christopher Posted March 9, 2007 Author Posted March 9, 2007 about to attempt safemode, be back whenever!
christopher Posted March 9, 2007 Author Posted March 9, 2007 ---------------------------------------------------------AVG Anti-Spyware - Scan Report--------------------------------------------------------- + Created at: 8:31:27 PM 3/8/2007 + Scan result: C:\System Volume Information\_restore{0768B94C-A9C5-4980-AAC7-F2FA66E33BB8}\RP1156\A0073226.dll -> Adware.Virtumonde : Ignored.C:\VundoFix Backups\wvuspmm.dll.bad -> Adware.Virtumonde : Ignored.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq43FF.tmp -> TrackingCookie.247realmedia : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38CF.tmp -> TrackingCookie.2o7 : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4699.tmp -> TrackingCookie.2o7 : Cleaned.C:\Documents and Settings\christopher\Cookies\christopher@aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned.C:\Documents and Settings\christopher\Cookies\christopher@grouplotto.aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3917.tmp -> TrackingCookie.Adserver : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3D9D.tmp -> TrackingCookie.Adserver : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF.tmp -> TrackingCookie.Adtech : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38D7.tmp -> TrackingCookie.Advertising : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3905.tmp -> TrackingCookie.Advertising : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4400.tmp -> TrackingCookie.Advertising : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq440F.tmp -> TrackingCookie.Advertising : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38D8.tmp -> TrackingCookie.Atdmt : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3D9C.tmp -> TrackingCookie.Atdmt : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38DA.tmp -> TrackingCookie.Bfast : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5FD9.tmp -> TrackingCookie.Bfast : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38DC.tmp -> TrackingCookie.Bluestreak : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4402.tmp -> TrackingCookie.Bluestreak : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E2.tmp -> TrackingCookie.Bridgetrack : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq55DC.tmp -> TrackingCookie.Bridgetrack : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38DF.tmp -> TrackingCookie.Burstnet : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq469A.tmp -> TrackingCookie.Burstnet : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E0.tmp -> TrackingCookie.Casalemedia : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq469B.tmp -> TrackingCookie.Casalemedia : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E1.tmp -> TrackingCookie.Centrport : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq55DB.tmp -> TrackingCookie.Centrport : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5FDB.tmp -> TrackingCookie.Cj : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4D15.tmp -> TrackingCookie.Clickbank : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1C2.tmp -> TrackingCookie.Clickzs : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E7.tmp -> TrackingCookie.Clickzs : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E4.tmp -> TrackingCookie.Com : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4404.tmp -> TrackingCookie.Com : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E5.tmp -> TrackingCookie.Comclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B7A.tmp -> TrackingCookie.Commission-junction : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5FDC.tmp -> TrackingCookie.Commission-junction : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E8.tmp -> TrackingCookie.Coremetrics : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46C1.tmp -> TrackingCookie.Coremetrics : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5FDA.tmp -> TrackingCookie.Counted : Cleaned.C:\Documents and Settings\christopher\Cookies\christopher@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.C:\Documents and Settings\christopher\Cookies\christopher@cpvfeed[3].txt -> TrackingCookie.Cpvfeed : Cleaned.C:\Documents and Settings\christopher\Cookies\christopher@cpvfeed[4].txt -> TrackingCookie.Cpvfeed : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1A17.tmp -> TrackingCookie.Dealtime : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq469C.tmp -> TrackingCookie.Dealtime : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38EB.tmp -> TrackingCookie.Doubleclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46C2.tmp -> TrackingCookie.Doubleclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38EF.tmp -> TrackingCookie.Falkag : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4406.tmp -> TrackingCookie.Falkag : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46C0.tmp -> TrackingCookie.Falkag : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B78.tmp -> TrackingCookie.Falkag : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F0.tmp -> TrackingCookie.Fastclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq469D.tmp -> TrackingCookie.Fastclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F1.tmp -> TrackingCookie.Fortunecity : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46D0.tmp -> TrackingCookie.Fortunecity : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq13.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1A18.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38ED.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F2.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F3.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F4.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F5.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F6.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F7.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4405.