Yet Another Cpvfeed.com Problem

Customer

September 04, 1175 18:00

I've been going crazy over these url.cpvfeed.com pop-ups. (I start Firefox and they make Explorer pop up! Insane!) I can't get rid of them and I've tried all sorts of spyware killers. Any help would be much appreciated!

I'll post my Ad-Aware log and then my HijackThis log.

Ad-Aware SE Build 1.06r1

Logfile Created on:Wednesday, March 28, 2007 5:58:02 AM

Created with Ad-Aware SE Personal, free for private use.

Using definitions file:SE1R163 26.03.2007

References detected during the scan:

MRU List(TAC index:0):6 total references

Tracking Cookie(TAC index:3):2 total references

Ad-Aware SE Settings

===========================

Set : Search for negligible risk entries

Set : Search for low-risk threats

Set : Safe mode (always request confirmation)

Set : Scan active processes

Set : Scan registry

Set : Deep-scan registry

Set : Scan my IE Favorites for banned URLs

Set : Scan my Hosts file

Extended Ad-Aware SE Settings

===========================

Set : Unload recognized processes & modules during scan

Set : Scan registry for all users instead of current user only

Set : Always try to unload modules before deletion

Set : During removal, unload Explorer and IE if necessary

Set : Let Windows remove files in use at next reboot

Set : Delete quarantined objects after restoring

Set : Include basic Ad-Aware settings in log file

Set : Include additional Ad-Aware settings in log file

Set : Include reference summary in log file

Set : Include alternate data stream details in log file

Set : Play sound at scan completion if scan locates critical objects

3-28-2007 5:58:02 AM - Scan started. (Smart mode)

Listing running processes

#:1 [smss.exe]

FilePath : \SystemRoot\System32\

ProcessID : 444

ThreadCreationTime : 3-28-2007 1:31:25 AM

BasePriority : Normal

#:2 [csrss.exe]

FilePath : \??\C:\XP\system32\

ProcessID : 524

ThreadCreationTime : 3-28-2007 1:31:32 AM

BasePriority : Normal

#:3 [winlogon.exe]

FilePath : \??\C:\XP\system32\

ProcessID : 548

ThreadCreationTime : 3-28-2007 1:31:33 AM

BasePriority : High

#:4 [services.exe]

FilePath : C:\XP\system32\

ProcessID : 592

ThreadCreationTime : 3-28-2007 1:31:33 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Services and Controller app

InternalName : services.exe

OriginalFilename : services.exe

#:5 [lsass.exe]

FilePath : C:\XP\system32\

ProcessID : 604

ThreadCreationTime : 3-28-2007 1:31:33 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : LSA Shell (Export Version)

InternalName : lsass.exe

OriginalFilename : lsass.exe

#:6 [svchost.exe]

FilePath : C:\XP\system32\

ProcessID : 768

ThreadCreationTime : 3-28-2007 1:31:38 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:7 [svchost.exe]

FilePath : C:\XP\system32\

ProcessID : 816

ThreadCreationTime : 3-28-2007 1:31:38 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:8 [svchost.exe]

FilePath : C:\XP\System32\

ProcessID : 884

ThreadCreationTime : 3-28-2007 1:31:39 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:9 [svchost.exe]

FilePath : C:\XP\system32\

ProcessID : 928

ThreadCreationTime : 3-28-2007 1:31:39 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:10 [svchost.exe]

FilePath : C:\XP\system32\

ProcessID : 1016

ThreadCreationTime : 3-28-2007 1:31:40 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:11 [ccsetmgr.exe]

FilePath : C:\Program Files\Common Files\Symantec Shared\

ProcessID : 1300

ThreadCreationTime : 3-28-2007 1:31:45 AM

BasePriority : Normal

FileVersion : 104.0.7.3

ProductVersion : 104.0.7.3

ProductName : Client and Host Security Platform

CompanyName : Symantec Corporation

FileDescription : Symantec Settings Manager Service

InternalName : ccSetMgr

OriginalFilename : ccSetMgr.exe

#:12 [ccevtmgr.exe]

FilePath : C:\Program Files\Common Files\Symantec Shared\

ProcessID : 1408

ThreadCreationTime : 3-28-2007 1:31:47 AM

BasePriority : Normal

FileVersion : 104.0.7.3

ProductVersion : 104.0.7.3

ProductName : Client and Host Security Platform

CompanyName : Symantec Corporation

FileDescription : Symantec Event Manager Service

InternalName : ccEvtMgr

OriginalFilename : ccEvtMgr.exe

#:13 [explorer.exe]

FilePath : C:\XP\

ProcessID : 1480

ThreadCreationTime : 3-28-2007 1:31:50 AM

BasePriority : Normal

FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 6.00.2900.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Windows Explorer

InternalName : explorer

OriginalFilename : EXPLORER.EXE

#:14 [spbbcsvc.exe]

FilePath : C:\Program Files\Common Files\Symantec Shared\SPBBC\

ProcessID : 1572

ThreadCreationTime : 3-28-2007 1:31:55 AM

BasePriority : Normal

FileVersion : 2.1.0.4

ProductVersion : 2.1.0.4

ProductName : SPBBC

CompanyName : Symantec Corporation

FileDescription : SPBBC Service

InternalName : SPBBCSvc

OriginalFilename : SPBBCSvc.exe

#:15 [spoolsv.exe]

FilePath : C:\XP\system32\

ProcessID : 1676

ThreadCreationTime : 3-28-2007 1:31:56 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Spooler SubSystem App

InternalName : spoolsv.exe

OriginalFilename : spoolsv.exe

#:16 [cdac11ba.exe]

