Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

Infected?

  • 02-04-2008 9:06am
    #1
    Realtine
    Registered Users, Registered Users 2 Posts: 391 ✭✭


    Hi there, could someone take a look at this HJL file for me? Little laptop has started to act a little odd, like taking a long while to connect to internet, getting 'connection has been reset' messages, firefox browser not loading properly, and when I ran Spybot last evening, it showed a Zlob infection. Have a little bit of removal knowledge but not at all confident of what this HJL is showing me if anything.....Gratefully yours...
    p.s I use firefox and would be happy enough to take a good deal of IE off except for the main bit used for microsoft updates...any advice?


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:05:51, on 02/04/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\ibmpmsvc.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\wltrysvc.exe
    C:\WINDOWS\System32\bcmwltry.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\aniServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Comodo\CBOClean\BOCORE.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\WINDOWS\system32\wltray.exe
    C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
    C:\Program Files\NETGEAR\WPN111\wpn111.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
    O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
    O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
    O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe
    O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Belkin Wireless Monitor.lnk = C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
    O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

    --
    End of file - 7444 bytes


Comments

  • #2
    ActorSeeksJob
    Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


    Do this

    Please download Deckard's System Scanner (DSS) and save it to your Desktop.
    • Close all other windows before proceeding.
    • Double-click on dss.exe and follow the prompts.
    • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
    • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.


  • #3
    Realtine
    Registered Users, Registered Users 2 Posts: 391 ✭✭Realtine


    Thanks for reponse!

    Deckard's System Scanner v20071014.68
    Run by Sandra on 2008-04-02 14:45:49
    Computer is in Normal Mode.

    -- System Restore

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    47: 2008-04-02 13:45:57 UTC - RP249 - Deckard's System Scanner Restore Point
    46: 2008-04-01 22:51:37 UTC - RP248 - Removed Airgo Subsystem Software
    45: 2008-04-01 21:49:08 UTC - RP247 - Restore Operation
    44: 2008-04-01 21:40:41 UTC - RP246 - Restore Operation
    43: 2008-03-31 08:26:14 UTC - RP245 - Unsigned driver install


    -- First Restore Point --
    1: 2008-01-10 12:06:31 UTC - RP203 - Restore Operation


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as Sandra.exe)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:46:42, on 02/04/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\ibmpmsvc.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\wltrysvc.exe
    C:\WINDOWS\System32\bcmwltry.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\aniServ.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Comodo\CBOClean\BOCORE.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\WINDOWS\system32\wltray.exe
    C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
    C:\Program Files\NETGEAR\WPN111\wpn111.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Sandra\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Sandra.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
    O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
    O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
    O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe
    O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Belkin Wireless Monitor.lnk = C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
    O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

    --
    End of file - 7467 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\)

    backup-20080108-221148-385 O17 - HKLM\System\CCS\Services\Tcpip\..\{5FBF5D2C-AEA0-4568-B8A5-9134F9DB7E1F}: NameServer = 62.231.32.10,62.231.32.11
    backup-20080211-221138-209 O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    backup-20080211-221138-292 O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    backup-20080211-221138-395 O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    backup-20080211-221228-150 O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    backup-20080211-221228-787 O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    backup-20080211-221228-964 O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    backup-20080211-221553-415 O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    backup-20080211-222214-142 O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    backup-20080211-222214-328 O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    backup-20080211-222214-723 O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    backup-20080401-234010-109 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    -- File Associations

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled

    R1 TPPWR - c:\windows\system32\drivers\tppwr.sys <Not Verified; IBM Corp.; IBM ThinkPad Utility>
    R2 mdmxsdk - c:\windows\system32\drivers\mdmxsdk.sys <Not Verified; Conexant; Diagnostic Interface>
    R3 aeaudio - c:\windows\system32\drivers\aeaudio.sys <Not Verified; Andrea Electronics Corporation; Andrea Audio Driver>
    R3 HSF_DPV - c:\windows\system32\drivers\hsf_dpv.sys <Not Verified; Conexant Systems, Inc.; SoftK56 Modem Driver>
    R3 HSFHWICH - c:\windows\system32\drivers\hsfhwich.sys <Not Verified; Conexant Systems, Inc.; SoftK56 Modem Driver>
    R3 IBMPMDRV - c:\windows\system32\drivers\ibmpmdrv.sys <Not Verified; IBM Corp.; IBM ThinkPad>
    R3 smwdm - c:\windows\system32\drivers\smwdm.sys <Not Verified; Analog Devices, Inc.; SoundMAX Digital Audio Driver>
    R3 TPM11 (NSC Integrated Trusted Platform Module 1.1) - c:\windows\system32\drivers\nsctpm11.sys <Not Verified; National Semiconductor Corp.; TPM>
    R3 winachsf - c:\windows\system32\drivers\hsf_cnxt.sys <Not Verified; Conexant Systems, Inc.; SoftK56 Modem Driver>

    S3 DNINDIS5 (DNINDIS5 NDIS Protocol Driver) - c:\windows\system32\dnindis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
    S3 InterCheck Control - c:\program files\sophos sweep for nt\icntdrv5.sys (file missing)
    S3 InterCheck Filter - c:\program files\sophos sweep for nt\icntflt5.sys (file missing)
    S3 InterCheck Support 01 - c:\program files\sophos sweep for nt\icntst01.sys (file missing)
    S3 InterCheck Support 02 - c:\program files\sophos sweep for nt\icntst02.sys (file missing)
    S3 InterCheck Support 03 - c:\program files\sophos sweep for nt\icntst03.sys (file missing)
    S3 InterCheck Support 04 - c:\program files\sophos sweep for nt\icntst04.sys (file missing)
    S3 InterCheck Support 05 - c:\program files\sophos sweep for nt\icntst05.sys (file missing)
    S3 InterCheck Support 06 - c:\program files\sophos sweep for nt\icntst06.sys (file missing)
    S3 InterCheck Support 07 - c:\program files\sophos sweep for nt\icntst07.sys (file missing)
    S3 InterCheck Support 08 - c:\program files\sophos sweep for nt\icntst08.sys (file missing)
    S3 InterCheck Support 09 - c:\program files\sophos sweep for nt\icntst09.sys (file missing)
    S3 InterCheck Support 10 - c:\program files\sophos sweep for nt\icntst10.sys (file missing)
    S3 InterCheck Support 11 - c:\program files\sophos sweep for nt\icntst11.sys (file missing)
    S3 InterCheck Support 12 - c:\program files\sophos sweep for nt\icntst12.sys (file missing)
    S3 nmwcd (Nokia USB Phone Parent) - c:\windows\system32\drivers\nmwcd.sys <Not Verified; Nokia; >
    S3 nmwcdc (Nokia USB Generic) - c:\windows\system32\drivers\nmwcdc.sys <Not Verified; Nokia; >
    S3 WPN111 (Wireless USB 2.0 Adapter with RangeMax Service) - c:\windows\system32\drivers\wpn111.sys <Not Verified; NETGEAR, Inc.; NETGEAR WPN111>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled

