coltm4carbine

ok don't fix that then.

yeh not supprised at all. I can see at least a trojan 1 sober.p varient (might be the "o") a new virus that has just came out a few days ago. (doesn't have a name yet) I decided not to continue analyzing it until you have ran the scans because it is soo bad. ok don't worry about that. can you also run these online scans ontop of that one. Please run the Housecall online virus scan located at: http://housecall.trendmicro.com/houseca ... t_corp.asp Follow the prompts to scan your hard drive for viruses. Select the "Autoclean" option so that Housecall will remove any viruses from your system. When the scan is finished, please restart your computer. Then please run the Panda scan here: http://www.pandasoftware.com/products/a ... ncipal.htm Choose to "Disinfect automatically," and follow the prompts. Delete any viruses found, and restart your computer. Finally, please run the WindowSecurity trojan scan here: http://www.windowsecurity.com/trojanscan/ Remove any trojans found, and restart your computer. These should get rid of most of the bad entries. If you cannot run HJT v1.99.1 you might want to try these (again it's taken from my canned speech so it might sound wrong):- Here are a couple of steps to try and run HijackThis. Follow them in order. If one step doesn't work, continue to the next step: Step # 1 Rename HijackThis[Caution: ExecutableFile] to H[Caution: ExecutableFile]. Try a scan. If it works, post the log back here. If not, proceed to the next step. Step # 2 Go to this link and download the 1.98.2 version of HijackThis[Caution: ExecutableFile]: hijackthis1.98.2 Try a scan. If it works, post the log back here. If not, proceed to the next step. Step # 3 Click here and download Itty Bitty Process Manager (IBProcMan.zip): ibprocman. Unzip it to it's own directory and try running it - it will provide a 'taskmanager' like process viewer in which you can stop running processes. Don't stop any yet, just list all that it has so whe can check them and give advice. Post the list back here. btw is your desktop looking normal (you know like has it got anything odd)?

ok forget what i said. plan b now. Have you been clicking links in emails? it looks like you have. In other words I am concerned that you might have the sober.p virus and a few other trojans... Please run full scans with Ad-Aware SE and Spybot-S&D as follows: (If you already have Ad-Aware SE 1.06 and Spybot 1.4 installed, you can skip the installation steps. If you don't, please uninstall your old versions and install the new ones from the links below.) Full Ad-Aware Scan Please download Ad-Aware SE from here: http://www.majorgeeks.com/download506.html Install Ad-Aware and run it. In the bottom-right hand corner, click "Check for updates now". Click "Connect" to download the newest reference file. Now we will configure Ad-Aware to perform a full scan. In the Ad-Aware main window, click on the gear icon at the top of the screen to open the preferences window. In the "General" window, make sure the following options are selected: 1) Automatically save log-file 2) Automatically quarantine objects prior to removal 3) Safe Mode (always request confirmation) Click the "Scanning" button on the left-hand side and make sure the following options are selected: 1) Scan within archives 2) Scan active processes 3) Scan registry 4) Deep scan registry 4) Scan my IE Favorites for banned URLs 5) Scan my Hosts file Please also click on "Select drives & folders to scan" and select your hard drive(s). Then click the "Advanced" button on the left-hand side and make sure all the options under "Log-file Detail Level" are selected. Next, click the "Tweak" button on the left-hand side. Click on "Scanning Engine" and make sure the following options are selected: 1) Unload recognized processes & modules during scanning 2) Obtain command line of scanned processes 3) Scan registry for all users instead of current user only Click on "Cleaning Engine" and make sure the following options are selected: 1) Always try to unload modules before deletion 2) During removal, unload Explorer and IE if necessary 3) Let Windows remove files in use at next reboot 4) Delete quarantined objects after restoring Finally, click on "Safety Settings" and make sure the following options are selected: 1) Automatically select problematic objects in results lists 2) Write-protect system files after repair (Hosts file, etc) Click on "Proceed" to save the preferences. Then please click the "Start" button on the bottom right side to begin a scan. Select "Use custom scanning options" and then click "Next". Ad-Aware will then scan for malware. When it is finished, make sure any objects listed in RED are selected and click "Next" to remove the objects. Then please restart your computer. Spybot Full Scan Next, please download Spybot-S&D from here: http://www.majorgeeks.com/download.php?det=2471 Install Spybot-S&D and run it. Select "Search for updates" and then select all available updates. Click on the drop-down box in the top center to choose a download location nearest to you. Then click "Download updates". When all updates have downloaded, close Spybot-S&D, and then run it again. Click on "Check for problems". When the scan has finished, select any entries listed in red and click "Fix selected problems". Then please restart your computer again. Then try this online virus scan: Trend- Micro Choose "fix" or "clean". Let it remove any infections found. Reboot and "copy/paste" a new Hijack This! log file into this thread.