FilePath : C:\XP\System32\drivers\

ProcessID : 1884

ThreadCreationTime : 3-28-2007 1:32:02 AM

BasePriority : Normal

FileVersion : 4.16.050

ProductVersion : 4.16.050 Windows NT 2002/04/24

ProductName : SafeCast Windows NT

CompanyName : Macrovision

FileDescription : Macrovision RTS Service

InternalName : CDANTSRV

OriginalFilename : CDANTSRV.EXE

Comments : StringFileInfo: U.S. English

#:17 [ctsvccda.exe]

FilePath : C:\XP\System32\

ProcessID : 1896

ThreadCreationTime : 3-28-2007 1:32:02 AM

BasePriority : Normal

FileVersion : 1.0.1.0

ProductVersion : 1.0.0.0

ProductName : Creative Service for CDROM Access

CompanyName : Creative Technology Ltd

FileDescription : Creative Service for CDROM Access

InternalName : CTsvcCDAEXE

OriginalFilename : CTsvcCDA.EXE

#:18 [gbpoll.exe]

FilePath : C:\Program Files\Norton SystemWorks\Norton GoBack\

ProcessID : 1944

ThreadCreationTime : 3-28-2007 1:32:02 AM

BasePriority : Normal

#:19 [nprotect.exe]

FilePath : C:\PROGRA~1\NORTON~3\NORTON~1\

ProcessID : 2012

ThreadCreationTime : 3-28-2007 1:32:03 AM

BasePriority : Normal

FileVersion : 19.0.1.8

ProductVersion : 19.0.1.8

ProductName : Norton Utilities

CompanyName : Symantec Corporation

FileDescription : Norton Protection Status

InternalName : NPROTECT

LegalTrademarks : Norton UtilitiesÂ® and UnEraseÂ® are registered trademarks of Symantec Corporation.

OriginalFilename : NPROTECT.EXE

#:20 [hpzipm12.exe]

FilePath : C:\XP\System32\

ProcessID : 244

ThreadCreationTime : 3-28-2007 1:32:07 AM

BasePriority : Normal

FileVersion : 9, 0, 0, 0

ProductVersion : 9, 0, 0, 0

ProductName : HP PML

CompanyName : HP

FileDescription : PML Driver

InternalName : PmlDrv

OriginalFilename : PmlDrv.exe

#:21 [nopdb.exe]

FilePath : C:\PROGRA~1\NORTON~3\NORTON~1\SPEEDD~1\

ProcessID : 388

ThreadCreationTime : 3-28-2007 1:32:08 AM

BasePriority : Normal

FileVersion : 7.00.0.24

ProductVersion : 7.00.0.24

ProductName : Norton Speed Disk

CompanyName : Symantec Corporation

FileDescription : NOPDB

InternalName : NOPDB

OriginalFilename : NOPDB.dll

#:22 [svchost.exe]

FilePath : C:\XP\system32\

ProcessID : 460

ThreadCreationTime : 3-28-2007 1:32:09 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:23 [symlcsvc.exe]

FilePath : C:\Program Files\Common Files\Symantec Shared\CCPD-LC\

ProcessID : 488

ThreadCreationTime : 3-28-2007 1:32:10 AM

BasePriority : Normal

FileVersion : 1.9.1.826

ProductVersion : 1.9.1.826

ProductName : Symantec Core Component

CompanyName : Symantec Corporation

FileDescription : Symantec Core Component

InternalName : symlcsvc

OriginalFilename : symlcsvc.exe

#:24 [mspmspsv.exe]

FilePath : C:\XP\System32\

ProcessID : 660

ThreadCreationTime : 3-28-2007 1:32:11 AM

BasePriority : Normal

FileVersion : 7.00.00.1954

ProductVersion : 7.00.00.1954

ProductName : Microsoft ® DRM

CompanyName : Microsoft Corporation

FileDescription : WMDM PMSP Service

InternalName : MSPMSPSV.EXE

OriginalFilename : MSPMSPSV.EXE

#:25 [alg.exe]

FilePath : C:\XP\System32\

ProcessID : 2072

ThreadCreationTime : 3-28-2007 1:32:19 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Application Layer Gateway Service

InternalName : ALG.exe

OriginalFilename : ALG.exe

#:26 [hpwuschd2.exe]

FilePath : C:\Program Files\HP\HP Software Update\

ProcessID : 2204

ThreadCreationTime : 3-28-2007 1:32:25 AM

BasePriority : Normal

FileVersion : 50.0.146.000

ProductVersion : 050.000.146.000

ProductName : hp digital imaging - hp all-in-one series

CompanyName : Hewlett-Packard Co.

FileDescription : Hewlett-Packard Product Assistant

InternalName : hpwuSchd2

OriginalFilename : hpwuSchd2.exe

Comments : Hewlett-Packard Product Assistant

#:27 [googledesktop.exe]

FilePath : C:\Program Files\Google\Google Desktop Search\

ProcessID : 2328

ThreadCreationTime : 3-28-2007 1:32:26 AM

BasePriority : Normal

FileVersion : 5.1.703.13372

ProductVersion : 5.1.703.13372

ProductName : Google Desktop

CompanyName : Google

FileDescription : Google Desktop

InternalName : Google Desktop

#:28 [jusched.exe]

FilePath : C:\Program Files\Java\jre1.5.0_11\bin\

ProcessID : 2416

ThreadCreationTime : 3-28-2007 1:32:26 AM

BasePriority : Normal

#:29 [point32.exe]

FilePath : C:\Program Files\Microsoft Hardware\Mouse\

ProcessID : 2556

ThreadCreationTime : 3-28-2007 1:32:27 AM

BasePriority : Normal

#:30 [ccapp.exe]

FilePath : C:\Program Files\Common Files\Symantec Shared\

ProcessID : 2592

ThreadCreationTime : 3-28-2007 1:32:28 AM

BasePriority : Normal

FileVersion : 104.0.7.3

ProductVersion : 104.0.7.3

ProductName : Client and Host Security Platform

CompanyName : Symantec Corporation

FileDescription : Symantec User Session

InternalName : ccApp

OriginalFilename : ccApp.exe

#:31 [qttask.exe]

FilePath : C:\Program Files\QuickTime\

ProcessID : 2608

ThreadCreationTime : 3-28-2007 1:32:28 AM

BasePriority : Normal

FileVersion : 7.1.5

ProductVersion : QuickTime 7.1.5

ProductName : QuickTime

CompanyName : Apple Computer, Inc.

