Solve : Trojan SHeur.AWKY? – InterviewSolution

InterviewSolution

1.	Solve : Trojan SHeur.AWKY?
Answer» Hi, I found your site yesterday and I'm hoping you can help me. We've had this virus for a while but it was in the userinit file so we couldn't delete it and didn't know how to get rid of it. I have followed the "read this before requesting malware..." and here are the logs. It doesn't seem to have stopped the computer working but it can't be good to have it. Thanks for giving your time to help Jane McDonald ................................. SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 11/30/2009 at 02:59 PM Application Version : 4.31.1000 Core Rules Database Version : 4319 Trace Rules Database Version: 2177 Scan type : Complete Scan Total Scan Time : 02:38:21 Memory items scanned : 523 Memory threats detected : 0 Registry items scanned : 6486 Registry threats detected : 22 File items scanned : 120017 File threats detected : 149 Adware.HotBar/ShopperReports (Low Risk) HKU\.DEFAULT\Software\MICROSOFT\Windows\CurrentVersion\Ext\Stats\{100EB1FD-D03E-47FD-81F3-EE91287F9465} HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{100EB1FD-D03E-47FD-81F3-EE91287F9465} Trojan.Agent/Gen HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1F88A6F5-908C-4C28-9A81-829953C5F5C5} HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1F88A6F5-908C-4C28-9A81-829953C5F5C5} Unclassified.Unknown Origin HKCR\PROTOCOLS\Filter\text/html HKCR\PROTOCOLS\Filter\text/html#CLSID Adware.Tracking Cookie C:\Documents and Settings\User\Cookies\[emailprotected][2].txt C:\Documents and Settings\User\Cookies\[emailprotected][4].txt C:\Documents and Settings\User\Cookies\[emailprotected][2].txt C:\Documents and Settings\User\Cookies\[emailprotected][1].txt C:\Documents and Settings\User\Cookies\[emailprotected][1].txt C:\Documents and Settings\User\Cookies\[emailprotected][1].txt C:\Documents and Settings\User\Cookies\[emailprotected][1].txt C:\Documents and Settings\User\Cookies\[emailprotected][1].txt C:\Documents and Settings\User\Cookies\[emailprotected][1].txt C:\Documents and Settings\User\Cookies\[emailprotected][1].txt Registry Cleaner Trial HKCR\Install.Install HKCR\Install.Install\CLSID HKCR\Install.Install\CurVer HKCR\Install.Install.1 HKCR\Install.Install.1\CLSID Adware.MyWebSearch/FunWebProducts HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE#NextInstance HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000#Service HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000#Legacy HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000#ConfigFlags HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000#Class HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000#ClassGUID HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE\0000#DeviceDesc Adware.Zango Toolbar/Hb C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\1070503.sdf C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\2633103.sdf C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\ASPL1.dat C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\hstat\34f0.dat C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\hstat C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\127887 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\13546 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\221757 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\23149 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\23901 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\26340 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\27503 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\29115 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\32242 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\34123 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\34137 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\34186 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\345676 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\34632 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\44228 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\44293 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\44323 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\44750 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\44878 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\45820 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\52335 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\540999 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\54473 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\59844 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\61837 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\67215 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\67226 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\67466 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\751219 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\751227 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\7521 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\79257 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\87439 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\87579 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\94407 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\95676 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\95803 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\95825 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\95828 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\97741 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML\98248 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\TooltipXML C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic\ustat C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\btntrans1.dat C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\buttondir.txt C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\components.cdf C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\default.cdf C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_511745-514279.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_bidzC_ZT_IE-ca.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_bidzC_ZT_IE-us.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_categorize.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_comparison.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_explorer-Mails.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_explorer-people.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_favorites.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Games.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Hide.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hotbarcom.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Hotmail.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_hsskin.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jemster.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jemsterie.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jemsteruk.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_jobsearch.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_Mails.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_MobileSidewalk.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_MobileSW-US.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_new.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_premium.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_reun.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_ringtones.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_SearchBoxTrapper.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_searchfor.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_searchgo.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_weather.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Default_yellowpages.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_1000.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_2000.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_3000.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bar.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_bbar1.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_logos.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\d_icons_buttons_other.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-548964.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-def-511724-9595.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\email-t1-bg.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\icons2.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\keywords.idx C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\keywords1.dat C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\layout.cdf C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\linkpathlegal.txt C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\progress.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\sales_buttons.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\s_icons_buttons.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\t2_bg.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\theweb.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\top7.cdf C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\Top7_theweb.mnu C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\tsd_bg.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1\zango.res C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\1 C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\BtnTrans1.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\buttondir.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\default.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_1000.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_2000.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_3000.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bar.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_bbar1.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_logos.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\d_icons_buttons_other.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\email-t1-bg.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\icons2.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\keywords.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\keywords1.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\layout.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\linkpathlegal.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\progress.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\sales_buttons.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\samplegroups2.txt C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\samplegroups2.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\s_icons_buttons.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\t2_bg.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\top7.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\tsd_bg.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad\zango.xip C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static\DownLoad C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar\static C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0\ZangoToolbar C:\Documents and Settings\User\Application Data\ZangoToolbar\v3.0 C:\Documents and Settings\User\Application Data\ZangoToolbar\zbar.log C:\Documents and Settings\User\Application Data\ZangoToolbar Trojan.Unclassified/BraviaX HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run#braviax HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run#braviax ....................................... ............... Malwarebytes' Anti-Malware 1.41 Database version: 3261 Windows 5.1.2600 Service Pack 3 30/11/2009 16:07:06 mbam-log-2009-11-30 (16-07-06).txt Scan type: Quick Scan Objects scanned: 105302 Time elapsed: 8 minute(s), 30 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\idid (Trojan.Sasfix) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\host (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\id (Malware.Trace) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ....................................... ................... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:01:59, on 30/11/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe C:\WINDOWS\system32\atwtusb.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\OLYMPUS\DeviceDetector\DevDtct2.exe C:\Program Files\SAGEM\SAGEM [emailprotected] 800-840\dslmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HijackThis\Sniper.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/http://uk.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/http://uk.search.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = .local R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150595.exe -Update -1150595 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322)" -"http://www.arcadetown.com/nannymania/playiframe.asp" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\OLYMPUS\DeviceDetector\DevDtct2.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM [emailprotected] 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\User\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://toolbar.imageshack.us O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload WRAPPER) - http://chat.yahoo.com/cab/yuplapp.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.ezarchive.com/zbox/app/ImageUploader3.cab/_file-/ImageUploader3.cab O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.mediamax.com/Upload/XUpload.ocx O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab O18 - PROTOCOL: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: cru629.dat O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 12772 bytes

Discussion

No Comment Found

Related InterviewSolutions