run some antiviruses? it should detect and delete it.

Ok using my canned speech for another forum might sound wrong but its quicker than me typing it all out: Hi and Welcome to Geeks to Go. My name is Coltm4carbine and I will be helping you. Please can you extract all your HiJack this files to a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible. Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below. Open Microsoft AntiSpyware. [*:3jqyx3t9]Click on Tools, Settings. [*:3jqyx3t9]In the left pane, click on Real-time Protection. [*:3jqyx3t9]Under Startup Options uncheck: Enable the Microsoft AntiSpyware Security Agents on startup (recommended). [*:3jqyx3t9]Under Real-time spyware threat protection uncheck: Enable real-time spyware threat protection (recommended). [*:3jqyx3t9]After you uncheck these, click on the Save button and close Microsoft AntiSpyware. [*:3jqyx3t9]Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware. [*:3jqyx3t9]We will re-enable it once we're done. Then after that go to: Start > Control Panel > Add or Remove Programs and remove the following: MyWebSearch MyWay Need2Find WildTangent PartyPoker (anything that says MyWay,Need2find,WildTangent and PartyPoker) [/b]Please note any other programs that you dont recognize in that list in your next response Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing) O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL (file missing) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.e3e (CAUTION - executable file) "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain O4 - Startup: Joint Operations Typhoon Rising Registration.lnk = C:\Documents and Settings\JOSH\Local Settings\Temp\{6D80A3E8-C482-41FF-A96E-DC24F66517D0}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.e3e (CAUTION - executable file) O4 - Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.e3e (CAUTION - executable file) [recommended unless you trust it] O8 - Extra context menu item: &Search - http://ka.bar.need2find.com/KA/menusearch.html?p=KA O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.e3e (CAUTION - executable file) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.e3e (CAUTION - executable file) O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode. Enable the 'Show Hidden Folders' option, like this: Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders. Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Click OK. Remove the following folders in bold (if found): C:\Program Files\MyWaySA C:\Program Files\Need2Find C:\Program Files\MyWaySA C:\PROGRA~1\INSTAF~1 If you would please reboot your computer into normal windows, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

go on it and see if you can join it. i be supprised. Who said it was professional? its just the name. kk i reapply for training again if u want. I would seriously laugh if more than 10 here are actually trained themselves. If i post a log containing new.net i would really wanna see how you people cope with it. you people might end up ripping my lsp chain and breaking down the whole internet connection. i would also want u to tell me all the variants of the cws and their symptoms. feel free to pm me with the results. i am going to pm u with a average HJT log that you will get at proper forums and see how you will cope.

kk post a hjt log this sounds bad. someone will help you out. please start it in a new topic. I am 13 too. all you need is some training and a few tests then before you know it you can join the alliance security analysist professionals (ASAP for short) btw i think you might of got one of the 4-5 new cws infections.