    R2 ANISERVICE (Airgo Networks NIC Service) - c:\windows\system32\aniserv.exe <Not Verified; Airgo Networks, Inc.; Airgo NIC Service>
    R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
    R2 BOCore - c:\program files\comodo\cboclean\bocore.exe <Not Verified; COMODO; COMODO BOClean - Anti-Malware>
    R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
    R2 IBMPMSVC (IBM PM Service) - c:\windows\system32\ibmpmsvc.exe

    S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>
    S4 SweepNet (Sophos Anti-Virus Network) - "c:\program files\sophos sweep for nt\swnetsup.exe" (file missing)
    S4 SWEEPSRV.SYS (Sophos Anti-Virus) - "c:\program files\sophos sweep for nt\sweepsrv.sys" (file missing)
    S4 SweepUpdate (Sophos Anti-Virus Update) - "c:\program files\sophos sweep for nt\swupdate.exe" (file missing)


    -- Device Manager: Disabled

    Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
    Description: Nokia Windows Portable Device Driver
    Device ID: ROOT\WPD\0000
    Manufacturer: Nokia
    Name: Nokia 5200
    PNP Device ID: ROOT\WPD\0000
    Service: WUDFRd

    Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
    Description: Nokia 5200
    Device ID: ROOT\WPD\0001
    Manufacturer: Nokia
    Name: Nokia 5200
    PNP Device ID: ROOT\WPD\0001
    Service: WUDFRd


    -- Scheduled Tasks

    2008-02-11 09:29:37 284 --a
    C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    2007-01-08 21:36:24 314 --a
    C:\WINDOWS\Tasks\BMMTask.job


    -- Files created between 2008-03-02 and 2008-04-02

    2008-04-02 09:49:10 0 dr-h
    C:\Documents and Settings\Sandra\Recent
    2008-04-01 22:50:53 0 d
    C:\DVDVideoSoft
    2008-04-01 01:33:33 0 d
    C:\Ares Tube
    2008-03-31 18:47:34 0 d
    C:\Program Files\IrfanView
    2008-03-30 22:04:07 0 d
    C:\Program Files\iPod
    2008-03-30 22:03:59 0 d
    C:\Program Files\iTunes
    2008-03-30 22:03:32 0 d
    C:\Program Files\Bonjour
    2008-03-29 16:46:58 0 d
    C:\Program Files\MRU-Blaster
    2008-03-29 00:22:42 0 dr-h
    C:\Documents and Settings\The Others\Recent
    2008-03-28 17:30:03 0 d
    C:\Program Files\EleFun Desktops
    2008-03-28 17:29:19 0 d
    C:\Documents and Settings\Sandra\Application Data\elefundesktops
    2008-03-27 18:04:43 0 d-a
    C:\Documents and Settings\All Users\Application Data\TEMP


    -- Find3M Report

    2008-04-02 09:54:11 0 d
    C:\Program Files\SpywareBlaster
    2008-04-01 21:59:58 0 d
    C:\Program Files\Mozilla Firefox 3 Beta 3
    2008-04-01 21:56:45 0 d
    C:\Program Files\Common Files
    2008-03-31 09:54:30 18622 --a
    C:\logfile
    2008-03-07 23:17:31 0 d
    C:\Documents and Settings\Sandra\Application Data\PC Suite
    2008-02-27 02:01:53 0 d
    C:\Documents and Settings\Sandra\Application Data\Mozilla
    2008-02-25 01:39:06 0 d
    C:\Program Files\QuickTime
    2008-02-13 14:20:50 0 d-a
    C:\Program Files\virtual_garden
    2008-02-11 23:31:33 1287 --a----c- C:\WINDOWS\mozver.dat
    2008-02-11 18:39:50 0 d
    C:\Program Files\Mozilla Thunderbird
    2008-02-11 09:35:26 0 d
    C:\Program Files\Windows Live Toolbar
    2008-02-11 09:35:24 0 d
    C:\Program Files\Windows Live Favorites
    2008-02-11 09:35:10 0 d
    C:\Program Files\Winamp
    2008-02-11 09:35:10 0 d
    C:\Documents and Settings\Sandra\Application Data\Winamp
    2008-02-09 09:24:37 0 d
    C:\Program Files\Google
    2008-02-08 19:46:22 0 d
    C:\Documents and Settings\Sandra\Application Data\Google
    2008-02-08 19:38:50 0 d
    C:\Program Files\Microsoft Silverlight
    2008-02-08 19:30:09 0 d
    C:\Program Files\Pawsoft
    2008-02-08 19:18:07 0 d
    C:\Documents and Settings\Sandra\Application Data\Adobe
    2008-02-06 19:07:30 0 d--h
    C:\Program Files\InstallShield Installation Information
    2008-02-06 19:06:20 0 d
    C:\Program Files\Belkin
    2008-01-21 23:08:11 1519245 --a
    C:\WINDOWS\Starlight.scr
    2008-01-21 11:14:36 214325 --a
    C:\Documents and Settings\Sandra\Application Data\NMM-MetaData.db
    2008-01-21 00:44:54 35628 --ah---c- C:\WINDOWS\system32\mlfcache.dat


    -- Registry Dump

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [16/06/2004 11:53]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [16/06/2004 11:53]
    "IMJPMIG9.0"="C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.exe" [14/07/2003 23:57]
    "BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [25/08/2004 02:37]
    "BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [25/08/2004 02:37]
    "BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [25/08/2004 02:37]
    "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [16/09/2007 21:06]
    "wltray.exe"="C:\WINDOWS\system32\wltray.exe" [08/06/2005 17:32]
    "BOC-425"="C:\PROGRA~1\Comodo\CBOClean\BOC425.exe" [08/08/2007 19:49]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [04/12/2007 14:00]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 00:56]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Belkin Wireless Monitor.lnk - C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe [25/01/2007 14:42:04]
    NETGEAR WPN111 Smart Wizard.lnk - C:\Program Files\NETGEAR\WPN111\wpn111.exe [05/06/2007 23:09:09]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @=&quot;Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @=&quot;Volume shadow copy"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterCheck Monitor.LNK]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterCheck Monitor.LNK
    backup=C:\WINDOWS\pss\InterCheck Monitor.LNKCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
    backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jessy^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
    path=C:\Documents and Settings\Jessy\Start Menu\Programs\Startup\LimeWire On Startup.lnk
    backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sandra^Start Menu^Programs^Startup^MRU-Blaster Scheduler.lnk]
    path=C:\Documents and Settings\Sandra\Start Menu\Programs\Startup\MRU-Blaster Scheduler.lnk
    backup=C:\WINDOWS\pss\MRU-Blaster Scheduler.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sandra^Start Menu^Programs^Startup^MRU-Blaster Silent Clean.lnk]
    path=C:\Documents and Settings\Sandra\Start Menu\Programs\Startup\MRU-Blaster Silent Clean.lnk
    backup=C:\WINDOWS\pss\MRU-Blaster Silent Clean.lnkStartup


