C program online

Windows Vista Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program Batman Arkham City 2012 Author Warner Bros. Interactive Entertainment Inc. Version Windows XP Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program Firefall 1112234 Author Red 5 Studios Version Windows 10 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program Batman: Arkham City GOTY 155343 Author Rocksteady Studios Version Windows 10 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program DC Universe Online 2011 Author Sony Online Entertainment Inc. Version Windows XP SP3 x32 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program DC Universe Online 2011 Author Sony Online Entertainment Inc. Version Windows 7 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program DC Universe Online 2011 Author Sony Online Entertainment Inc. Version Windows Vista Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program Far Cry 5 2994304 Author Ubisoft Montreal Version Windows 10 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program Far Cry 5 3122389 Author Ubisoft Montreal Version Windows 10 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program L.A. Noire The Complete Edition 2011 Author Rockstar Games Version Windows Vista SP1 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program L.A. Noire The Complete Edition 2011 Author Rockstar Games Version Windows XP SP3 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program L.A. Noire The Complete Edition 2011 Author Rockstar Games Version Windows 7 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program Hancom Office 2014 VP d.2016-01-21 Author Hancom, Inc. Version Windows 10 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program 15,000 Media Contacts 2.0 Author Summitsoft Corporation Version Windows 7 Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location C:\Windows\System32\ + dotnetfx35.exe d481cda2625d9dd2731a00f482484d86 231.50 MB Program 15,000 Media Contacts 2.0 Author Summitsoft Corporation Version Windows Vista Type 64-bit (x64) Size 242743296 MD5 Checksum d481cda2625d9dd2731a00f482484d86 SHA1 Checksum 3dce66bae0dd71284ac7a971baed07030a186918 CRC32: 1d9139bd File Directory Location

ExeC:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exeC:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exeC:\Program Files (x86)\PC Suite\JoinMEUIExec.exeC:\Program Files\AVAST Software\Avast\AvastUI.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files (x86)\QuickTime\QTTask.exeC:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exeC:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Users\Usher\Downloads\exe\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllR3 - URLSearchHook: DivX Browser Bar Toolbar - {77e8143b-6759-416e-b521-82cfed75150b} - C:\Program Files(x86)\DivX_Browser_Bar\prxtbDivX.dllF2 - REG:system.ini: UserInit=userinit.exe,O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dllO2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dllO2 - BHO: DivX Browser Bar - {77e8143b-6759-416e-b521-82cfed75150b} - C:\Program Files (x86)\DivX_Browser_Bar\prxtbDivX.dllO2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dllO2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files(x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllO2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dllO2 - BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files(x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dllO3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\GoogleToolbar\GoogleToolbar_32.dllO3 - Toolbar: DivX Browser Bar Toolbar - {77e8143b-6759-416e-b521-82cfed75150b} - C:\Program Files(x86)\DivX_Browser_Bar\prxtbDivX.dllO3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVASTSoftware\Avast\aswWebRepIE.dllO4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exeO4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"O4 - HKLM\..\Run: [JoinMEUIExec] "C:\Program Files (x86)\PC Suite\JoinMEUIExec.exe"O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /noguiO4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunO4 - HKUS\S-1-5-18\..\Run: [TOSHIBA Online Product Information] C:\Program Files (x86)\TOSHIBA\TOSHIBA OnlineProduct Information\topi.exe (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\RunOnce: [SpUninstallDeleteDir] rmdir /s /q "\SearchProtect" (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [TOSHIBA Online Product Information] C:\Program Files (x86)\TOSHIBA\TOSHIBA OnlineProduct Information\topi.exe (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [SpUninstallDeleteDir] rmdir /s /q "\SearchProtect" (User 'Default user')O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (User 'Default user')O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dllO9 - Extra button:

What is Steganos Online Shield? (from Steganos GmbH)Steganos Online Shield protects you extensively and continuously while being on the Internet. It locks hackers out reliably and secures you online when you shop, browse or download -356 days a year. Protect yourself against snoops in public hotspots, for example while being in a hotel, a cafe, an airport or at the offi... Read moreOverviewSteganos Online Shield is a program developed by Steganos GmbH. The most used version is 1.4.14, with over 98% of all installations currently using this version. Upon installation and setup, it defines an auto-start registry entry which makes this program run on each Windows boot for all user logins. It adds a background controller service that is set to automatically run. Delaying the start of this service is possible through the service manager. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The main program executable is [INSTALLDIR]OnlineShieldClient.exe. The software installer includes 42 files and is usually about 31.49 MB (33,018,129 bytes). SteganosUpdater.exe is the automatic update component of the software designed to download and apply new updates should new versions be released. In comparison to the total number of users, most PCs are running the OS Windows 7 (SP1) as well as Windows 10. While about 64% of users of Steganos Online Shield come from Germany, it is also popular in the United States and France.Program detailsURL: www.steganos.com/us/products/secure-surfing/online-shield/overviewInstallation folder: C:\Program Files\steganos online shieldUninstaller: C:\Program Files\Steganos Online Shield\uninstall.exeEstimated size: 31.49 MBFiles installed by Steganos Online ShieldLibShred.dll - Steganos Online Shield (Steganos Shredder DLL)Notifier.exe - Steganos NotifierOnlineShieldClient.exeOnlineShieldService.exeOnlineShieldServiceStarter.exe - OnlineShield Service StarterShutdownApp.exe - OnlineShield ShutdownAppSteganosBrowserMonitor.exe - Steganos Online Shield Browser MonitorSteganosUpdater.exe - Steganos Updateruninstall.exeUninstallWindow.exe - Uninstall WindowUpdater.exe - Update Wizardicudt.dll (by The ICU Project) - International Components for Unicode (ICU Data DLL)libGLESv2.dll - ANGLE libGLESv2 Dynamic Link LibrarylibEGL.dll - ANGLE libEGL Dynamic Link Libraryawesomium.dll (by Awesomium Technologies) - Awesomium (Awesomium Core)awesomium_process.exe (by Awesomium Technologies) - Awesomium Rendereravcodec-53.dllavformat-53.dllavutil-51.dllinfohelper.exeRenameTAP.exeResetPendingMoves.exeServiceControl.exesetuptool.exeBehaviors exhibitedScheduled TaskOnlineShieldClient.exe is scheduled as a task with the class '{E1301222-039A-4A01-990A-64191F9D9B45}' (runs on registration).3 Scheduled Tasks (Boot/Login)OnlineShieldClient.exe is automatically launched at startup through a scheduled task named SOS_Agent.SteganosBrowserMonitor.exe is automatically launched at startup through a scheduled task named SOS Browser Monitor_Reg_HKCURun_S-1-5-21-869138378-1274519537-3161427072-1001.Notifier.exe is automatically launched at startup through a scheduled task named SOS Notifier_Reg_HKLMWow6432Run.ServiceOnlineShieldService.exe runs as a service named 'Online Shield Starter Service' (Online Shield Starter Service).3 Startup Files (User Run)Updater.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'SOS_Update' and executes as "C:\Program Files\Steganos Online Shield\Updater.exe" --resume --verbosity silent.SteganosBrowserMonitor.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'SOS Browser Monitor' and executes as "C:\Program Files\Steganos Online Shield\SteganosBrowserMonitor.exe".OnlineShieldClient.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'SOS_Agent' and executes as "C:\Program Files\Steganos Online Shield\OnlineShieldClient.exe" -agent.4 Startup Files (All Users Run)Updater.exe is loaded in the all users (HKLM) registry as a startup file name 'SOS_Update' which loads as C:\Program Files\Steganos Online Shield\Updater.exe.SteganosBrowserMonitor.exe is

Games Player) - - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dllO23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeO23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeO23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1165359182\ee\services\safetyCore\ver210_5_2_1\aolavupd.exeO23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exeO23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exeO23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe 0 Back to top --> #27 don77 Posted 08 July 2007 - 08:22 PM don77 Malware Expert Retired Staff 18,526 posts Looks great Any luck on the scan ? 0 Back to top --> #28 bnr101 Posted 08 July 2007 - 08:30 PM Sorry, got caught up in this episode of SVU Here's the dr log:inst.exe;C:\Documents and Settings\All Users\Application Data\AOL Downloads\ssc_suite_installer_210.5.2.1_suite;Probably BACKDOOR.Trojan;; Process.exe;C:\Documents and Settings\Belinda\Desktop\SDFix\apps;Tool.Prockill;; Process.exe;C:\Documents and Settings\Belinda\Desktop\SmitfraudFix;Tool.Prockill;; KillWind.exe;C:\hp\bin;Tool.ProcessKill;; Process.exe;C:\Program Files\America Online 9.0\download\SmitfraudFix;Tool.Prockill;; setup.exe;C:\Program Files\Common Files\AOL\Backup\ACS\Current\Suite;Probably BACKDOOR.Trojan;; mcinst.exe;C:\Program Files\Common Files\McAfee\Installer;Probably BACKDOOR.Trojan;; Process.exe;C:\SDFix\apps;Tool.Prockill;; A0160500.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP230;Probably MULDROP.Trojan;; A0167303.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP254;Trojan.Click.444;Deleted.; A0167965.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP261;Tool.Prockill;; A0168004.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP261;Tool.Prockill;; A0168032.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP261;Tool.ShutDown.11;; A0168034.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP261;Tool.Prockill;; A0168096.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP261;Tool.Prockill;; A0168104.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP261;Tool.ShutDown.11;; A0168106.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP261;Tool.Prockill;; A0169433.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP263;Tool.ShutDown.11;; A0169435.exe;C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP263;Tool.ShutDown.11;; TMP_FILE_1.tmp;C:\WINDOWS;Trojan.MulDrop.4313;Deleted.; Process.exe;C:\WINDOWS\system32;Tool.Prockill;; --------------------------------------------------------------------------------See what's free at AOL.com. Edited by bnr101, 08 July 2007 - 08:45 PM. 0 Back to top --> #29 don77 Posted 09 July 2007 - 04:48 PM don77 Malware Expert Retired Staff 18,526 posts Looking Good Just one more scan to be sure we got it allPlease do an online scan with Kaspersky WebScannerClick on Kaspersky Online ScannerYou will be promted to install an ActiveX component from Kaspersky, Click Yes.The program will launch and then begin downloading the latest definition files:Once the files have been downloaded click on NEXTNow click on Scan SettingsIn the scan settings make that the following are selected:Scan using the following Anti-Virus database:Extended (if available otherwise Standard)Scan Options:Scan ArchivesScan Mail BasesClick OKNow under select a target to scan:Select My ComputerThis will program will start and scan your system.The scan will