oh its usually a sign of a cws infection. In training i was always told to remove them unless the user set them. did u set it anyway? if not run cws shredder then fix the lines. That should be your internet start and search page. can i also ask what is this line? O20 - AppInit_DLLs: C:\WINDOWS\System32\kbdfn.dll from my "tools" I can't find anything on it and from the logs i have seen i have never seen it before.

did u set ur start and search page to about:blank? if not Download CWShredder, unzip it, and save it on the Desktop. Run CWShredder to fix your CWS problem fix this this, it is unneccessery. (you can leave it if u want) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = btw a question for the mods or tech heads why does tip.it changes the exe files to e3e?

look for the prt scrn button next to the f12 press it to take a screen shot. after that go on something like paint to edit and print it.

i know but when i was in training (to interpret HJT logs) i was told only to remove entries which are bad otherwise leave them. anyway the orphaned reg has been removed.

get a bb gun and shoot them in the head.

it was a check anyway :) but i knew about the real player. fixed comet curser. and now my log should be clean. just a bit supprised only 2 people knew the o9 was legit.

you will need an older version of hjt but out of all the logs i have seen only a few infections stop hjt from working.

firefox for me and most of the staff members at more "advanced tech forums"

at last someone that has found out where they went wrong. :) cangratulations. it is a bug inside hjt sometimes a o23 and a o9 will show as no file when there is one. only ever fix them if its bad. once again cangrats :)

kk if a mod said so....

lol 1 thing for sure and that is i ain't gonna click on the links unless i know which virus it is. lol reinstalling...