FileDescription : QuickTime Task

InternalName : QuickTime Task

LegalCopyright : Copyright Apple Computer, Inc. 1989-2007

OriginalFilename : QTTask.exe

#:32 [ituneshelper.exe]

FilePath : C:\Program Files\iTunes\

ProcessID : 2644

ThreadCreationTime : 3-28-2007 1:32:29 AM

BasePriority : Normal

FileVersion : 7.1.1.5

ProductVersion : 7.1.1.5

ProductName : iTunes

CompanyName : Apple Inc.

FileDescription : iTunesHelper Module

InternalName : iTunesHelper

OriginalFilename : iTunesHelper.exe

#:33 [googledesktop.exe]

FilePath : C:\Program Files\Google\Google Desktop Search\

ProcessID : 2668

ThreadCreationTime : 3-28-2007 1:32:29 AM

BasePriority : Normal

FileVersion : 5.1.703.13372

ProductVersion : 5.1.703.13372

ProductName : Google Desktop

CompanyName : Google

FileDescription : Google Desktop

InternalName : Google Desktop

#:34 [svchost.exe]

FilePath : C:\XP\System32\

ProcessID : 2692

ThreadCreationTime : 3-28-2007 1:32:30 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:35 [wcescomm.exe]

FilePath : C:\Program Files\Microsoft ActiveSync\

ProcessID : 2728

ThreadCreationTime : 3-28-2007 1:32:31 AM

BasePriority : Normal

FileVersion : 3.8.0.5004

ProductVersion : 3.8.5004

ProductName : Microsoft ActiveSync

CompanyName : Microsoft Corporation

FileDescription : ActiveSync Connection Manager

InternalName : wcescomm

LegalTrademarks : MicrosoftÂ® and WindowsÂ® are registered trademarks of Microsoft Corporation.

OriginalFilename : WCESCOMM.EXE

#:36 [cka.exe]

FilePath : C:\Program Files\Norton SystemWorks\CKA\

ProcessID : 2772

ThreadCreationTime : 3-28-2007 1:32:32 AM

BasePriority : Normal

FileVersion : 9.00.2

ProductVersion : 9.00.2

ProductName : Norton SystemWorks

CompanyName : Symantec Corporation

FileDescription : Connection Keep Alive

InternalName : CKA

OriginalFilename : CKA.exe

#:37 [ctfmon.exe]

FilePath : C:\XP\system32\

ProcessID : 2896

ThreadCreationTime : 3-28-2007 1:32:34 AM

BasePriority : Normal

FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

ProductVersion : 5.1.2600.2180

ProductName : MicrosoftÂ® WindowsÂ® Operating System

CompanyName : Microsoft Corporation

FileDescription : CTF Loader

InternalName : CTFMON

OriginalFilename : CTFMON.EXE

#:38 [ipodservice.exe]

FilePath : C:\Program Files\iPod\bin\

ProcessID : 2920

ThreadCreationTime : 3-28-2007 1:32:35 AM

BasePriority : Normal

FileVersion : 7.1.1.5

ProductVersion : 7.1.1.5

ProductName : iTunes

CompanyName : Apple Inc.

FileDescription : iPodService Module

InternalName : iPodService

OriginalFilename : iPodService.exe

#:39 [gbtray.exe]

FilePath : C:\Program Files\Norton SystemWorks\Norton GoBack\

ProcessID : 2948

ThreadCreationTime : 3-28-2007 1:32:35 AM

BasePriority : Normal

#:40 [googledesktop.exe]

FilePath : C:\Program Files\Google\Google Desktop Search\

ProcessID : 2972

ThreadCreationTime : 3-28-2007 1:32:36 AM

BasePriority : Normal

FileVersion : 5.1.703.13372

ProductVersion : 5.1.703.13372

ProductName : Google Desktop

CompanyName : Google

FileDescription : Google Desktop

InternalName : Google Desktop

#:41 [acrotray.exe]

FilePath : C:\Program Files\Adobe\Acrobat 6.0\Distillr\

ProcessID : 3028

ThreadCreationTime : 3-28-2007 1:32:38 AM

BasePriority : Normal

FileVersion : 6.0.1.2003102300

ProductVersion : 6.0.1.2003102300

ProductName : AcroTray - Adobe Acrobat Distiller helper application.

CompanyName : Adobe Systems Inc.

FileDescription : AcroTray

InternalName : AcroTray

OriginalFilename : AcroTray.exe

#:42 [nscsrvce.exe]

FilePath : C:\Program Files\Common Files\Symantec Shared\Security Console\

ProcessID : 3556

ThreadCreationTime : 3-28-2007 1:33:31 AM

BasePriority : Normal

FileVersion : 2006.1.8.2

ProductVersion : 2006.1.8

ProductName : Norton Security Console

CompanyName : Symantec Corporation

FileDescription : Norton Security Console Norton Protection Center Service

InternalName : NSCService

OriginalFilename : NSCSrvce.exe

#:43 [outlook.exe]

FilePath : C:\Program Files\Microsoft Office\OFFICE11\

ProcessID : 3616

ThreadCreationTime : 3-28-2007 2:22:52 AM

BasePriority : Normal

#:44 [firefox.exe]