Logs:Otmoveitc:\windows\downloaded program files\ipreg32.inf moved successfully.c:\windows\ms3.exe moved successfully.c:\windows\uniq moved successfully.c:\windows\system32\cache32dsrf4535dfs moved successfully.c:\documents and settings\all users\application data\vidctrl moved successfully.C:\Documents and Settings\Steve\Local Settings\Temp\SpamBlockerUtilityU.exe moved successfully.File/Folder C:\Documents and Settings\Steve\Local Settings\Temp\UDC6_0001_D19M1908\installer.exe not found. Created on 07/08/2007 18:13:15 ActivescanIncident Status Location Adware:adware/cws.searchmeup Not disinfected c:\windows\ms4.exe Spyware:spyware/media-motor Not disinfected Windows Registry Adware:adware/transponder Not disinfected Windows Registry Adware:adware/novo Not disinfected Windows Registry Adware:adware/hotoffers Not disinfected Windows Registry Potentially unwanted tool:application/kill&clean Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\extensions\CmdMapping\{BF69DF00-2734-477F-8257-27CD04F88779} Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Belinda\Cookies\belinda@2o7[1].txt Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Belinda\Desktop\SDFix\apps\Process.exe Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Belinda\Desktop\SDFix.exe[SDFix\apps\Process.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Belinda\Desktop\SmitfraudFix\Process.exe Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\fixwareout\FindT\nircmd.exe Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe Potentially unwanted tool:Application/Processor Not disinfected C:\Program Files\America Online 9.0\download\SmitfraudFix\Process.exe Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\apps\Process.exe Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe Adware:Adware/Zango Not disinfected C:\_OTMoveIt\MovedFiles\documents and settings\Steve\Local Settings\Temp\SpamBlockerUtilityU.exe[SBTVSetup.exe][SBTV.exe] Adware:Adware/IST Not disinfected C:\_OTMoveIt\MovedFiles\documents and settings\Steve\Local Settings\Temp\SpamBlockerUtilityU.exe[SBTVSetup.exe][SBTVHelper.dll] Spyware:Spyware/Iehelp 0 Back to top --> #19 bnr101 Posted 08 July 2007 - 05:15 PM Logfile of Trend Micro HijackThis Scan saved at 7:11:07 PM, on 7/8/2007Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeC:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeC:\Program Files\Common Files\AOL\1165359182\ee\services\safetyCore\ver210_5_2_1\aolavupd.exeC:\Program Files\CA\PPRT\bin\ITMRTSVC.exeC:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\mcafee.com\personal firewall\MPFService.exeC:\Program Files\Softex\OmniPass\Omniserv.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Softex\OmniPass\OPXPApp.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exeC:\Program Files\Multimedia Card Reader\shwicon2k.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\sm56hlpr.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Java\jre1.5.0_11\bin\jusched.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\AOL\1165359182\ee\AOLSoftware.exeC:\Program Files\Common Files\AOL\1165359182\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exeC:\Program Files\mcafee.com\antivirus\oasclnt.exeC:\Program Files\mcafee.com\antivirus\mcvsescn.exeC:\Program Files\mcafee.com\personal firewall\MPfTray.exeC:\Program Files\HP\HP Software Update\HPWuSchd2.exeC:\HP\KBD\KBD.EXEC:\Program Files\Common Files\AOL\1165359182\ee\SSCEvtHdlr.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\America Online 9.0\waol.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Common Files\AOL\1165359182\ee\aolsoftware.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\WINDOWS\System32\taskmgr.exeC:\Program Files\America Online 9.0\shellmon.exeC:\Documents and Settings\Belinda\Desktop\hijackthis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dllO4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exeO4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exeO4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXEO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetectO4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1165359182\ee\AOLSoftware.exeO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1165359182\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exeO4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1165359182\ee\SSCRun.exeO4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exeO4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exeO4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exeO4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program