kk ty any more bad entries welcomed

Hi, just wanted a check-up nothing too important. Logfile of HijackThis v1.99.1 Scan saved at 11:12:00, on 24/10/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss[Caution: ExecutableFile] C:\WINDOWS\system32\winlogon[Caution: ExecutableFile] C:\WINDOWS\system32\services[Caution: ExecutableFile] C:\WINDOWS\system32\lsass[Caution: ExecutableFile] C:\WINDOWS\system32\Ati2evxx[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\system32\Ati2evxx[Caution: ExecutableFile] C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile] C:\WINDOWS\Explorer[Caution: ExecutableFile] C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins[Caution: ExecutableFile] c:\PROGRA~1\mcafee.com\vso\mcvsrte[Caution: ExecutableFile] C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr[Caution: ExecutableFile] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx[Caution: ExecutableFile] C:\Program Files\QuickTime\qttask[Caution: ExecutableFile] C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile] C:\PROGRA~1\mcafee.com\agent\mcagent[Caution: ExecutableFile] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent[Caution: ExecutableFile] C:\PROGRA~1\mcafee.com\vso\mcvsshld[Caution: ExecutableFile] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2[Caution: ExecutableFile] c:\progra~1\mcafee.com\vso\mcvsescn[Caution: ExecutableFile] C:\Program Files\Microsoft AntiSpyware\gcasServ[Caution: ExecutableFile] C:\PROGRA~1\mcafee.com\mps\mscifapp[Caution: ExecutableFile] C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile] C:\Program Files\BillP Studios\WinPatrol\winpatrol[Caution: ExecutableFile] C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile] C:\WINDOWS\system32\rundll32[Caution: ExecutableFile] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer[Caution: ExecutableFile] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication[Caution: ExecutableFile] C:\Program Files\McAfee\McAfee QuickClean\Plguni[Caution: ExecutableFile] C:\Program Files\Webroot\Spy Sweeper\SpySweeper[Caution: ExecutableFile] C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1[Caution: ExecutableFile] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2[Caution: ExecutableFile] C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: ExecutableFile] C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s[Caution: ExecutableFile] c:\progra~1\mcafee.com\vso\mcvsftsn[Caution: ExecutableFile] C:\Program Files\WIDCOMM\Bluetooth Software\BTTray[Caution: ExecutableFile] C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun[Caution: ExecutableFile] C:\Program Files\BHODemon 2\BHODemon[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\Program Files\SpywareGuard\sgmain[Caution: ExecutableFile] C:\Program Files\United Devices\UD[Caution: ExecutableFile] C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] C:\WINDOWS\wanmpsvc[Caution: ExecutableFile] C:\Program Files\SpywareGuard\sgbhp[Caution: ExecutableFile] C:\Program Files\Microsoft AntiSpyware\gcasDtServ[Caution: ExecutableFile] C:\Program Files\United Devices\ud_7174683[Caution: ExecutableFile] C:\Program Files\United Devices\ud_7174683_0.dir\ud_ligfit_Release[Caution: ExecutableFile] c:\PROGRA~1\mcafee.com\vso\mcshield[Caution: ExecutableFile] C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\Mp[bleep]ent[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE[Caution: ExecutableFile] C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile] C:\Program Files\HijackThis Scanalyser\hjtscan[Caution: ExecutableFile] C:\HijackThis\HijackThis[Caution: ExecutableFile] R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.yahoo.co.uk"); (C:\Documents and Settings\Wong\Application Data\Mozilla\Profiles\default\p226ydua.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_UK.src"); (C:\Documents and Settings\Wong\Application Data\Mozilla\Profiles\default\p226ydua.slt\prefs.js) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1B313945-68B9-860F-BDB9-B5999C129D75} - C:\WINDOWS\System32\cieuaev.dll O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll O2 - BHO: (no name) - {35E78239-811E-4c3f-B37D-F339AC16C2C0} - (no file) O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\PROGRA~1\mcafee.com\mps\POPUPK~1.DLL O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx[Caution: ExecutableFile] O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile] O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate[Caution: ExecutableFile] O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent[Caution: ExecutableFile] O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent[Caution: ExecutableFile] O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr[Caution: ExecutableFile]" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld[Caution: ExecutableFile]" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2[Caution: ExecutableFile] O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray[Caution: ExecutableFile] O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ[Caution: ExecutableFile]" O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp[Caution: ExecutableFile] /embedding O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]" -osboot O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol[Caution: ExecutableFile] O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]" O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32[Caution: ExecutableFile] bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer[Caution: ExecutableFile] O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication[Caution: ExecutableFile] -onlytray O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] C:\Program Files\McAfee\McAfee QuickClean\Plguni[Caution: ExecutableFile] /START O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent[Caution: ExecutableFile] O4 - HKCU\..\Run: [spySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper[Caution: ExecutableFile] /0 O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2[Caution: ExecutableFile] /NoDialog O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]" /background O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: ExecutableFile] O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon[Caution: ExecutableFile] O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain[Caution: ExecutableFile] O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD[Caution: ExecutableFile] O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl[Caution: ExecutableFile] O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9[Caution: ExecutableFile] O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesuk.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesuk.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite[Caution: ExecutableFile] O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c ... urrent.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com/res ... nPUpld.cab O16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} (ICQVideoControl Class) - http://xtraz.icq.com/xtraz/activex/ICQVideoControl.cab O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - ]http://www.xblock.com/download/xclean_micro[Caution: ExecutableFile] O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0, ... Portal.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 8421444968 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.c ... mplete.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-l ... cfscan.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by16fd.bay16.hotmail.msn.com/act ... Atchmt.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{62ACF179-4179-4456-8319-5810DBF8C58F}: NameServer = 62.6.40.178 194.72.9.38 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx[Caution: ExecutableFile] O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag[Caution: ExecutableFile] O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins[Caution: ExecutableFile] O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile] O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield[Caution: ExecutableFile] O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr[Caution: ExecutableFile]) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr[Caution: ExecutableFile] O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte[Caution: ExecutableFile] O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE[Caution: ExecutableFile] O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr[Caution: ExecutableFile] O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc[Caution: ExecutableFile]

*edit* soz only jst saw the date.

yes i use it for a lot of things.

Hi there can you please post another HJT log because i think you got a few bad entries.