Mobile/PDA About Us Advertise here
User User name Password  
  Not registered yet? Register here.
Lost your password? Click here. 		 
  Home   News   Guides   Downloads   Glossary   Hardware   Profiles   Forums   v4  
 Advertise at AfterDawn.com     Link to us!     Private messages     Compose a private message     List of all updated threads     Threads without replies     Search messages
Monday 10.3.2025 / 06:22
Search AfterDawn Forums:        In English   Suomeksi   På svenska
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > help
Show topics
 
Forums
Forums
Help
  Jump to:
 
Posted Message
Robbbb
Newbie
_ 		18. December 2007 @ 18:40 _ Link to this message    Send private message to this user   
Hello all,

My sister has a virus on her pc which constantly produces pop ups such as 'windows security alert your computer is under attack'.

I have scanned with spybot & norton, but to no avail.

Any help would be appreciated.

Here is the Hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:06:01, on 19/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\sessmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PCEye2000\pceye.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lexmark P910 Series\lxbymon.exe
C:\Program Files\Lexmark P910 Series\ezprint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\lxbycoms.exe
C:\WINDOWS\system32\pcwpx.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\RDSHOST.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LXBYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PcEye] C:\Program Files\PCEye2000\pceye.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [lxbymon.exe] "C:\Program Files\Lexmark P910 Series\lxbymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark P910 Series\ezprint.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.iqon.ie
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Share...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1120502833140
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/ct.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O21 - SSODL: leorop - {E0D7103D-3FF5-4F65-A8C5-F55F489B8198} - C:\WINDOWS\leorop.dll
O21 - SSODL: nopzet - {8E9ABAC6-3511-4DE2-BC1A-C1569B9A6E98} - C:\WINDOWS\nopzet.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxby_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbycoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://rds.yahoo.com/S=96062883/K=butter...blue-flower.jpg

--
End of file - 10577 bytes
[ + quote]
Advertisement
_ 		__
QuikDraw
Senior Member
_ 		19. December 2007 @ 15:02 _ Link to this message    Send private message to this user   
Try this:
http://www.afterdawn.com/software/deskto...mitfraudfix.cfm
You will need to boot into safe mode to run this program.
[ + quote]
Robbbb
Newbie
_ 		20. December 2007 @ 10:56 _ Link to this message    Send private message to this user   
Thanks quickdraw m8 - worked a treat - ladies and gentleman, quickdraw rules
[ + quote]
QuikDraw
Senior Member
_ 		20. December 2007 @ 13:00 _ Link to this message    Send private message to this user   
Great! Here's another one to remove. R0 -HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
Reboot into safe mode, run Hijackthis, put a check mark next to the above entry. Click Fix.
Run HijackThis again and post the new log report. Want to make sure we got rid of these entries as well. leorop.dll, and Noplet.dll
May need to manually remove from the registry.
[ + quote]

This message has been edited since posting. Last time this message was edited on 20. December 2007 @ 13:47
echoreply
Member
_ 		20. December 2007 @ 17:21 _ Link to this message    Send private message to this user   
FYI; smitfraudfix also produces logs after running the two steps. while your popups may be gone you could still have other malware often bundled with the smitfraud "package" thats the reason why it generates logs.
[ + quote]
http://www.virusvault.us/
Robbbb
Newbie
_ 		21. December 2007 @ 06:26 _ Link to this message    Send private message to this user   
Hey Quickdraw & Echo,

Sorry for the delay but the problem isn't on my pc so i have to connect to my sisters to get logs etc so please be patient with me.