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4000 Series]
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S116.tmp" /EF "HKCU"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    "C:\Program Files\iTunes\iTunesHelper.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
    "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
    C:\Program Files\Picasa2\PicasaMediaDetector.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
    "C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" /Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "C:\Program Files\QuickTime\qttask.exe" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{1290A33C-85F5-4164-A1BE-7DD299D4986A}]
    "C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SweepUpdate"=2 (0x2)
    "SWEEPSRV.SYS"=2 (0x2)
    "SweepNet"=2 (0x2)


    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EEBF9CA6-567B-41cd-B5F6-EF2C7FEF37B5}]
    rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmactedp.inf,PerUserStub



    -- Hosts

    127.0.0.1 007guard.com
    127.0.0.1 www.007guard.com
    127.0.0.1 008i.com
    127.0.0.1 008k.com
    127.0.0.1 www.008k.com
    127.0.0.1 00hq.com
    127.0.0.1 www.00hq.com
    127.0.0.1 010402.com
    127.0.0.1 032439.com
    127.0.0.1 www.032439.com

    8072 more entries in hosts file.


    -- End of Deckard's System Scanner: finished at 2008-04-02 14:47:24


    and other one..........

    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.

    -- System Information

    Microsoft Windows XP Professional (build 2600) SP 2.0
    Architecture: X86; Language: English

    CPU 0: Intel(R) Pentium(R) M processor 1.86GHz
    Percentage of Memory in Use: 42%
    Physical Memory (total/avail): 1022.42 MiB / 585.91 MiB
    Pagefile Memory (total/avail): 2459.35 MiB / 2099.88 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1924.82 MiB

    C: is Fixed (NTFS) - 55.88 GiB total, 38.96 GiB free.
    D: is CDROM (No Media)

    \\.\PHYSICALDRIVE0 - HTS541060G9AT00 - 55.89 GiB - 1 partition
    \PARTITION0 (bootable) - Installable File System - 55.88 GiB - C:



    -- Security Center

    AUOptions is set to notify before download.
    Windows Internal Firewall is enabled.

    FW: COMODO Firewall Pro v2.3.035 (COMODO)
    AV: AVG 7.5.488 v7.5.488 (GRISOFT)
    AV: avast! antivirus 4.7.1098 [VPS 080401-0] v4.7.1098 (ALWIL Software)

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"


    -- Environment Variables

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Sandra\Application Data
    CLASSPATH=.;C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=SANDRASNETWORK
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Sandra
    LOGONSERVER=\\SANDRASNETWORK
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    OSVER=XP
    Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Belkin\Belkin Wireless Utility\Unicows;C:\Program Files\QuickTime\QTSystem\
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 6 Model 13 Stepping 8, GenuineIntel
    PROCESSOR_LEVEL=6
    PROCESSOR_REVISION=0d08
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Sandra\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Sandra\LOCALS~1\Temp
    USERDOMAIN=SANDRASNETWORK
    USERNAME=Sandra
    USERPROFILE=C:\Documents and Settings\Sandra
    windir=C:\WINDOWS


    -- User Profiles

    Sandra (admin)
    The Others (admin)
    Administrator (admin)