FilePath : C:\PROGRA~1\Mozilla Firefox\

ProcessID : 3936

ThreadCreationTime : 3-28-2007 12:51:52 PM

BasePriority : Normal

#:45 [iexplore.exe]

FilePath : C:\Program Files\Internet Explorer\

ProcessID : 844

ThreadCreationTime : 3-28-2007 12:52:00 PM

BasePriority : Normal

FileVersion : 7.00.5730.11 (winmain(wmbla).061017-1135)

ProductVersion : 7.00.5730.11

ProductName : WindowsÂ® Internet Explorer

CompanyName : Microsoft Corporation

FileDescription : Internet Explorer

InternalName : iexplore

OriginalFilename : IEXPLORE.EXE

#:46 [ad-aware.exe]

FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\

ProcessID : 1164

ThreadCreationTime : 3-28-2007 12:55:44 PM

BasePriority : Normal

FileVersion : 6.2.0.236

ProductVersion : SE 106

ProductName : Lavasoft Ad-Aware SE

CompanyName : Lavasoft Sweden

FileDescription : Ad-Aware SE Core application

InternalName : Ad-Aware.exe

OriginalFilename : Ad-Aware.exe

Memory scan result:

New critical objects: 0

Objects found so far: 0

Started registry scan

Registry Scan result:

New critical objects: 0

Objects found so far: 0

Started deep registry scan

Deep registry scan result:

New critical objects: 0

Objects found so far: 0

Started Tracking Cookie scan

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : ted_gideonse@live365[1].txt

TAC Rating : 3

Category : Data Miner

Comment : Hits:1

Value : Cookie:ted gideonse@live365.com/

Expires : 3-30-2012 3:24:28 PM

LastSync : Hits:1

UseCount : 0

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : ted_gideonse@mediaplex[1].txt

TAC Rating : 3

Category : Data Miner

Comment : Hits:1

Value : Cookie:ted gideonse@mediaplex.com/

Expires : 6-21-2009 5:00:00 PM

LastSync : Hits:1

UseCount : 0

Tracking cookie scan result:

New critical objects: 2

Objects found so far: 2

Deep scanning and examining files...

Disk Scan Result for C:\XP

New critical objects: 0

Objects found so far: 2

Disk Scan Result for C:\XP\system32

New critical objects: 0

Objects found so far: 2

Disk Scan Result for C:\DOCUME~1\TEDGID~1\LOCALS~1\Temp\

New critical objects: 0

Objects found so far: 2

Scanning Hosts file......

Hosts file location:"C:\XP\system32\drivers\etc\hosts".

Hosts file scan result:

1 entries scanned.

New critical objects:0

Objects found so far: 2

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct3d

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct X

MRU List Object Recognized!

Location: : software\microsoft\directdraw\mostrecentapplication

Description : most recent application to use microsoft directdraw

MRU List Object Recognized!

Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\directinput\mostrecentapplication

Description : most recent application to use microsoft directinput

MRU List Object Recognized!

Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\directinput\mostrecentapplication

Description : most recent application to use microsoft directinput

MRU List Object Recognized!

Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\windows media\wmsdk\general

Description : windows media sdk

Performing conditional scans...

Conditional scan result:

New critical objects: 0

Objects found so far: 8

6:05:13 AM Scan Complete

Summary Of This Scan

Total scanning time:00:07:11.516

Objects scanned:99136

Objects identified:2

Objects ignored:0

New critical objects:2

Logfile of HijackThis v1.99.1

Scan saved at 6:59:38 AM, on 3/28/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:

C:\XP\System32\smss.exe

C:\XP\system32\winlogon.exe

C:\XP\system32\services.exe

C:\XP\system32\lsass.exe

C:\XP\system32\svchost.exe

C:\XP\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\XP\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\XP\system32\spoolsv.exe

C:\XP\System32\drivers\CDAC11BA.EXE

C:\XP\System32\CTsvcCDA.EXE

C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe

C:\PROGRA~1\NORTON~3\NORTON~1\NPROTECT.EXE

C:\XP\System32\HPZipm12.exe

C:\PROGRA~1\NORTON~3\NORTON~1\SPEEDD~1\NOPDB.EXE

C:\XP\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\XP\System32\MsPMSPSv.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\XP\System32\svchost.exe

C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

C:\Program Files\Norton SystemWorks\CKA\CKA.exe

C:\XP\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\XP\system32\notepad.exe

C:\PROGRA~1\Mozilla Firefox\firefox.exe

C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://webproxy.ucsd.edu/proxy.pl:8000

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [YCentral] c:\progra~1\yahoo!\YCentral\YahooCentral.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\XP\system32\dmpybgqq.dll",setvm

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [algchk.exe] C:\XP\System32\algchk.exe

O4 - HKCU\..\Run: [symKeepAlive] C:\Program Files\Norton SystemWorks\CKA\CKA.exe

O4 - HKCU\..\Run: [Nero PhotoShow Media Manager] C:\PROGRA~1\Nero\NEROPH~1\data\Xtras\mssysmgr.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\XP\system32\ctfmon.exe

O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk

O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200112...meInstaller.exe

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\XP\system32\WPDShServiceObj.dll

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\XP\System32\drivers\CDAC11BA.EXE

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\XP\System32\CTsvcCDA.EXE

O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe

O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - LxrSII1s.exe (file missing)

O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~1\NPROTECT.EXE

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: Pml Driver HPZ12 - HP - C:\XP\System32\HPZipm12.exe

O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~1\SPEEDD~1\NOPDB.EXE

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Help!

Comments

3 comments

Customer

June 09, 2021 11:17
submit
C:\XP\System32\algchk.exe
to
http://www.virustotal.com/en/indexx.html
and post the results here.