Another error i notice is that I cannot open the registry. It just comes on for a fewseconds then disappears. I haave googled the problem and it is supposedly a virus but there doesn't seem to be a straightforward solution though i'll keep looking.
[ + quote]
QuikDraw
Senior Member
_ 		21. December 2007 @ 07:16 _ Link to this message    Send private message to this user   
If your Regedit, Msconfig, and MSN Messenger 6.0, are disappearing you diffenitly have another virus. Along with posting a new Hijack Log. Echo, has a good point, post a Smitfraudfix Log as well. In addition, download Combofix, and post that Log, too. http://forums.majorgeeks.com/showthread.php?t=134965
Have you or your sister been downloading from Kazaa, or Limewire?
[ + quote]

This message has been edited since posting. Last time this message was edited on 21. December 2007 @ 07:17
Robbbb
Newbie
_ 		21. December 2007 @ 07:33 _ Link to this message    Send private message to this user   
She uses limewire all the time, why is that a problem?
[ + quote]
QuikDraw
Senior Member
_ 		21. December 2007 @ 07:53 _ Link to this message    Send private message to this user   
I thought so, this is most likely how she got the PC infected. Work at getting those 3 logs posted. Take your time.
[ + quote]

This message has been edited since posting. Last time this message was edited on 21. December 2007 @ 07:56
Robbbb
Newbie
_ 		21. December 2007 @ 08:09 _ Link to this message    Send private message to this user   
Thanks for being so patiet quickdraw, the problem is she is in Ireland and i'm in uk so i have to connect to her pc each time i want to do anything
[ + quote]
Robbbb
Newbie
_ 		21. December 2007 @ 11:46 _ Link to this message    Send private message to this user   
Alright quickdraw m8, here are the logs:

ComboFix 07-12-21.4 - Dorothy 2007-12-21 16:34:42.1 - NTFSx86
Running from: C:\Documents and Settings\Dorothy\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Dorothy\Application Data\Starware316
C:\Documents and Settings\Dorothy\Application Data\Starware316\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Configurator\Configurator.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Configurator\Configurator.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Games\GamesOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Games\GamesOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Games\images\active\Games0.bmp
C:\Documents and Settings\Dorothy\Application Data\Starware316\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Manager\ManagerOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Movies\images\active\Movies0.bmp
C:\Documents and Settings\Dorothy\Application Data\Starware316\Movies\MoviesOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Reference\ReferenceOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Screensavers\ScreensaversOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Screensavers\ScreensaversOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
C:\Documents and Settings\Dorothy\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Dorothy\Application Data\Starware316\Weather\AlertArchive.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Weather\WeatherOptions.xml
C:\Documents and Settings\Dorothy\Application Data\Starware316\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316
C:\Documents and Settings\Joseph\Application Data\Starware316\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Configurator\Configurator.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Configurator\Configurator.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Games\GamesOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Games\GamesOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Games\images\active\Games0.bmp
C:\Documents and Settings\Joseph\Application Data\Starware316\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Manager\ManagerOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Movies\images\active\Movies0.bmp
C:\Documents and Settings\Joseph\Application Data\Starware316\Movies\MoviesOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Reference\ReferenceOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Screensavers\ScreensaversOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Screensavers\ScreensaversOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
C:\Documents and Settings\Joseph\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Tem6.tmp
C:\Documents and Settings\Joseph\Application Data\Starware316\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Joseph\Application Data\Starware316\Weather\AlertArchive.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Weather\WeatherOptions.xml
C:\Documents and Settings\Joseph\Application Data\Starware316\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Joseph\Favorites\Error Cleaner.url
C:\Documents and Settings\Joseph\Favorites\Privacy Protector.url
C:\Documents and Settings\Joseph\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Lisa\Application Data\Starware316
C:\Documents and Settings\Lisa\Application Data\Starware316\BrowserSearch\BrowserSearch.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\BrowserSearch\BrowserSearch.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Configurator\Configurator.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Configurator\Configurator.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\ErrorSearch\ErrorSearchOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Games\GamesOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Games\GamesOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Games\images\active\Games0.bmp
C:\Documents and Settings\Lisa\Application Data\Starware316\Layouts\ToolbarLayout.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Layouts\ToolbarLayout.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Manager\ManagerOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Manager\ManagerOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Movies\images\active\Movies0.bmp
C:\Documents and Settings\Lisa\Application Data\Starware316\Movies\MoviesOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Movies\MoviesOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Reference\ReferenceOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Reference\ReferenceOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\RelatedSearch\RelatedSearchOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Screensavers\ScreensaversOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Screensavers\ScreensaversOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp
C:\Documents and Settings\Lisa\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\TemD.tmp
C:\Documents and Settings\Lisa\Application Data\Starware316\Toolbar\TBProductsOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Toolbar\TBProductsOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\ToolbarLogo\ToolbarLogoOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\ToolbarSearch\ToolbarSearchOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\TravelSearch\TravelSearchOptions.xml.backup
C:\Documents and Settings\Lisa\Application Data\Starware316\Weather\AlertArchive.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Weather\WeatherOptions.xml
C:\Documents and Settings\Lisa\Application Data\Starware316\Weather\WeatherOptions.xml.backup
C:\Documents and Settings\Lisa\Favorites\Error Cleaner.url
C:\Documents and Settings\Lisa\Favorites\Privacy Protector.url
C:\Documents and Settings\Lisa\Favorites\Spyware&Malware Protection.url
C:\WINDOWS\dat.txt
C:\WINDOWS\search_res.txt