    -- Add/Remove Programs

    --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    A2L Assessor Engine --> MsiExec.exe /I{C5C60936-52BD-4E5E-9C09-D7F10163B8B5}
    A2L Crystal Reports Control --> MsiExec.exe /I{8EE4822B-A1A0-40E0-9A54-E08BF0D2690C}
    Ad-Aware SE Personal --> MsiExec.exe /X{78CC3BAB-DE2A-4FB4-8FBB-E4DADDC26747}
    Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A00000000001}
    Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
    Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
    ATI Display Driver --> rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
    Belkin Wireless Client Utility --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{0DACEA66-186D-4187-80B7-4D28ABBAE59D} /l1033
    Belkin Wireless Utility --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{49C090F0-4D03-4DD2-87BA-BF6AA53B9735}\setup.exe" -l0x9
    BOClean --> C:\WINDOWS\UNBOC.EXE
    Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
    CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
    CCScore --> MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}
    ClearType Tuning Control Panel Applet --> MsiExec.exe /I{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}
    COMODO Firewall Pro --> C:\Program Files\Comodo\Firewall\fwconfig.exe -uninstalln
    EPSON Attach To Email --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
    EPSON Copy Utility 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x9 -UnInstall
    EPSON File Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E86BC406-944E-41F6-ADE6-2C136734C96B}\Setup.exe" -l0x9 UNINST
    EPSON Printer Software --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
    EPSON Scan --> C:\Program Files\epson\escndv\setup\setup.exe /r
    EPSON Scan Assistant --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x9 -u
    ESSBrwr --> MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6}
    ESSCDBK --> MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}
    ESScore --> MsiExec.exe /I{42938595-0D83-404D-9F73-F8177FDD531A}
    ESSgui --> MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A}
    ESSini --> MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765}
    ESSPCD --> MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}
    ESSPDock --> MsiExec.exe /I{FCDB1C92-03C6-4C76-8625-371224256091}
    ESSSONIC --> MsiExec.exe /I{073F22CE-9A5B-4A40-A604-C7270AC6BF34}
    ESSTOOLS --> MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589}
    essvatgt --> MsiExec.exe /I{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}
    FLV Player 2.0, build 23 --> C:\Program Files\FLV Player\uninst.exe
    Foxit Reader --> C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
    GiPo@MoveOnBoot 1.9.5 --> MsiExec.exe /I{9F185C48-595B-401A-A1D6-AAB324890DC4}
    Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
    HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
    IBM ThinkPad Battery MaxiMiser and Power Management Features --> C:\WINDOWS\IsUninst.exe -fC:\PROGRA~1\ThinkPad\UTILIT~1\Unbmm.isu -c"C:\Program Files\ThinkPad\Utilities\Tpinsbmm.dll"
    IBM ThinkPad Power Management Driver --> RunDll32.exe tpinspm.dll,Uninstall
    InterActual Player --> C:\Program Files\InterActual\InterActual Player\inuninst.exe
    Internet Explorer Q903235 --> C:\WINDOWS\ieuninst.exe C:\WINDOWS\INF\Q903235.inf
    iTunes --> MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
    J2SE Runtime Environment 5.0 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030}
    Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
    kgcbase --> MsiExec.exe /I{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}
    Kodak EasyShare software --> C:\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_1e0002_175fe20\Setup.exe /APR-REMOVE
    Macromedia Flash Player --> MsiExec.exe /I{71F44A7E-624E-449E-976A-A7DEA48072E1}
    Macromedia Shockwave Player --> MsiExec.exe /I{FF89E320-01A4-43D0-BC69-93A15DCEB303}
    Map Button (Windows Live Toolbar) --> MsiExec.exe /X{ECDA9BD9-A54E-462A-8191-A2B569D9AB34}
    MediaShow 3.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5A9B7C0-8751-11D8-9D75-000129760D75}\setup.exe" -uninstall
    Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Java Virtual Machine --> MsiExec.exe /I{3CC11E1B-A1BE-4430-B7BE-C95C6B81C476}
    Microsoft Journal Viewer --> MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA7}
    Microsoft Office 2003 Proofing Tools --> MsiExec.exe /I{901F0409-6000-11D3-8CFE-0150048383C9}
    Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
    Microsoft Organization Chart 2.0 --> MsiExec.exe /I{90AE0409-6000-11D3-8CFE-0150048383C9}
    Microsoft Outlook 2003 Configuration --> MsiExec.exe /I{56A9A40A-0209-4148-B16A-9646BFBD2508}
    Microsoft PowerPoint 2003 Viewer --> MsiExec.exe /X{90AF0409-6000-11D3-8CFE-0150048383C9}
    Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft User-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
    Microsoft Windows Messenger --> MsiExec.exe /I{ABEB838C-A1A7-4C5D-B7E1-8B4314B10138}
    Mozilla Firefox (2.0.0.13) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    Mozilla Firefox (3.0b3) --> C:\Program Files\Mozilla Firefox 3 Beta 3\uninstall\helper.exe
    Mozilla Thunderbird (2.0.0.6) --> C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
    MRU-Blaster v1.5 (Database 3/28/2004) --> "C:\Program Files\MRU-Blaster\unins000.exe"
    MSVC80_x86 --> MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
    netbrdg --> MsiExec.exe /I{4537EA4B-F603-4181-89FB-2953FC695AB1}
    NETGEAR RangeMax(TM) Wireless USB 2.0 Adapter WPN111 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{582E9125-32B6-4CBA-AB48-3E33CE3DB389}\Setup.exe"
    Nokia Connectivity Cable Driver --> MsiExec.exe /X{0A3D3C54-2EC0-4D67-B265-FF17926E6D67}
    Nokia PC Suite --> C:\Documents and Settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Nokia_PC_Suite_rel_6_85_14_1_eng_web.exe
    Nokia PC Suite --> MsiExec.exe /I{29466F9C-7C6A-419C-B301-F440FAF78760}
    OfotoXMI --> MsiExec.exe /I{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}
    OneCare Advisor (Windows Live Toolbar) --> MsiExec.exe /X{DF821FC5-C198-452B-A0D4-82433EFEAE9B}
    PC Connectivity Solution --> MsiExec.exe /I{BA084E7C-8ABA-4670-BDE8-B85E689A5C1B}
    Picasa 2 --> "C:\Program Files\Picasa2\Uninstall.exe"
    Popup Blocker (Windows Live Toolbar) --> MsiExec.exe /X{117CD9C0-0F15-4633-93D7-F957B50535A5}
    PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
    PowerDVD Copy 1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3D04529-6EDB-11D8-A372-0050BAE317E1}\setup.exe" -uninstall
    QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
    RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    Riva FLV Encoder 2.0 --> "C:\Program Files\Riva\Riva FLV Encoder 2.0\unins000.exe"
    SFR --> MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B}
    SHASTA --> MsiExec.exe /I{605A4E39-613C-4A12-B56F-DEFBE6757237}
    skin0001 --> MsiExec.exe /I{5316DFC9-CE99-4458-9AB3-E8726EDE0210}
    SKINXSDK --> MsiExec.exe /I{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}
    Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{95FC661A-A0C5-4B18-92CE-90347DA79CC9}
    Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    SpywareBlaster 4.0 --> "C:\Program Files\SpywareBlaster\unins000.exe"
    staticcr --> MsiExec.exe /I{8943CE61-53BD-475E-90E1-A580869E98A2}
    ThinkPad Integrated 56K Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_05591014\HXFSETUP.EXE -U -ITkp0559K.INF
    tooltips --> MsiExec.exe /I{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}
    Visio Viewer 2003 --> MsiExec.exe /I{90520409-6000-11D3-8CFE-0150048383C9}
    VPRINTOL --> MsiExec.exe /I{999D43F4-9709-4887-9B1A-83EBB15A8370}
    Web OpenConnect --> MsiExec.exe /I{92400FA0-7893-4E6A-B494-7850AA685034}
    Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_1EB5F2E6F54A6BEDE9F436D1BA5D830FC71739BE\nokbtmdm.inf
    Windows Driver Package - Nokia Modem (10/12/2007 3.6) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_0A5D98F754C6588B2E3DDE89DDEF097075ADFFB7\nokia_bluetooth.inf
    Windows Live Favorites for Windows Live Toolbar --> MsiExec.exe /X{DCE65B11-710D-4C54-9DE5-1A6A0BD2186B}
    Windows Live Outlook Toolbar (Windows Live Toolbar) --> MsiExec.exe /X{A40D6757-B145-4FE7-B694-89180A9F3F64}
    Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {7FF0415A-C82A-4715-B31F-6DBB8D28C1CA}
    Windows Live Toolbar --> MsiExec.exe /X{7FF0415A-C82A-4715-B31F-6DBB8D28C1CA}
    Windows Live Toolbar Extension (Windows Live Toolbar) --> MsiExec.exe /X{3727B920-F5A3-46A4-AC02-94F421A039C7}
    Windows Live Toolbar Feed Detector (Windows Live Toolbar) --> MsiExec.exe /X{38024121-D084-4E7D-B1A2-1A04CB5C4CF3}
    Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
    Windows XP Default Brand Screensaver --> MsiExec.exe /I{EDAEF045-6AC9-4B2C-A8E6-9AE60337809A}
    Windows XP Master Browser Fix --> MsiExec.exe /I{511B3053-8E3F-4110-AD0D-718EB39AAAE1}
    Windows XP Recycler Fix --> MsiExec.exe /I{F7ED2161-6D72-4456-A153-376C7978BBBD}
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
    WIRELESS --> MsiExec.exe /I{F9593CFB-D836-49BC-BFF1-0E669A411D9F}
    XP Remote Access Client --> MsiExec.exe /I{2847BBEE-923F-4279-92C1-AE281ECADFF3}