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4407.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4408.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4409.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46C3.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B7C.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4D16.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq507F.tmp -> TrackingCookie.Hitbox : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F8.tmp -> TrackingCookie.Hitslink : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq45F3.tmp -> TrackingCookie.Hitslink : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B7E.tmp -> TrackingCookie.Hitslink : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6B34.tmp -> TrackingCookie.Hotlog : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38F9.tmp -> TrackingCookie.Internetfuel : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46C4.tmp -> TrackingCookie.Internetfuel : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15.tmp -> TrackingCookie.Linksynergy : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38FC.tmp -> TrackingCookie.Mediaplex : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46D1.tmp -> TrackingCookie.Mediaplex : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B83.tmp -> TrackingCookie.Ne : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B81.tmp -> TrackingCookie.Onestat : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq55DD.tmp -> TrackingCookie.Onestat : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3900.tmp -> TrackingCookie.Paycounter : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq440B.tmp -> TrackingCookie.Paycounter : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38E6.tmp -> TrackingCookie.Pro-market : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B7F.tmp -> TrackingCookie.Qksrv : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4DED.tmp -> TrackingCookie.Qksrv : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3902.tmp -> TrackingCookie.Questionmarket : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq440C.tmp -> TrackingCookie.Questionmarket : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3903.tmp -> TrackingCookie.Realmedia : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq440D.tmp -> TrackingCookie.Realmedia : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq440E.tmp -> TrackingCookie.Realtracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4D18.tmp -> TrackingCookie.Realtracker : Cleaned.:mozilla.64:C:\Documents and Settings\christopher\Application Data\Mozilla\Firefox\Profiles\c1y7hqer.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.65:C:\Documents and Settings\christopher\Application Data\Mozilla\Firefox\Profiles\c1y7hqer.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.66:C:\Documents and Settings\christopher\Application Data\Mozilla\Firefox\Profiles\c1y7hqer.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.67:C:\Documents and Settings\christopher\Application Data\Mozilla\Firefox\Profiles\c1y7hqer.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.68:C:\Documents and Settings\christopher\Application Data\Mozilla\Firefox\Profiles\c1y7hqer.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.69:C:\Documents and Settings\christopher\Application Data\Mozilla\Firefox\Profiles\c1y7hqer.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3904.tmp -> TrackingCookie.Revenue : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5FDD.tmp -> TrackingCookie.Revenue : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38EC.tmp -> TrackingCookie.Ru4 : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B7B.tmp -> TrackingCookie.Ru4 : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq38DE.tmp -> TrackingCookie.Serving-sys : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3906.tmp -> TrackingCookie.Serving-sys : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4403.tmp -> TrackingCookie.Serving-sys : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B80.tmp -> TrackingCookie.Serving-sys : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1C4.tmp -> TrackingCookie.Sexlist : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46D2.tmp -> TrackingCookie.Sexlist : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1C5.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3907.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3908.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3909.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4410.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4411.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq45F4.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq45F5.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46C7.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8.tmp -> TrackingCookie.Sextracker : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4412.tmp -> TrackingCookie.Spylog : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq390C.tmp -> TrackingCookie.Statcounter : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B82.tmp -> TrackingCookie.Statcounter : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq19.tmp -> TrackingCookie.Tacoda : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq557A.tmp -> TrackingCookie.Tacoda : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq390D.tmp -> TrackingCookie.Targetnet : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4413.tmp -> TrackingCookie.Targetnet : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq390E.tmp -> TrackingCookie.Tradedoubler : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq469F.tmp -> TrackingCookie.Tradedoubler : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq390F.tmp -> TrackingCookie.Trafficmp : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46A0.tmp -> TrackingCookie.Trafficmp : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1A19.tmp -> TrackingCookie.Tribalfusion : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3910.tmp -> TrackingCookie.Tribalfusion : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46A1.tmp -> TrackingCookie.Tribalfusion : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6B36.tmp -> TrackingCookie.Valuead : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3912.tmp -> TrackingCookie.Valueclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3913.tmp -> TrackingCookie.Valueclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4414.tmp -> TrackingCookie.Valueclick : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3914.tmp -> TrackingCookie.Webtrendslive : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4DEE.tmp -> TrackingCookie.Webtrendslive : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5577.tmp -> TrackingCookie.Yieldmanager : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6F.tmp -> TrackingCookie.Yieldmanager : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3918.tmp -> TrackingCookie.Zedo : Cleaned.C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46C8.tmp -> TrackingCookie.Zedo : Cleaned.::Report endsextracker is my fav! Logfile of HijackThis v1.99.1Scan saved at 8:39:31 PM, on 3/8/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16414)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Ahead\InCD\InCDsrv.exeC:\Program Files\TGTSoft\StyleXP\StyleXPService.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\ezSP_Px.exeC:\Program Files\Microsoft IntelliPoint\point32.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exeC:\Program Files\TGTSoft\StyleXP\StyleXP.exeC:\Program Files\AIM95\aim.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exeC:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exeC:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exeC:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\christopher\Desktop\c\scan.exe.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exeO4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exeO4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimizedO4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -HideO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odlO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO11 - Options group: [iNTERNATIONAL] International*O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1161395254515O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1161395242343O20 - Winlogon Notify: winhoo32 - winhoo32.dll (file missing)O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exeO23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exeO23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exeO23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (Application) (file missing)O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exeO23 - Service: VAIO Media Photo Server (Application) (VAIOMediaPlatform-PhotoServer-AppServer) - Unknown owner - C:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exeO23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exeO23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
jeff.sadowski Posted March 9, 2007 Posted March 9, 2007 What is VundoFix.exe?What licence is it under?how can we be guaranteed that it is safe to use and not hijacked itself?Using linux for so long has made me weary of software licenses and conferming that the file I download has the credentials it is suppose to.(I acctually like MS's plan to confirm the place that produced the software)
christopher Posted March 9, 2007 Author Posted March 9, 2007 What is VundoFix.exe?What licence is it under?how can we be guaranteed that it is safe to use and not hijacked itself?Using linux for so long has made me weary of software licenses and conferming that the file I download has the credentials it is suppose to.(I acctually like MS's plan to confirm the place that produced the software)vundofix worked well for me, i haven't seen any bad side effects yet. it searches through bad .dll's and points them out for you to delete. i was skeptical at first but i did a little research. haven't found malicious talk about it yet and other people seem to have no problems either.it def. helped my IE problem, no popups from IE and usually i get them in spurts every 4 hours or so. still have a firefox prob that just came to life since after i created this thread.
coltm4carbine Posted March 9, 2007 Posted March 9, 2007 (edited) Go to add/remove program and remove:McAfee personal firewallAlthough I do suggest you keep the firewall......Apart from that...Clean! Congratulations.Let's reset your hidden/system files and folders. System files are hidden for a reason and we don't want to have them openly available and susceptible to accidental deletion.* Click Start. * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View tab. * Under the Hidden files and folders heading UNSELECT Show hidden files and folders. * CHECK the Hide protected operating system files (recommended) option. * Click Yes to confirm. * Click OK.The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.SpywareBlaster - Great prevention tool to keep nasties from installing on your system.SpywareGuard - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein====================What is VundoFix.exe?Vundofix is a tool that finds vundo and removes it.What licence is it under? Freeware...how can we be guaranteed that it is safe to use and not hijacked itself?Because of this tool the creator was awarded the Microsoft MVP for windows security... It's used all over the antispyware community...It worked on the OP and the other people I've used it on...Can you also remind me what the firefox problem? Although I may not be able to help I'm sure some of the brains on here will be able to help... Edited March 9, 2007 by coltm4carbine
christopher Posted March 9, 2007 Author Posted March 9, 2007 basically the same issue i had with IE.. but now it's firefox! ha! i thought nothing was supposed to happen to firefox!