.
((((((((((((((((((((((((( Files Created from 2007-11-21 to 2007-12-21 )))))))))))))))))))))))))))))))
.

2007-12-19 15:25 . 2007-12-19 15:31 3,096 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-18 23:47 . 2007-12-18 23:47 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-18 18:59 . 2007-12-18 18:59 1,158 --a------ C:\WINDOWS\mozver.dat
2007-12-17 12:41 . 2007-12-17 12:41 0 --a------ C:\WINDOWS\nsreg.dat
2007-12-16 19:48 . 2007-12-16 19:48 <DIR> d-------- C:\Program Files\Smith Micro
2007-12-16 18:28 . 2007-12-16 18:28 <DIR> d-------- C:\Documents and Settings\All Users\Symantec Temporary Files

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-21 16:41 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-19 03:16 --------- d-----w C:\Documents and Settings\Lisa\Application Data\BFGTOOLBAR
2007-12-18 20:02 --------- d-----w C:\Program Files\Lavasoft
2007-12-18 20:02 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-12-18 10:36 --------- d-----w C:\Program Files\Norton Internet Security
2007-12-16 18:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-16 18:03 --------- d-----w C:\Program Files\Creative
2007-12-16 18:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-16 18:01 --------- d-----w C:\Program Files\Azureus
2007-12-16 17:56 --------- d-----w C:\Program Files\MSN Games
2007-12-16 17:55 --------- d-----w C:\Documents and Settings\Lisa\Application Data\LimeWire
2007-12-13 17:33 --------- d-----w C:\Documents and Settings\Lisa\Application Data\Azureus
2007-12-09 14:04 --------- d-----w C:\Documents and Settings\Dorothy\Application Data\PlayFirst
2007-12-09 14:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
2007-12-01 13:30 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-27 17:03 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-27 17:03 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-27 17:03 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-27 17:03 --------- d-----w C:\Program Files\Symantec
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 17:45 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-29 16:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\SpinTop Games
2007-10-22 16:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\BigFishGames
2007-10-22 00:30 --------- d-----w C:\Program Files\MSN Messenger
2007-06-03 01:32 154 ----a-w C:\Documents and Settings\Dorothy\Application Data\wklnhst.dat
2007-04-24 19:47 8,564 ----a-w C:\Documents and Settings\Joseph\Application Data\wklnhst.dat
2007-04-16 13:32 106,480 ----a-w C:\Documents and Settings\Dorothy\Application Data\GDIPFONTCACHEV1.DAT
2006-12-24 20:35 92,064 ----a-w C:\Documents and Settings\Lisa\mqdmmdm.sys
2006-12-24 20:35 9,232 ----a-w C:\Documents and Settings\Lisa\mqdmmdfl.sys
2006-12-24 20:35 79,328 ----a-w C:\Documents and Settings\Lisa\mqdmserd.sys
2006-12-24 20:35 66,656 ----a-w C:\Documents and Settings\Lisa\mqdmbus.sys
2006-12-24 20:35 6,208 ----a-w C:\Documents and Settings\Lisa\mqdmcmnt.sys
2006-12-24 20:35 5,936 ----a-w C:\Documents and Settings\Lisa\mqdmwhnt.sys
2006-12-24 20:35 4,048 ----a-w C:\Documents and Settings\Lisa\mqdmcr.sys
2006-12-24 20:35 25,600 ----a-w C:\Documents and Settings\Lisa\usbsermptxp.sys
2006-12-24 20:35 22,768 ----a-w C:\Documents and Settings\Lisa\usbsermpt.sys
2006-03-11 20:58 106,480 ----a-w C:\Documents and Settings\Lisa\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 14:18]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 23:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 19:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-06-29 08:03]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-12-18 06:20]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-23 08:09]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 17:43]
"SoundMan"="SOUNDMAN.EXE" [2003-10-08 16:41 C:\WINDOWS\SOUNDMAN.EXE]
"PcEye"="C:\Program Files\PCEye2000\pceye.exe" [2004-10-28 19:37]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe" [2004-12-06 20:31]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]
"lxbymon.exe"="C:\Program Files\Lexmark P910 Series\lxbymon.exe" [2004-08-20 18:31]
"EzPrint"="C:\Program Files\Lexmark P910 Series\ezprint.exe" [2004-08-25 00:16]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 11:44:06]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2005-09-20 18:01:29]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"leorop"= {E0D7103D-3FF5-4F65-A8C5-F55F489B8198} - C:\WINDOWS\leorop.dll [ ]
"nopzet"= {8E9ABAC6-3511-4DE2-BC1A-C1569B9A6E98} - C:\WINDOWS\nopzet.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 19:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background