    -- Application Event Log

    Event Record #/Type4730 / Error
    Event Submitted/Written: 04/02/2008 02:42:49 PM
    Event ID/Source: 100 / AVG7
    Event Description:
    2008-04-02 13:42:49,296 SANDRASNETWORK [000508:000524] ERROR 000 AVG7.AM service module run failed: Error 0x80040154

    Event Record #/Type4721 / Error
    Event Submitted/Written: 04/02/2008 09:48:16 AM
    Event ID/Source: 100 / AVG7
    Event Description:
    2008-04-02 08:48:16,625 SANDRASNETWORK [000508:000524] ERROR 000 AVG7.AM service module run failed: Error 0x80040154

    Event Record #/Type4712 / Error
    Event Submitted/Written: 04/02/2008 09:23:36 AM
    Event ID/Source: 100 / AVG7
    Event Description:
    2008-04-02 08:23:36,468 SANDRASNETWORK [000492:000508] ERROR 000 AVG7.AM service module run failed: Error 0x80040154

    Event Record #/Type4702 / Error
    Event Submitted/Written: 04/02/2008 08:18:02 AM
    Event ID/Source: 100 / AVG7
    Event Description:
    2008-04-02 07:18:02,296 SANDRASNETWORK [000500:000516] ERROR 000 AVG7.AM service module run failed: Error 0x80040154

    Event Record #/Type4694 / Error
    Event Submitted/Written: 04/01/2008 10:53:40 PM
    Event ID/Source: 100 / AVG7
    Event Description:
    2008-04-01 21:53:40,546 SANDRASNETWORK [000508:000520] ERROR 000 AVG7.AM service module run failed: Error 0x80040154



    -- Security Event Log

    No Errors/Warnings found.


    -- System Event Log

    Event Record #/Type11119 / Warning
    Event Submitted/Written: 04/02/2008 02:42:10 PM / 04/02/2008 02:43:08 PM
    Event ID/Source: 4 / b57w2k
    Event Description:
    Broadcom NetXtreme Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.

    Event Record #/Type11117 / Warning
    Event Submitted/Written: 04/02/2008 02:43:08 PM
    Event ID/Source: 1003 / Dhcp
    Event Description:
    Your computer was not able to renew its address from the network (from the
    DHCP Server) for the Network Card with network address 001150EC5EC6. The following
    error occurred:
    %%1223.
    Your computer will continue to try and obtain an address on its own from
    the network address (DHCP) server.

    Event Record #/Type11111 / Warning
    Event Submitted/Written: 04/02/2008 09:47:37 AM / 04/02/2008 09:48:35 AM
    Event ID/Source: 4 / b57w2k
    Event Description:
    Broadcom NetXtreme Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.

    Event Record #/Type11104 / Warning
    Event Submitted/Written: 04/02/2008 09:22:54 AM / 04/02/2008 09:23:52 AM
    Event ID/Source: 4 / b57w2k
    Event Description:
    Broadcom NetXtreme Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.

    Event Record #/Type11099 / Error
    Event Submitted/Written: 04/02/2008 09:22:09 AM
    Event ID/Source: 10005 / DCOM
    Event Description:
    DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
    in order to run the server:
    {1BE1F766-5536-11D1-B726-00C04FB926AF}



    -- End of Deckard's System Scanner: finished at 2008-04-02 14:47:24


  • #4
    ActorSeeksJob
    Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


    Hello

    You have two firewalls, so you need to disable Windows firewall

    1. Click Start, click Run, type Firewall.cpl, and then click OK.
    2. On the General tab, click Off (not recommended), and then click OK.



    You also have two anti-virus programs, AVG and Avast, you need to remove one of these


    Reboot and do this

    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner and click Accept

    You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases

        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer

        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save as Text button:
        [*]Save the file to your desktop.
        [*]Copy and paste that information in your next post.



        Also tell me how your PC is running


      • #5
        Realtine
        Registered Users, Registered Users 2 Posts: 391 ✭✭Realtine


        OK - Was very surprised by results of the kapersky scan! :eek:Let's see what you can do for me here ..
        Computer is doing ok except for I think a little slow in starting up and shutting down, take a little while in connecting to the internet also, but I think that might be the ISP.

        Was surprised to find AVG still on it as I thought it had been disabled eons ago, same goes for Windows firewall - again thought it had been disabled...

        Anyway - here goes!
        KASPERSKY ONLINE SCANNER REPORT
        Thursday, April 03, 2008 3:24:56 AM
        Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
        Kaspersky Online Scanner version: 5.0.98.0
        Kaspersky Anti-Virus database last update: 2/04/2008
        Kaspersky Anti-Virus database records: 678701

        Scan Settings:
        Scan using the following antivirus database: extended
        Scan Archives: true
        Scan Mail Bases: true

        Scan Target - My Computer:
        C:\
        D:\

        Scan Statistics:
        Total number of scanned objects: 74752
        Number of viruses found: 6
        Number of infected objects: 57
        Number of suspicious objects: 0
        Duration of the scan process: 01:46:42