Also note that you are only running ad-aware in smart (quick) scan mode, not full mode.
0
Customer

June 09, 2021 11:17
Unfortunately, I deleted algchk.exe before I saw your reply. But it didn't do anything, so I guess it wasn't the culprit. I'm still getting the cpvfeed pop-ups. Below is the full-scan log and the latest Hijackthis log.

Ad-Aware SE Build 1.06r1
Logfile Created on:Tuesday, April 03, 2007 8:16:48 AM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R164 02.04.2007
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

References detected during the scan:
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
MRU List(TAC index:0):12 total references
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects

4/3/2007 8:16:48 AM - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\Ted Gideonse\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office

MRU List Object Recognized!
Location: : C:\Documents and Settings\Ted Gideonse\recent
Description : list of recently opened documents

MRU List Object Recognized!
Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\adobe\adobe acrobat\6.0\avgeneral\crecentfiles
Description : list of recently used files in adobe acrobat

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X

MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw

MRU List Object Recognized!
Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\office\11.0\common\open find\microsoft office word\settings\open\file name mru
Description : list of recent documents opened by microsoft word

MRU List Object Recognized!
Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\office\11.0\common\open find\microsoft office word\settings\save as\file name mru
Description : list of recent documents saved by microsoft word

MRU List Object Recognized!
Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened

MRU List Object Recognized!
Location: : S-1-5-21-746137067-1767777339-682003330-1003\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

Listing running processes
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 452
ThreadCreationTime : 4/2/2007 5:06:33 PM
BasePriority : Normal

#:2 [csrss.exe]
FilePath : \??\C:\XP\system32\
ProcessID : 532
ThreadCreationTime : 4/2/2007 5:06:41 PM
BasePriority : Normal

#:3 [winlogon.exe]
FilePath : \??\C:\XP\system32\
ProcessID : 556
ThreadCreationTime : 4/2/2007 5:06:42 PM
BasePriority : High

#:4 [services.exe]
FilePath : C:\XP\system32\
ProcessID : 600
ThreadCreationTime : 4/2/2007 5:06:43 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\XP\system32\
ProcessID : 612
ThreadCreationTime : 4/2/2007 5:06:43 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\XP\system32\
ProcessID : 800
ThreadCreationTime : 4/2/2007 5:06:49 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\XP\system32\
ProcessID : 848
ThreadCreationTime : 4/2/2007 5:06:50 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\XP\System32\
ProcessID : 940
ThreadCreationTime : 4/2/2007 5:06:50 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\XP\system32\
ProcessID : 1040
ThreadCreationTime : 4/2/2007 5:06:52 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [svchost.exe]
FilePath : C:\XP\system32\
ProcessID : 1172
ThreadCreationTime : 4/2/2007 5:06:53 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:11 [ccsetmgr.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 1308
ThreadCreationTime : 4/2/2007 5:06:55 PM
BasePriority : Normal
FileVersion : 104.0.7.3
ProductVersion : 104.0.7.3
ProductName : Client and Host Security Platform
CompanyName : Symantec Corporation
FileDescription : Symantec Settings Manager Service
InternalName : ccSetMgr
LegalCopyright : Copyright © 2000-2005 Symantec Corporation. All rights reserved.
OriginalFilename : ccSetMgr.exe

#:12 [ccevtmgr.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 1624
ThreadCreationTime : 4/2/2007 5:07:00 PM
BasePriority : Normal
FileVersion : 104.0.7.3
ProductVersion : 104.0.7.3
ProductName : Client and Host Security Platform
CompanyName : Symantec Corporation
FileDescription : Symantec Event Manager Service
InternalName : ccEvtMgr
LegalCopyright : Copyright © 2000-2005 Symantec Corporation. All rights reserved.
OriginalFilename : ccEvtMgr.exe

#:13 [ccproxy.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 1800
ThreadCreationTime : 4/2/2007 5:07:09 PM
BasePriority : Normal
FileVersion : 104.0.5.3
ProductVersion : 104.0.5.3
ProductName : Client and Host Security Platform
CompanyName : Symantec Corporation
FileDescription : Symantec Network Proxy Service
InternalName : ccProxy
LegalCopyright : Copyright © 2000-2005 Symantec Corporation. All rights reserved.
OriginalFilename : ccProxy.exe

#:14 [sndsrvc.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 1836
ThreadCreationTime : 4/2/2007 5:07:10 PM
BasePriority : Normal
FileVersion : 6.0.2.211
ProductVersion : 6.0
ProductName : Symantec Security Drivers
CompanyName : Symantec Corporation
FileDescription : Network Driver Service
InternalName : SndSrvc
LegalCopyright : Copyright 2002 - 2005 Symantec Corporation
OriginalFilename : SndSrvc.exe

#:15 [spbbcsvc.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\SPBBC\
ProcessID : 1884
ThreadCreationTime : 4/2/2007 5:07:10 PM
BasePriority : Normal
FileVersion : 2.1.0.4
ProductVersion : 2.1.0.4
ProductName : SPBBC
CompanyName : Symantec Corporation
FileDescription : SPBBC Service
InternalName : SPBBCSvc
LegalCopyright : Copyright © 2004, 2005 Symantec Corporation. All rights reserved.
OriginalFilename : SPBBCSvc.exe

#:16 [spoolsv.exe]
FilePath : C:\XP\system32\
ProcessID : 192
ThreadCreationTime : 4/2/2007 5:07:12 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:17 [aluschedulersvc.exe]
FilePath : C:\Program Files\Symantec\LiveUpdate\
ProcessID : 412
ThreadCreationTime : 4/2/2007 5:07:19 PM
BasePriority : Normal
FileVersion : 3.0.0.154
ProductVersion : 3.0.0.154
ProductName : LiveUpdate
CompanyName : Symantec Corporation
FileDescription : Automatic LiveUpdate Scheduler Service
InternalName : Automatic LiveUpdate Scheduler Service
LegalCopyright : Copyright Â© 1996-2005 Symantec Corporation
OriginalFilename : ALUSchedulerSvc.exe

