.exe c:hpbincmdcons.cmd
O4 – HKLM..Run: [hpfsched] C:WINDOWShpfsched.exe
O4 – HKLM..Run: [msxct] msxct.exe
O4 – HKLM..Run: [s7rg3nQ] ntstrl12.exe
O4 – HKLM..Run: [POINTER] point32.exe
O4 – HKLM..Run: [WorksFUD] C:Program FilesMicrosoft Workswkfud.exe
O4 – HKLM..Run: [Microsoft Works Portfolio] C:Program FilesMicrosoft WorksWksSb.exe /AllUsers
O4 – HKLM..Run: [Microsoft Works Update Detection] C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
O4 – HKLM..Run: [TkBellExe] “C:Program FilesCommon FilesRealUpdate_OBrealsched.exe” -osboot
O4 – HKLM..Run: [LogonStudio] “C:WinCustomizeLogonStudiologonstudio.exe” /RANDOM
O4 – HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [avgnt] “C:Program FilesAntiVir PersonalEdition Classicavgnt.exe” /min
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [FreePDF Assistant] C:Program FilesFreePDF_XPfpassist.exe
O4 – HKLM..Run: [Zune Launcher] “C:Program FilesZuneZuneLauncher.exe”
O4 – HKLM..Run: [ISUSPM] “C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe” -scheduler
O4 – HKLM..Run: [AlcxMonitor] ALCXMNTR.EXE
O4 – HKLM..Run: [UnlockerAssistant] “C:Documents and SettingsHP_OwnerDesktopMain BaseOther PlacesUnlockerUnlockerAssistant.exe”
O4 – HKLM..Run: [COMODO Firewall Pro] “C:Program FilesComodoFirewallCPF.exe” /background
O4 – HKCU..Run: [MsnMsgr] “C:Program FilesMSN MessengerMsnMsgr.Exe” /background
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [dm2launcher.exe] “C:PROGRA~1DESKTO~1.0dm2launcher.exe” -start
O4 – HKCU..Run: [dw0mRhcEi] ntmyerxp.exe
O4 – HKCU..Run: [MSMSGS] “C:Program FilesMessengerMsmsgs.exe” /background
O4 – HKCU..Run: [updateMgr] C:Program FilesAdobeAcrobat 7.0ReaderAdobeUpdateManager.exe AcRdB7_0_0
O4 – HKCU..Run: [BitTorrent] “C:Program FilesBitTorrentbittorrent.exe” –force_start_minimized
O4 – HKCU..Run: [Aim6] “C:Program FilesAIM6aim6.exe” /d locale=en-US ee://aol/imApp
O4 – Startup: ImationFlashDetect.lnk = C:Program FilesImationImationFlashDetect.exe
O4 – Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
O4 – Global Startup: InterVideo WinCinema Manager.lnk = C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O4 – Global Startup: SpySubtract.lnk = C:Program FilesInterMuteSpySubtractsslaunch.exe
O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra button: Research – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:PROGRA~1MI1933~1OFFICE11REFIEBAR.DLL
O9 – Extra button: AIM – {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} – C:Documents and SettingsHP_OwnerDesktopMain BaseInstant MessengersAIMaim.exe
O9 – Extra button: (no name) – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra button: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra ‘Tools’ menuitem: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O10 – Unknown file in Winsock LSP: c:windowssystem32nwprovau.dll
O16 – DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) – http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 – DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) – https://activatemydsl.verizon.net/sdcCommon/download/tgctlcm.cab
O16 – DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 – DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) – http://musicmix.messenger.msn.com/Medialogic.CAB
O16 – DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) – http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 – DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} – http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 – DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) – http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136228466031
O16 – DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} – http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 – DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 – DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) – http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 – DPF: {BD393C14-72AD-4790-A095-76522973D6B8} – http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 – DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) – http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 – Filter hijack: text/html – (no CLSID) – (no file)
O20 – AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GOEC62~1.DLL
O22 – SharedTaskScheduler: Browseui preloader – {438755C2-A8BA-11D1-B96B-00A0C90312E1} – C:WINDOWSsystem32browseui.dll
O22 – SharedTaskScheduler: Component Categories cache daemon – {8C7461EF-2B13-11d2-BE35-3078302C2030} – C:WINDOWSsystem32browseui.dll
O23 – Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) – Avira GmbH – C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 – Service: AntiVir PersonalEdition Classic Guard (AntiVirService) – AVIRA GmbH – C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 – Service: AOL Connectivity Service (AOL ACS) – America Online, Inc. – C:PROGRA~1COMMON~1AOLACSacsd.exe
O23 – Service: AOL Spyware Protection Service (AOLService) – Unknown owner – C:Program FilesCommon FilesAOLAOL Spyware Protection\aolserv.exe
O23 – Service: Comodo Application Agent (CmdAgent) – COMODO – C:Program FilesComodoFirewallcmdagent.exe
O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 – Service: ISSvc (ISSVC) – Symantec Corporation – c:Program FilesNorton Internet SecurityISSVC.exe
O23 – Service: IviRegMgr – InterVideo – C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
O23 – Service: MySQL – Unknown owner – C:Documents.exe (file missing)
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:WINDOWSsystem32nvsvc32.exe
O23 – Service: Pml Driver HPZ12 – HP – C:WINDOWSsystem32HPZipm12.exe
O23 – Service: SAVScan – Symantec Corporation – c:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
O23 – Service: StarWind iSCSI Service (StarWindService) – Rocket Division Software – C:Program FilesAlcohol SoftAlcohol 52StarWindStarWindService.exe
O23 – Service: SymWMI Service (SymWSC) – Symantec Corporation – c:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 – Service: UStorage Server Service – OTi – C:WINDOWSsystem32UStorSrv.exe
O24 – Desktop Component 0: (no name) – C:Documents and SettingsHP_OwnerDesktopMain BaseThe Art GalleryThe Anime GalleryRandom .gifs + ImagesGasaraki Header.gif
O24 – Desktop Component 1: (no name) – http://content.ytmnd.com/content/e/d/ed104d90bda3580f9c9fbe8759d2868c.gif
O24 – Desktop Component 2: (no name) – C:Documents and SettingsHP_OwnerDesktopMain BaseThe Art GalleryGIFsJellyfish.gif
O24 – Desktop Component 3: (no name) – C:Documents and SettingsHP_OwnerMy DocumentsWeb ItemsGlyphRight.gif—
End of file – 13636 bytesPhilip, at the moment I’m not having CPU problems. It just happens randomly when I for instance open a program then it may, out of nowhere, just start using up my CPU like crazy, so I would close it and then another program would start doing the same thing. Its not quite the problem in the thread you showed me, although I will try the HijackThis and post the log here.
Also I just did a registry scan with Avira and found nothing.
Also I believe the first time it happened was with my ZoneAlarm so I decided to just uninstall it and install Comodo Firewall instead…which is interesting since ZoneAlarm is mentioned in that thread. Huh.
And I just realised the only way I can change my background is through display but still it just won’t work anymore the way I normally do it, well rather I have to “verify” my changes made with display by simply going into it and pressing okay as the change I make appears there.
She keeps saying she doesn’t want to re-do everything on a new address. She wants to get her current address to work.
She insisted that it was a messenger problem that wouldn’t be solved by her logging in on a different account but I could try and coax her to try it more.