        Infected Object Name / Virus Name / Last Action
        C:\Documents and Settings\Administrator\Application Data\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\HTML Help\hh.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2003.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office PowerPoint 2003.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Media Player\000140CD.wpl Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\MSO2057.acl Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\1.0.1.LNK Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\COE01069.LNK Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Templates.LNK Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped
        C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Themes\Custom.theme Object is locked skipped
        C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Desktop\QuickTime Player.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Favorites\Links\Customize Links.url Object is locked skipped
        C:\Documents and Settings\Administrator\Favorites\Links\Free Hotmail.url Object is locked skipped
        C:\Documents and Settings\Administrator\Favorites\Links\Windows Media.url Object is locked skipped
        C:\Documents and Settings\Administrator\Favorites\Links\Windows.url Object is locked skipped
        C:\Documents and Settings\Administrator\Favorites\MSN.com.url Object is locked skipped
        C:\Documents and Settings\Administrator\Favorites\Radio Station Guide.url Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\CD Burning\My Videos\Desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\HelpCtr\HelpSessionHistory.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Media Player\wmpfolders.wmdb Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\History\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007040920070416\index.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007041920070420\index.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\diauto.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC1.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC2.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC3.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC4.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC5.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC6.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC7.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC8.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLC9.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLCA.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\GLCB.tmp Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT2C.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT2D.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT2E.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT5C.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT5D.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT5E.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT5F.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT60.dtd Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT61.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT62.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\IMT63.xml Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temp\Office 11 Maintenance(0000).TXT Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\37PTM0ZK\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\37PTM0ZK\shared[1].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\37PTM0ZK\shared[2].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\37PTM0ZK\shared[3].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ENFMSI1N\Common[1].js Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ENFMSI1N\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ENFMSI1N\shared[1].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ENFMSI1N\shared[2].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ENFMSI1N\shared[3].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IRWP6WQS\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IRWP6WQS\shared[1].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IRWP6WQS\shared[2].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\Common[1].js Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\Common[2].js Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\Homepage__DESKTOP[1].js Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\Homepage__SHARED[1].js Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\shared[1].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\shared[2].css Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MCN3JXRD\wrapperparam[1].js Object is locked skipped
        C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\My Documents\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\My Documents\My Music\Desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\My Documents\My Music\Sample Music.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\My Documents\My Videos\Desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\ntuser.dat Object is locked skipped
        C:\Documents and Settings\Administrator\NTUSER.DAT.LOG Object is locked skipped
        C:\Documents and Settings\Administrator\ntuser.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\1.0.1.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\BUILDXP.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\CD Drive.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\COE01069.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\COE01069_UB ROI and FA - Update and View.mst.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\Install.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\installerxp.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\Pbk.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\rasphone.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\RBS.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\Sample Pictures.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\Sunset.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\Track01.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\Track02.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Recent\Track04.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\SendTo\Compressed (zipped) Folder.ZFSendToTarget Object is locked skipped
        C:\Documents and Settings\Administrator\SendTo\Desktop (create shortcut).DeskLink Object is locked skipped
        C:\Documents and Settings\Administrator\SendTo\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\SendTo\Mail Recipient.MAPIMail Object is locked skipped
        C:\Documents and Settings\Administrator\SendTo\My Documents.mydocs Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Command Prompt.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Notepad.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Synchronize.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Tour Windows XP.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Windows Explorer.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\desktop.ini Object is locked skipped
        C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\amipro.sam Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\excel.xls Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\excel4.xls Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\lotus.wk4 Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\powerpnt.ppt Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\presenta.shw Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\quattro.wb2 Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\sndrec.wav Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\winword.doc Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\winword2.doc Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\wordpfct.wpd Object is locked skipped
        C:\Documents and Settings\Administrator\Templates\wordpfct.wpg Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
        C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
        C:\Documents and Settings\Sandra\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped
        C:\Documents and Settings\Sandra\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3614 Infected: not-a-virus:NetTool.Win32.Portscan.c skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3793 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3795 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3798 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3851 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3854 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3855 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file3856 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file4095/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file4095/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe/file4095 Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\Documents and Settings\Sandra\Desktop\Downloads\Tools jess\UBCD4WinV310.exe Inno: infected - 11 skipped
        C:\Documents and Settings\Sandra\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\Sandra\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\Sandra\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Sandra\Local Settings\Temp\~DF2D3C.tmp Object is locked skipped
        C:\Documents and Settings\Sandra\Local Settings\Temp\~DFAD11.tmp Object is locked skipped
        C:\Documents and Settings\Sandra\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
        C:\Documents and Settings\Sandra\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Sandra\ntuser.dat Object is locked skipped
        C:\Documents and Settings\Sandra\NTUSER.DAT.LOG Object is locked skipped
        C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
        C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
        C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
        C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
        C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
        C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
        C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
        C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070725.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070725.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070725.exe RarSFX: infected - 2 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070812.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070814.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070815.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070816.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070845.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070847.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070849.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP217\A0070977.exe Infected: not-a-virus:NetTool.Win32.Portscan.c skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075568.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075568.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075568.exe RarSFX: infected - 2 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075652.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075653.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075654.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075656.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075698.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075700.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075702.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP222\A0075819.exe Infected: not-a-virus:NetTool.Win32.Portscan.c skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP248\A0097694.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP248\A0097694.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP248\A0097694.exe RarSFX: infected - 2 skipped
        C:\System Volume Information\_restore{83300D33-5FAB-49B3-BE4A-939BF51BA039}\RP251\change.log Object is locked skipped
        C:\UBCD\UBCD4Win\BartPE\programs\IPScan\ipscan.exe Infected: not-a-virus:NetTool.Win32.Portscan.c skipped
        C:\UBCD\UBCD4Win\BartPE\programs\Keyfinder\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\UBCD\UBCD4Win\BartPE\programs\Keyfinder\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\UBCD\UBCD4Win\BartPE\programs\Keyfinder\keyfinder.exe RarSFX: infected - 2 skipped
        C:\UBCD\UBCD4Win\BartPE\programs\ultravnc\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\UBCD\UBCD4Win\BartPE\programs\ultravnc\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
        C:\UBCD\UBCD4Win\BartPE\programs\ultravnc\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\UBCD\UBCD4Win\BartPE\programs\vncserver\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\UBCD\UBCD4Win\BartPE\programs\vncserver\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\UBCD2\UBCD4Win\BartPE\I386\SYSTEM32\WM_HOOKS.DLL Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\IPScan\ipscan.exe Infected: not-a-virus:NetTool.Win32.Portscan.c skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\Keyfinder\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\Keyfinder\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\Keyfinder\keyfinder.exe RarSFX: infected - 2 skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\ultravnc\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\ultravnc\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\ultravnc\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\vncserver\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\UBCD2\UBCD4Win\BartPE\PROGRAMS\vncserver\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
        C:\WINDOWS\$NtUninstallKB321936$\cscdll.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB321936$\mrxsmb.sys Object is locked skipped
        C:\WINDOWS\$NtUninstallKB321936$\rdbss.sys Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\hh.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\hhctrl.ocx Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\itircl.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\itss.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\ole32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\osk.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\rpcrt4.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\rpcss.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\shmedia.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\user32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\win32k.sys Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB826939$\zipfldr.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\dao360.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\expsrv.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msexch40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msexcl40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msjet40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msjetol1.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msjetoledb40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msjint40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msjter40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msjtes40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msltus40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\mspbde40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msrd2x40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msrd3x40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msrepl40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\mstext40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\mswdat10.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\mswstr10.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\msxbde40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB829558$\vbajet32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB833407$\bssym7.ttf Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\evtgprov.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\xpsp2res.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB837001$\msjetol1.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB839645$\xpsp2res.dll Object is locked skipped
        C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
        C:\WINDOWS\SchedLgU.Txt Object is locked skipped
        C:\WINDOWS\SoftwareDistribution\EventCache\{4172D402-19FC-4B6B-A70D-CDCF86747EF1}.bin Object is locked skipped
        C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
        C:\WINDOWS\Sti_Trace.log Object is locked skipped
        C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
        C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
        C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
        C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\default Object is locked skipped
        C:\WINDOWS\system32\config\default.LOG Object is locked skipped
        C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
        C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
        C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
        C:\WINDOWS\system32\config\SAM Object is locked skipped
        C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
        C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\SECURITY Object is locked skipped
        C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
        C:\WINDOWS\system32\config\software Object is locked skipped
        C:\WINDOWS\system32\config\software.LOG Object is locked skipped
        C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\system Object is locked skipped
        C:\WINDOWS\system32\config\system.LOG Object is locked skipped
        C:\WINDOWS\system32\h323log.txt Object is locked skipped
        C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
        C:\WINDOWS\Temp\Perflib_Perfdata_74c.dat Object is locked skipped
        C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
        C:\WINDOWS\wiadebug.log Object is locked skipped
        C:\WINDOWS\wiaservc.log Object is locked skipped
        C:\WINDOWS\WindowsUpdate.log Object is locked skipped

        Scan process completed.