*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-12-21 16:26:09 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
"2007-10-26 21:38:31 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Joseph.job"
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-21 16:41:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-21 16:42:51
.
2007-12-20 21:05:07 --- E O F ---


SmitFraudFix v2.273

Scan done at 17:00:14.29, 21/12/2007
Run from C:\Documents and Settings\Dorothy\Desktop\New
Folder\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec
Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PCEye2000\pceye.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Lexmark P910 Series\lxbymon.exe
C:\Program Files\Lexmark P910 Series\ezprint.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\pcwpx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\lxbycoms.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\sessmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security
Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe
C:\WINDOWS\system32\RDSHOST.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dorothy


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dorothy\Application
Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Dorothy\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: SiS 900 PCI Fast Ethernet Adapter - Packet Scheduler
Miniport
DNS Server Search Order: 83.147.160.2
DNS Server Search Order: 83.147.160.3

HKLM\SYSTEM\CCS\Services\Tcpip\..\{262DF147-82E7-41E6-98C9-7113882B0F8C}:
DhcpNameServer=83.147.160.2 83.147.160.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{262DF147-82E7-41E6-98C9-7113882B0F8C}:
DhcpNameServer=83.147.160.2 83.147.160.3
HKLM\SYSTEM\CS2\Services\Tcpip\..\{262DF147-82E7-41E6-98C9-7113882B0F8C}:
DhcpNameServer=83.147.160.2 83.147.160.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{262DF147-82E7-41E6-98C9-7113882B0F8C}:
DhcpNameServer=83.147.160.2 83.147.160.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=83.147.160.2
83.147.160.3
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=83.147.160.2
83.147.160.3
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=83.147.160.2
83.147.160.3
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=83.147.160.2
83.147.160.3


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:58:53, on 21/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PCEye2000\pceye.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Lexmark P910 Series\lxbymon.exe
C:\Program Files\Lexmark P910 Series\ezprint.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\pcwpx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\lxbycoms.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\sessmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe
C:\WINDOWS\system32\RDSHOST.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PcEye] C:\Program Files\PCEye2000\pceye.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [lxbymon.exe] "C:\Program Files\Lexmark P910 Series\lxbymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark P910 Series\ezprint.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Share...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1120502833140
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/ct.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O21 - SSODL: leorop - {E0D7103D-3FF5-4F65-A8C5-F55F489B8198} - C:\WINDOWS\leorop.dll (file missing)
O21 - SSODL: nopzet - {8E9ABAC6-3511-4DE2-BC1A-C1569B9A6E98} - C:\WINDOWS\nopzet.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxby_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbycoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 10866 bytes