#:18 [cdac11ba.exe]
FilePath : C:\XP\System32\drivers\
ProcessID : 492
ThreadCreationTime : 4/2/2007 5:07:19 PM
BasePriority : Normal
FileVersion : 4.16.050
ProductVersion : 4.16.050 Windows NT 2002/04/24
ProductName : SafeCast Windows NT
CompanyName : Macrovision
FileDescription : Macrovision RTS Service
InternalName : CDANTSRV
LegalCopyright : Copyright © 1998-2002 Macrovision Corp.
OriginalFilename : CDANTSRV.EXE
Comments : StringFileInfo: U.S. English

#:19 [ctsvccda.exe]
FilePath : C:\XP\System32\
ProcessID : 496
ThreadCreationTime : 4/2/2007 5:07:19 PM
BasePriority : Normal
FileVersion : 1.0.1.0
ProductVersion : 1.0.0.0
ProductName : Creative Service for CDROM Access
CompanyName : Creative Technology Ltd
FileDescription : Creative Service for CDROM Access
InternalName : CTsvcCDAEXE
LegalCopyright : Copyright © Creative Technology Ltd., 1999. All rights reserved.
OriginalFilename : CTsvcCDA.EXE

#:20 [gbpoll.exe]
FilePath : C:\Program Files\Norton SystemWorks\Norton GoBack\
ProcessID : 536
ThreadCreationTime : 4/2/2007 5:07:19 PM
BasePriority : Normal

#:21 [navapsvc.exe]
FilePath : C:\Program Files\Norton Internet Security\Norton AntiVirus\
ProcessID : 916
ThreadCreationTime : 4/2/2007 5:07:20 PM
BasePriority : Normal
FileVersion : 12.2.0.13
ProductVersion : 12.2.0
ProductName : Norton AntiVirus
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Auto-Protect Service
InternalName : NAVAPSVC
LegalCopyright : Norton AntiVirus 2006 for Windows 2000/XP Copyright Â© 2005 Symantec Corporation. All rights reserved.
OriginalFilename : NAVAPSVC.EXE

#:22 [nprotect.exe]
FilePath : C:\PROGRA~1\NORTON~3\NORTON~1\
ProcessID : 1224
ThreadCreationTime : 4/2/2007 5:07:21 PM
BasePriority : Normal
FileVersion : 19.0.1.8
ProductVersion : 19.0.1.8
ProductName : Norton Utilities
CompanyName : Symantec Corporation
FileDescription : Norton Protection Status
InternalName : NPROTECT
LegalCopyright : Copyright © 1997-2005 Symantec Corporation
LegalTrademarks : Norton UtilitiesÂ® and UnEraseÂ® are registered trademarks of Symantec Corporation.
OriginalFilename : NPROTECT.EXE

#:23 [hpzipm12.exe]
FilePath : C:\XP\System32\
ProcessID : 1296
ThreadCreationTime : 4/2/2007 5:07:24 PM
BasePriority : Normal
FileVersion : 9, 0, 0, 0
ProductVersion : 9, 0, 0, 0
ProductName : HP PML
CompanyName : HP
FileDescription : PML Driver
InternalName : PmlDrv
LegalCopyright : Copyright Â© 1998, 1999 Hewlett-Packard Company
OriginalFilename : PmlDrv.exe

#:24 [nopdb.exe]
FilePath : C:\PROGRA~1\NORTON~3\NORTON~1\SPEEDD~1\
ProcessID : 1464
ThreadCreationTime : 4/2/2007 5:07:25 PM
BasePriority : Normal
FileVersion : 7.00.0.24
ProductVersion : 7.00.0.24
ProductName : Norton Speed Disk
CompanyName : Symantec Corporation
FileDescription : NOPDB
InternalName : NOPDB
LegalCopyright : Copyright © 1997-2005 Symantec Corporation
OriginalFilename : NOPDB.dll

#:25 [svchost.exe]
FilePath : C:\XP\system32\
ProcessID : 1540
ThreadCreationTime : 4/2/2007 5:07:27 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:26 [symlcsvc.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\CCPD-LC\
ProcessID : 1572
ThreadCreationTime : 4/2/2007 5:07:27 PM
BasePriority : Normal
FileVersion : 1.9.1.826
ProductVersion : 1.9.1.826
ProductName : Symantec Core Component
CompanyName : Symantec Corporation
FileDescription : Symantec Core Component
InternalName : symlcsvc
LegalCopyright : Copyright © 2003
OriginalFilename : symlcsvc.exe

#:27 [mspmspsv.exe]
FilePath : C:\XP\System32\
ProcessID : 1936
ThreadCreationTime : 4/2/2007 5:07:28 PM
BasePriority : Normal
FileVersion : 7.00.00.1954
ProductVersion : 7.00.00.1954
ProductName : Microsoft ® DRM
CompanyName : Microsoft Corporation
FileDescription : WMDM PMSP Service
InternalName : MSPMSPSV.EXE
LegalCopyright : Copyright © Microsoft Corp. 1981-2000
OriginalFilename : MSPMSPSV.EXE

#:28 [hpwuschd2.exe]
FilePath : C:\Program Files\HP\HP Software Update\
ProcessID : 2472
ThreadCreationTime : 4/2/2007 5:07:43 PM
BasePriority : Normal
FileVersion : 50.0.146.000
ProductVersion : 050.000.146.000
ProductName : hp digital imaging - hp all-in-one series
CompanyName : Hewlett-Packard Co.
FileDescription : Hewlett-Packard Product Assistant
InternalName : hpwuSchd2
LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004
OriginalFilename : hpwuSchd2.exe
Comments : Hewlett-Packard Product Assistant

#:29 [googledesktop.exe]
FilePath : C:\Program Files\Google\Google Desktop Search\
ProcessID : 2508
ThreadCreationTime : 4/2/2007 5:07:44 PM
BasePriority : Normal
FileVersion : 5.1.703.13372
ProductVersion : 5.1.703.13372
ProductName : Google Desktop
CompanyName : Google
FileDescription : Google Desktop
InternalName : Google Desktop
LegalCopyright : Copyright © 2003-07 Google. All Rights Reserved.