      • #6
        ActorSeeksJob
        Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


        Looking good

        Which anti-virus did you remove, AVG ?

        Lets see a new DSS log so I can make sure it's all gone


      • Advertisement
      • #7
        Realtine
        Registered Users, Registered Users 2 Posts: 391 ✭✭Realtine



        Yp AVG is gone



        here we go...


        Deckard's System Scanner v20071014.68
        Run by Sandra on 2008-04-03 13:58:05
        Computer is in Normal Mode.



        -- HijackThis (run as Sandra.exe)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 13:58:09, on 03/04/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16608)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\ibmpmsvc.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\wltrysvc.exe
        C:\WINDOWS\System32\bcmwltry.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\System32\aniServ.exe
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        C:\Program Files\Comodo\CBOClean\BOCORE.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Comodo\Firewall\cmdagent.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\WINDOWS\system32\RunDll32.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Comodo\Firewall\CPF.exe
        C:\WINDOWS\system32\wltray.exe
        C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
        C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
        C:\Program Files\NETGEAR\WPN111\wpn111.exe
        C:\Documents and Settings\Sandra\Desktop\dss.exe
        C:\PROGRA~1\TRENDM~1\HIJACK~1\Sandra.exe

        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
        O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
        O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
        O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
        O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
        O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
        O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe
        O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Belkin Wireless Monitor.lnk = C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
        O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
        O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

        --
        End of file - 8033 bytes

        -- Files created between 2008-03-03 and 2008-04-03

        2008-04-03 01:22:22 0 d
        C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
        2008-04-03 01:22:20 0 d
        C:\WINDOWS\system32\Kaspersky Lab
        2008-04-03 01:15:10 0 dr-h
        C:\Documents and Settings\Sandra\Recent
        2008-04-03 00:37:59 0 d
        C:\Program Files\Microsoft.NET
        2008-04-03 00:34:37 0 d
        C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-01 22:50:53 0 d
        C:\DVDVideoSoft
        2008-04-01 01:33:33 0 d
        C:\Ares Tube
        2008-03-31 18:47:34 0 d
        C:\Program Files\IrfanView
        2008-03-30 22:04:07 0 d
        C:\Program Files\iPod
        2008-03-30 22:03:59 0 d
        C:\Program Files\iTunes
        2008-03-30 22:03:32 0 d
        C:\Program Files\Bonjour
        2008-03-29 16:46:58 0 d
        C:\Program Files\MRU-Blaster
        2008-03-29 00:22:42 0 dr-h
        C:\Documents and Settings\The Others\Recent
        2008-03-28 17:30:03 0 d
        C:\Program Files\EleFun Desktops
        2008-03-28 17:29:19 0 d
        C:\Documents and Settings\Sandra\Application Data\elefundesktops
        2008-03-27 18:04:43 0 d-a
        C:\Documents and Settings\All Users\Application Data\TEMP


        -- Find3M Report

        2008-04-03 00:39:00 0 d
        C:\Program Files\Microsoft Works
        2008-04-02 09:54:11 0 d
        C:\Program Files\SpywareBlaster
        2008-04-01 21:59:58 0 d
        C:\Program Files\Mozilla Firefox 3 Beta 3
        2008-04-01 21:56:45 0 d
        C:\Program Files\Common Files
        2008-03-31 09:54:30 18622 --a
        C:\logfile
        2008-03-07 23:17:31 0 d
        C:\Documents and Settings\Sandra\Application Data\PC Suite
        2008-02-27 02:01:53 0 d
        C:\Documents and Settings\Sandra\Application Data\Mozilla
        2008-02-25 01:39:06 0 d
        C:\Program Files\QuickTime
        2008-02-13 14:20:50 0 d-a
        C:\Program Files\virtual_garden
        2008-02-11 23:31:33 1287 --a----c- C:\WINDOWS\mozver.dat
        2008-02-11 18:39:50 0 d
        C:\Program Files\Mozilla Thunderbird
        2008-02-11 09:35:26 0 d
        C:\Program Files\Windows Live Toolbar
        2008-02-11 09:35:24 0 d
        C:\Program Files\Windows Live Favorites
        2008-02-11 09:35:10 0 d
        C:\Program Files\Winamp
        2008-02-11 09:35:10 0 d
        C:\Documents and Settings\Sandra\Application Data\Winamp
        2008-02-09 09:24:37 0 d
        C:\Program Files\Google
        2008-02-08 19:46:22 0 d
        C:\Documents and Settings\Sandra\Application Data\Google
        2008-02-08 19:38:50 0 d
        C:\Program Files\Microsoft Silverlight
        2008-02-08 19:30:09 0 d
        C:\Program Files\Pawsoft
        2008-02-08 19:18:07 0 d
        C:\Documents and Settings\Sandra\Application Data\Adobe
        2008-02-06 19:07:30 0 d--h
        C:\Program Files\InstallShield Installation Information
        2008-02-06 19:06:20 0 d
        C:\Program Files\Belkin
        2008-01-21 23:08:11 1519245 --a
        C:\WINDOWS\Starlight.scr
        2008-01-21 11:14:36 214325 --a
        C:\Documents and Settings\Sandra\Application Data\NMM-MetaData.db
        2008-01-21 00:44:54 35628 --ah---c- C:\WINDOWS\system32\mlfcache.dat


        -- Registry Dump

        *Note* empty entries & legit default entries are not shown


        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [16/06/2004 11:53]
        "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [16/06/2004 11:53]
        "IMJPMIG9.0"="C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.exe" [14/07/2003 23:57]
        "BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [25/08/2004 02:37]
        "BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [25/08/2004 02:37]
        "BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [25/08/2004 02:37]
        "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [16/09/2007 21:06]
        "wltray.exe"="C:\WINDOWS\system32\wltray.exe" [08/06/2005 17:32]
        "BOC-425"="C:\PROGRA~1\Comodo\CBOClean\BOC425.exe" [08/08/2007 19:49]
        "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [04/12/2007 14:00]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 00:56]
        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [08/02/2008 19:46]