Thanks for all your help
[ + quote]
Robbbb
Newbie
_ 		21. December 2007 @ 12:05 _ Link to this message    Send private message to this user   
Sorry for the double post quickdraw, but isn't cftmon a virus??
[ + quote]
QuikDraw
Senior Member
_ 		21. December 2007 @ 13:15 _ Link to this message    Send private message to this user   
Here's some info in regards to your question.
cftmon.exe is an application that does NOT appear to be a security risk
The Process Server database currently registers cftmon.exe to Microsoft.
This is part of Microsoft Office.
http://www.bleepingcomputer.com/startups/ctfmon.exe-1121.html
http://www.auditmypc.com/process/cftmon.asp

Run hijack and remove these.
O21 - SSODL: nopzet - {8E9ABAC6-3511-4DE2-BC1A-C1569B9A6E98} - C:\WINDOWS\nopzet.dll (file missing)

O21 - SSODL: leorop - {E0D7103D-3FF5-4F65-A8C5-F55F489B8198} - C:\WINDOWS\leorop.dll (file missing)

It appears you have a few Toolbars, do you want these?
[ + quote]
Robbbb
Newbie
_ 		21. December 2007 @ 13:20 _ Link to this message    Send private message to this user   
Hi quickdraw

to be honest, as it isn't my pc, i'd better leave anything that isn't dangerous so i'll leave the toolbars
[ + quote]
QuikDraw
Senior Member
_ 		21. December 2007 @ 13:39 _ Link to this message    Send private message to this user   
OK, we leave the toolbars. How's the PC running, so far?
[ + quote]

This message has been edited since posting. Last time this message was edited on 21. December 2007 @ 18:47
Robbbb
Newbie
_ 		22. December 2007 @ 06:57 _ Link to this message    Send private message to this user   
It's fine apart from the fact i can't open regedit, i have spotted wuauclt.exe - isn't this a virus?
[ + quote]
QuikDraw
Senior Member
_ 		22. December 2007 @ 14:54 _ Link to this message    Send private message to this user   
wuauclt.exe is a process managing automatic updates for Microsoft Windows. This process continuously checks for the latest updates and uses the Internet to do so. This program is important for the stable and secure running of your computer and should not be terminated.

Try this: Start> Run> type. sfc /scannow

I'll check the data base to see if I can find a fix for your registry issue, if scannow does not do the trick.

Download and use this while we are sorting out your virus problem.
http://www.dougknox.com/xp/utils/xp_emerutils.htm

Try this online scanner to check for viruses. Takes awhile to run.
http://www.eset.com/onlinescan/
[ + quote]

This message has been edited since posting. Last time this message was edited on 22. December 2007 @ 15:52
Robbbb
Newbie
_ 		22. December 2007 @ 16:22 _ Link to this message    Send private message to this user   
Thanks quickdraw, it's okay now. I started regedit in safe mode and removed anything that wasn't vital and it's all working perfectly.

Thank you for all your help, you've been brilliant.
[ + quote]
QuikDraw
Senior Member
_ 		22. December 2007 @ 17:00 _ Link to this message    Send private message to this user   
GREAT! Glad to hear you were able to find a fix. If for any reason the problems start again let me know.

Merry Christmas!
[ + quote]
Advertisement
_ 		__
 
_
Robbbb
Newbie
_ 		23. December 2007 @ 04:02 _ Link to this message    Send private message to this user   
Will do and Merry Christmas to you Quickdraw
[ + quote]
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > help
 

Digital video: AfterDawn.com | AfterDawn Forums
Music: MP3Lizard.com
Gaming: Blasteroids.com | Blasteroids Forums | Compare game prices
Software: Software downloads
Blogs: User profile pages
RSS feeds: AfterDawn.com News | Software updates | AfterDawn Forums
International: AfterDawn in Finnish | AfterDawn in Swedish | AfterDawn in Norwegian | download.fi
Navigate: Search | Site map
About us: About AfterDawn Ltd | Advertise on our sites | Rules, Restrictions, Legal disclaimer & Privacy policy
Contact us: Send feedback | Contact our media sales team
 
  © 1999-2025 by AfterDawn Ltd.

  IDG TechNetwork