#:30 [jusched.exe]
FilePath : C:\Program Files\Java\jre1.5.0_11\bin\
ProcessID : 2516
ThreadCreationTime : 4/2/2007 5:07:44 PM
BasePriority : Normal

#:31 [point32.exe]
FilePath : C:\Program Files\Microsoft Hardware\Mouse\
ProcessID : 2524
ThreadCreationTime : 4/2/2007 5:07:44 PM
BasePriority : Normal

#:32 [ccapp.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 2532
ThreadCreationTime : 4/2/2007 5:07:44 PM
BasePriority : Normal
FileVersion : 104.0.7.3
ProductVersion : 104.0.7.3
ProductName : Client and Host Security Platform
CompanyName : Symantec Corporation
FileDescription : Symantec User Session
InternalName : ccApp
LegalCopyright : Copyright © 2000-2005 Symantec Corporation. All rights reserved.
OriginalFilename : ccApp.exe

#:33 [qttask.exe]
FilePath : C:\Program Files\QuickTime\
ProcessID : 2576
ThreadCreationTime : 4/2/2007 5:07:45 PM
BasePriority : Normal
FileVersion : 7.1.5
ProductVersion : QuickTime 7.1.5
ProductName : QuickTime
CompanyName : Apple Computer, Inc.
FileDescription : QuickTime Task
InternalName : QuickTime Task
LegalCopyright : Copyright Apple Computer, Inc. 1989-2007
OriginalFilename : QTTask.exe

#:34 [ituneshelper.exe]
FilePath : C:\Program Files\iTunes\
ProcessID : 2708
ThreadCreationTime : 4/2/2007 5:07:55 PM
BasePriority : Normal
FileVersion : 7.1.1.5
ProductVersion : 7.1.1.5
ProductName : iTunes
CompanyName : Apple Inc.
FileDescription : iTunesHelper Module
InternalName : iTunesHelper
LegalCopyright : Â© 2003-2007 Apple Inc. All Rights Reserved.
OriginalFilename : iTunesHelper.exe

#:35 [wcescomm.exe]
FilePath : C:\Program Files\Microsoft ActiveSync\
ProcessID : 2792
ThreadCreationTime : 4/2/2007 5:07:57 PM
BasePriority : Normal
FileVersion : 3.8.0.5004
ProductVersion : 3.8.5004
ProductName : Microsoft ActiveSync
CompanyName : Microsoft Corporation
FileDescription : ActiveSync Connection Manager
InternalName : wcescomm
LegalCopyright : Copyright Â© 1995-2004 Microsoft Corp. All rights reserved.
LegalTrademarks : MicrosoftÂ® and WindowsÂ® are registered trademarks of Microsoft Corporation.
OriginalFilename : WCESCOMM.EXE

#:36 [cka.exe]
FilePath : C:\Program Files\Norton SystemWorks\CKA\
ProcessID : 2820
ThreadCreationTime : 4/2/2007 5:07:59 PM
BasePriority : Normal
FileVersion : 9.00.2
ProductVersion : 9.00.2
ProductName : Norton SystemWorks
CompanyName : Symantec Corporation
FileDescription : Connection Keep Alive
InternalName : CKA
LegalCopyright : Â© 1997-2005 Symantec Corporation
OriginalFilename : CKA.exe

#:37 [ctfmon.exe]
FilePath : C:\XP\system32\
ProcessID : 2856
ThreadCreationTime : 4/2/2007 5:08:03 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:38 [alg.exe]
FilePath : C:\XP\System32\
ProcessID : 3088
ThreadCreationTime : 4/2/2007 5:08:07 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe

#:39 [gbtray.exe]
FilePath : C:\Program Files\Norton SystemWorks\Norton GoBack\
ProcessID : 3364
ThreadCreationTime : 4/2/2007 5:08:21 PM
BasePriority : Normal

#:40 [acrotray.exe]
FilePath : C:\Program Files\Adobe\Acrobat 6.0\Distillr\
ProcessID : 3492
ThreadCreationTime : 4/2/2007 5:08:26 PM
BasePriority : Normal
FileVersion : 6.0.1.2003102300
ProductVersion : 6.0.1.2003102300
ProductName : AcroTray - Adobe Acrobat Distiller helper application.
CompanyName : Adobe Systems Inc.
FileDescription : AcroTray
InternalName : AcroTray
LegalCopyright : Copyright 1984-2003 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename : AcroTray.exe

#:41 [googledesktop.exe]
FilePath : C:\Program Files\Google\Google Desktop Search\
ProcessID : 3576
ThreadCreationTime : 4/2/2007 5:08:26 PM
BasePriority : Normal
FileVersion : 5.1.703.13372
ProductVersion : 5.1.703.13372
ProductName : Google Desktop
CompanyName : Google
FileDescription : Google Desktop
InternalName : Google Desktop
LegalCopyright : Copyright © 2003-07 Google. All Rights Reserved.