        [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
        "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

        C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
        Belkin Wireless Monitor.lnk - C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe [25/01/2007 14:42:04]
        NETGEAR WPN111 Smart Wizard.lnk - C:\Program Files\NETGEAR\WPN111\wpn111.exe [05/06/2007 23:09:09]

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
        @=&quot;Service"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
        @=&quot;Volume shadow copy"

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterCheck Monitor.LNK]
        path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterCheck Monitor.LNK
        backup=C:\WINDOWS\pss\InterCheck Monitor.LNKCommon Startup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
        path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
        backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jessy^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
        path=C:\Documents and Settings\Jessy\Start Menu\Programs\Startup\LimeWire On Startup.lnk
        backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sandra^Start Menu^Programs^Startup^MRU-Blaster Scheduler.lnk]
        path=C:\Documents and Settings\Sandra\Start Menu\Programs\Startup\MRU-Blaster Scheduler.lnk
        backup=C:\WINDOWS\pss\MRU-Blaster Scheduler.lnkStartup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sandra^Start Menu^Programs^Startup^MRU-Blaster Silent Clean.lnk]
        path=C:\Documents and Settings\Sandra\Start Menu\Programs\Startup\MRU-Blaster Silent Clean.lnk
        backup=C:\WINDOWS\pss\MRU-Blaster Silent Clean.lnkStartup


        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4000 Series]
        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S116.tmp" /EF "HKCU"

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
        "C:\Program Files\iTunes\iTunesHelper.exe"

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
        "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
        C:\Program Files\Picasa2\PicasaMediaDetector.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
        "C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" /Startup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
        "C:\Program Files\QuickTime\qttask.exe" -atboottime

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
        "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
        "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
        C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
        "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{1290A33C-85F5-4164-A1BE-7DD299D4986A}]
        "C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe"

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
        "SweepUpdate"=2 (0x2)
        "SWEEPSRV.SYS"=2 (0x2)
        "SweepNet"=2 (0x2)


        [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EEBF9CA6-567B-41cd-B5F6-EF2C7FEF37B5}]
        rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmactedp.inf,PerUserStub



        -- End of Deckard's System Scanner: finished at 2008-04-03 13:58:46


      • #8
        ActorSeeksJob
        Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


        It's still there, that will cause problems.

        Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

        Grisoft


        1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

        2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



        Open Notepad and Copy (Control+C) and Paste (Control+V) the following code into the Notepad window.

        @echo off
sc stop Avg7Alrt
sc delete Avg7Alrt
sc stop Avg7UpdSvc
sc delete Avg7UpdSvc
sc stop AVGEMS
sc delete AVGEMS
exit


        Click on 'File' then 'Save As'
        In the Save in drop down box select Desktop
        In the File name box type in FixService.bat
        In the Save as type drop down box select All Files
        Close Notepad.

        Now, find FixService.bat on your Desktop and Double click it
        A window will open and close, do not be concerned this is normal.


        Then reboot and delete this folder in bold

        C:\PROGRA~1\Grisoft

        And post a new HijackThis log


      • #9
        Realtine
        Registered Users, Registered Users 2 Posts: 391 ✭✭Realtine


        IT WONT GO AWAY!

        I cannot find AVG or Grisoft in Add/Remove Progs..
        I don't know where it's hiding..and when I check the items in HJT it just reappears again...what should I do?

        ad on!

        OK I've done the notebook request and rebooted but the only Grisoft I can find is if I do a 'search' and it comes up as a folder 'grisoft' in C : programmes - its a full folder full of stuff - is this what I should delete or should i be searching elsewhere.....?


      • #10
        ActorSeeksJob
        Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


        Yes that is what you want to delete

        Reboot after that and post a new HijackThis log


      • #11
        Realtine
        Registered Users, Registered Users 2 Posts: 391 ✭✭Realtine


        OK here we go...HJT



        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 19:05:06, on 03/04/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16608)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\ibmpmsvc.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\wltrysvc.exe
        C:\WINDOWS\System32\bcmwltry.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\System32\aniServ.exe
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Comodo\CBOClean\BOCORE.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Comodo\Firewall\cmdagent.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\system32\RunDll32.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Comodo\Firewall\CPF.exe
        C:\WINDOWS\system32\wltray.exe
        C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
        C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
        C:\Program Files\NETGEAR\WPN111\wpn111.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
        O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
        O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
        O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
        O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
        O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
        O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe
        O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Belkin Wireless Monitor.lnk = C:\Program Files\Belkin\F5D9010v4\Belkinwcui.exe
        O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
        O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

        --
        End of file - 7719 bytes


      • Advertisement
      • #12
        ActorSeeksJob
        Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


        Your logs are clean ! We need to do a few things

        You can delete the tools that we used


        You now need to update your Java and remove your older versions.

        Please follow these steps to remove older version Java components.

        * Click Start > Control Panel.
        * Click Add/Remove Programs.
        * Check any item with Java Runtime Environment (JRE) in the name.
        * Click the Remove or Change/Remove button.

        Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
        here



        Now we need to create a new System Restore point.

        Click Start Menu > Run > type (or copy and paste)

        %SystemRoot%\System32\restore\rstrui.exe

        Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

        Next goto Start Menu > Run > type

        cleanmgr

        Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

        To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



        Below I have included a number of recommendations for how to protect your computer against malware infections.

        * Keep Windows updated by regularly checking their website at :
        http://windowsupdate.microsoft.com/
        This will ensure your computer has always the latest security updates available installed on your computer.

        * To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
        SpywareBlaster protects against bad ActiveX
        IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
        Have a look at this tutorial for IE-Spyad here

        * SpywareGuard offers realtime protection from spyware installation attempts.

        Make Internet Explorer more secure
        • Click Start > Run
        • Type Inetcpl.cpl & click OK
        • Click on the Security tab
        • Click Reset all zones to default level
        • Make sure the Internet Zone is selected & Click Custom level
        • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
        • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

        * MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

        * Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
        secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
        blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
        Here

        * Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
        Here

        Thank you for your patience, and performing all of the procedures requested.


      • #13
        Realtine
        Registered Users, Registered Users 2 Posts: 391 ✭✭Realtine


        Thank you for help resolving this issue.

        You just never know do you! I thought I kept a pretty secure PC.
        Will take your recommendations on board immediately.

        Muchas gracias


      Advertisement