coltm4carbine Posted March 9, 2007 Posted March 9, 2007 (edited) Oh shoot, missed something (harmless though...so don't panic).Open HJT and fix the following: O20 - Winlogon Notify: winhoo32 - winhoo32.dll (file missing)Show hidden files and delete (if it's still there - it should be gone anyway - just incase):C:\WINDOWS\SYSTEM32\winhoo32.dllReboot.I also suggest you remove all your versions of Java and install a new one here.I have also noticed that you have both ad-aware personal and pro. You might want to remove one.Also I think there's a newer version of adobe acrobat reader... (I am not sure, I use foxit)I'll leave your firefox issue with the other people who knows a lot more about computers than me, but a suggestion. do you have an ad blocker? sounds like online adverts to me. Edited March 9, 2007 by coltm4carbine
jeff.sadowski Posted March 9, 2007 Posted March 9, 2007 basically the same issue i had with IE.. but now it's firefox! ha! i thought nothing was supposed to happen to firefox!That is a common misconception on Firefox. Firefox also has some vulnerabilities. I hate all web browsers they all have issues.just be careful about what you click on and things will work alright.Actually it sounds as though something might be opening something using your default web browser. So no matter what you use you will have the issue until you disable that program. Do you have any file sharing programs? or downloaded warez apps this sounds like something like that.Oh and by the way I had a friend show me that you can do windows updates with firefox so if you really wanted you could get rid of IE but I recommend against it because it should also be your file browser. I do everything from cmd with dir to list and cd to go to different folders call me weird but it helps when scripting. Just about everything I do is scriptable. You could install cyqwin and use lynx to browse but thats going too far for me. Ascii art (a command line method of displaying pictures using best fit algorithms to fit ascii characters together to make a picture) is missing too much of the pictures for me. Microsoft should have never developed a gui os for a server. If they wanted a gui they should have developed a php interface over ssl to the servers. I still feel servers should be headless. They just perpetuated bad program design.
RJARRRPCGP Posted March 21, 2007 Posted March 21, 2007 (edited) It's not recommended to remove Internet Explorer as it is integrated into Windows. Simply disable the desktop shortcuts and basically "hide" it. Those nLite can remove it; it does not remove it properly and can cause many ill effects. Your best bet is to hide the shortcuts and if you have a irewall, you can simply disable Internet Explorers access to the Internet.nLite usually does remove it properly and leaves some registry entries so that some applications won't refuse to continue.But expect the following if you remove Internet Explorer:1. Comodo Personal Firewall will fail. It probably fails with generic errors and is terminated.2. You're not able to play the games at pogo.com. Because the games at pogo.com are known to fail to load with Firefox, you probably just get a white box. -----------------------------------------------------------------------------------------------------------Applications that possibly have problems with Internet Explorer removed:SkypeAIMPerfect DiskO&O Defrag.Net FrameworkAny application that uses the .Net Framework--------------------------------------------------------------------------------------------------------There aren't many issues with Internet Explorer removed. Especially if you're a gamer. I haven't came across any 3D game that fails because of Internet Explorer being removed!Games are more likely to love you for removing Internet Explorer. Edited March 21, 2007 by RJARRRPCGP
Jeremy Posted March 21, 2007 Posted March 21, 2007 But expect the following if you remove Internet Explorer:1. Comodo Personal Firewall will fail. It probably fails with generic errors and is terminated.2. You're not able to play the games at pogo.com. Because the games at pogo.com are known to fail to load with Firefox, you probably just get a white box. -----------------------------------------------------------------------------------------------------------Applications that possibly have problems with Internet Explorer removed:SkypeAIMPerfect DiskO&O Defrag.Net FrameworkAny application that uses the .Net FrameworkI've removed IE and:Comodo works fine. I don't play website games but I have played on shockwave.com which uses flash, no issues.Skype works fine, so does PD, O&O and every .NET app I have used.
RJARRRPCGP Posted March 24, 2007 Posted March 24, 2007 (edited) But expect the following if you remove Internet Explorer:1. Comodo Personal Firewall will fail. It probably fails with generic errors and is terminated.2. You're not able to play the games at pogo.com. Because the games at pogo.com are known to fail to load with Firefox, you probably just get a white box. -----------------------------------------------------------------------------------------------------------Applications that possibly have problems with Internet Explorer removed:SkypeAIMPerfect DiskO&O Defrag.Net FrameworkAny application that uses the .Net FrameworkI've removed IE and:Comodo works fine. I don't play website games but I have played on shockwave.com which uses flash, no issues.Skype works fine, so does PD, O&O and every .NET app I have used.I mentioned Comodo Firewall, because when I tried to use it under Windows 2000 Pro with the FDV fileset, AFAIK, the Comodo Firewall installer didn't display any error messages and thus seemed to be fine, but after I rebooted, error messages popped up and Comodo Firewall was terminated. Also, about the internet games, I talked about that, because I worked on a PC for someone that does use pogo.com and I decided to test it with Firefox and when I tested it with Firefox a while ago, gotten nothing but a box! nLite, even with Internet Explorer stripped, has good compatibility, AFAIK. I rarely, if at all, see an application complain about Internet Explorer not being installed. Edited March 24, 2007 by RJARRRPCGP
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now