#:42 [ipodservice.exe]
FilePath : C:\Program Files\iPod\bin\
ProcessID : 3692
ThreadCreationTime : 4/2/2007 5:08:34 PM
BasePriority : Normal
FileVersion : 7.1.1.5
ProductVersion : 7.1.1.5
ProductName : iTunes
CompanyName : Apple Inc.
FileDescription : iPodService Module
InternalName : iPodService
LegalCopyright : Â© 2003-2007 Apple Inc. All Rights Reserved.
OriginalFilename : iPodService.exe

#:43 [svchost.exe]
FilePath : C:\XP\System32\
ProcessID : 3936
ThreadCreationTime : 4/2/2007 5:08:41 PM
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:44 [nscsrvce.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\Security Console\
ProcessID : 1724
ThreadCreationTime : 4/2/2007 5:09:46 PM
BasePriority : Normal
FileVersion : 2006.1.8.2
ProductVersion : 2006.1.8
ProductName : Norton Security Console
CompanyName : Symantec Corporation
FileDescription : Norton Security Console Norton Protection Center Service
InternalName : NSCService
LegalCopyright : Norton Security Console 2006 for Windows 2000/XP Copyright Â© 2005 Symantec Corporation. All rights reserved.
OriginalFilename : NSCSrvce.exe

#:45 [lastfm.exe]
FilePath : C:\Program Files\Last.fm\
ProcessID : 3532
ThreadCreationTime : 4/2/2007 6:55:12 PM
BasePriority : Normal

#:46 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 3780
ThreadCreationTime : 4/3/2007 2:44:12 AM
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright Â© Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

#:47 [wisptis.exe]
FilePath : C:\XP\System32\
ProcessID : 3772
ThreadCreationTime : 4/3/2007 2:52:16 AM
BasePriority : High
FileVersion : 1.0.2201.0 (xpsp1.020820-1800)
ProductVersion : 1.0.2201.0
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Microsoft Tablet PC Platform Component
InternalName : WISPTIS.EXE
LegalCopyright : Copyright Â© 1998-2002 Microsoft Corporation.
OriginalFilename : WISPTIS.EXE

#:48 [explorer.exe]
FilePath : C:\XP\
ProcessID : 3680
ThreadCreationTime : 4/3/2007 4:55:04 AM
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : MicrosoftÂ® WindowsÂ® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Â© Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE

#:49 [outlook.exe]
FilePath : C:\Program Files\Microsoft Office\OFFICE11\
ProcessID : 1276
ThreadCreationTime : 4/3/2007 3:15:39 PM
BasePriority : Normal

Memory scan result:
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
New critical objects: 0
Objects found so far: 12

Started registry scan
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Registry Scan result:
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
New critical objects: 0
Objects found so far: 12

Started deep registry scan
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Deep registry scan result:
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
New critical objects: 0
Objects found so far: 12

Started Tracking Cookie scan
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Tracking cookie scan result:
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
New critical objects: 0
Objects found so far: 12

Deep scanning and examining files (C:)
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Disk Scan Result for C:\
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
New critical objects: 0
Objects found so far: 12

Deep scanning and examining files (G:)
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Disk Scan Result for G:\
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
New critical objects: 0
Objects found so far: 12

Scanning Hosts file......
Hosts file location:"C:\XP\system32\drivers\etc\hosts".
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Hosts file scan result:
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
1 entries scanned.
New critical objects:0
Objects found so far: 12

Performing conditional scans...
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Conditional scan result:
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
New critical objects: 0
Objects found so far: 12

9:05:39 AM Scan Complete

Summary Of This Scan
Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
Total scanning time:00:48:50.625
Objects scanned:191650
Objects identified:0
Objects ignored:0
New critical objects:0

-----------

Logfile of HijackThis v1.99.1
Scan saved at 9:31:44 AM, on 4/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\XP\System32\smss.exe
C:\XP\system32\csrss.exe
C:\XP\system32\winlogon.exe
C:\XP\system32\services.exe
C:\XP\system32\lsass.exe
C:\XP\system32\svchost.exe
C:\XP\system32\svchost.exe
C:\XP\System32\svchost.exe
C:\XP\system32\svchost.exe
C:\XP\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\XP\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\XP\System32\drivers\CDAC11BA.EXE
C:\XP\System32\CTsvcCDA.EXE
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~3\NORTON~1\NPROTECT.EXE
C:\XP\System32\HPZipm12.exe
C:\PROGRA~1\NORTON~3\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\XP\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\XP\System32\MsPMSPSv.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Norton SystemWorks\CKA\CKA.exe
C:\XP\system32\ctfmon.exe
C:\XP\System32\alg.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\XP\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\XP\System32\WISPTIS.EXE
C:\XP\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\XP\system32\notepad.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://webproxy.ucsd.edu/proxy.pl:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YCentral] c:\progra~1\yahoo!\YCentral\YahooCentral.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\XP\system32\dmpybgqq.dll",setvm
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [symKeepAlive] C:\Program Files\Norton SystemWorks\CKA\CKA.exe
O4 - HKCU\..\Run: [Nero PhotoShow Media Manager] C:\PROGRA~1\Nero\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\XP\system32\ctfmon.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [iNTERNATIONAL] International*
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200112...meInstaller.exe
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\XP\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\XP\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\XP\System32\CTsvcCDA.EXE
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - LxrSII1s.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~1\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\XP\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
0
Customer

June 09, 2021 11:17
submit
C:\XP\system32\dmpybgqq.dll
to
http://www.virustotal.com/en/indexx.html
and post the results here.

Then, download http://swandog46.geekstogo.com/avenger.exe to your desktop run avenger.exe from your desktop

copy the bold text below:

FILES TO DELETE:
C:\XP\system32\dmpybgqq.dll

then choose "input script manually"

next click on the Magnifying Glass

then paste the bold text you copied in there (ctrl+v) and click done

then click the traffic light button and allow it to reboot your computer.

post the log from C:\avenger.txt, and a comboscan log.
0

Please sign in to leave a comment.

Comments

Didn't find what you were looking for?