Hi there, I was wondering if anyone would be able to help me. On the desktop on my computer it says 'virus alert' in the taskbar and I can not see My Computer or documents when I click on the start menu. It also will not allow me to use the task manager.
I have read and followed the advice in the post 'read me before posting a request for assistance'. This seemed to be successful on my account but when other family members log onto there accounts the same problems were there, the 'virus alert' in the taskbar etc.
I presume this means there is still some sort of virus on the system but I'm not really sure what to do next.
These are the logs:
Malwarebytes' Anti-Malware log
Malwarebytes' Anti-Malware 1.24
Database version: 1054
Windows 5.1.2600 Service Pack 2
16:54:29 15/08/2008
mbam-log-8-15-2008 (16-54-29).txt
Scan type: Full Scan (C:\|)
Objects scanned: 92343
Time elapsed: 1 hour(s), 3 minute(s), 21 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 14
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\starware358 (Adware.Starware) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Worm.IRCBot) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (h:mm:ss tt) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
EST Online Scanner Log
# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3359 (20080815)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=fb886947dda26f42b777280025888c13
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-08-15 04:58:59
# local_time=2008-08-15 05:59:00 (+0000, GMT Standard Time)
# country="United Kingdom"
# osver=5.1.2600 NT Service Pack 2
# scanned=237426
# found=1
# scan_time=2829
C:\Documents and Settings\Ian\Application Data\Intra bike\MAGS BLEH BOOK.exe Win32/Obfuscated.A1 trojan B9DF08BFE159263B32473A1074323E56
Deckard's System Scanner - Main.txt
Deckard's System Scanner v20071014.68
Run by Amy on 2008-08-15 18:01:28
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Percentage of Memory in Use: 79% (more than 75%).
Total Physical Memory: 256 MiB (512 MiB recommended).
-- HijackThis (run as Amy.exe) -------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:01:54 PM, on 15/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\UMStor\Res.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\NETGEAR\WPN111\wpn111.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Amy\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Amy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.karoo.co.uk
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=2057
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: bgrqfetx - {892B88A3-DC94-4A1F-A75A-9AA50061A683} - C:\WINDOWS\bgrqfetx.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Mix Phone Download Hold] C:\Documents and Settings\All Users\Application Data\BYTE CLOCK MIX PHONE\Mix build.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\WINDOWS\UMStor\Res.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.karoo.co.uk
O16 - DPF: {0330235A-114A-249D-107B-2A511FD4DA9A} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {03BB6695-75C4-19A5-5090-2A7B288EB2B9} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {065632D4-2217-22C1-80D2-5B951D7064B9} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {0C06FD44-6640-4122-733F-1C33180B4CBA} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {0C3CAD41-4B8C-2958-332B-49CD4E872FC0} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {0F7E884D-EBBB-16E2-B26B-19822712CB05} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {11B53B85-71C3-0754-2E95-6F9E266339BA} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {11D743D4-5236-07CD-242D-4A247D4E3FE9} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {1513379C-CEE3-31BA-F9C4-0B5E4785E4F9} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {1871C434-1EBE-1F56-1103-29D96A7E051E} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {1F9EDAA1-64E3-5EDA-F8AB-1D5A1EB35923} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {1FDB0EC3-7F4C-5E7E-2E8E-17E4627FF4D0} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {22F8F797-C9AB-4EDF-66C3-74507EDC5A5A} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {236623EB-67F3-34C5-4F4A-7F146B4D31C6} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {24151E9E-5361-0A9D-BBEB-08F3326DFAA7} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {248D031E-1C70-04F0-3DF2-1E41185F595B} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {2B24290B-4166-3D16-D98C-090A5D2CE231} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {2CCB696B-FAF8-53F0-ED16-5A8563350597} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {2D91BD5B-CA84-75FE-D5F8-77F130DD98B0} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {2EB0ED04-BF7F-3B23-498B-78627A303635} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {313FFF3F-2B90-0A12-B916-6B6E3A239035} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {3194B3BF-FED9-51E7-A412-26BC1593DE30} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {36D78A80-AD7A-79F9-8EE3-565B5CF04C5B} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {383FA08D-D105-1DBC-7310-6D636958496C} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {38BFF1E8-D0CC-55A2-4699-33F240600344} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {393711ED-2D74-28DD-23F1-3E2C4F98A57C} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {3E473D5F-B221-32A2-C9B6-1D9912994AD8} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {3EF242FC-59CA-3AF0-E992-716070E3D585} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {41014E5B-AD68-764D-A478-6E663E0C51A3} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {422783EF-7212-4D6D-86CF-76C43FEEDB7C} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {45E809E8-3945-5DA8-0A8E-09237121E06A} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {49992F3E-350A-196E-FCEC-6B220F3B9AF5} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {4BE97ACA-F42F-2EF8-099A-656333632386} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {4BFABD62-D7F3-175D-9C2E-00857E225948} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {56BF9A87-B69B-2ECC-8BEA-424F66D6FB93} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {56FE0F7A-7BFD-50E4-3285-73DC4AF022BE} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {5832F636-8646-6D1D-BAA1-21567B31001C} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {5A01A085-A2A5-2023-9CD2-2DDD6691D6EC} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {5A411213-D15F-392F-9604-51534DF2711D} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {5B5D6D7D-454A-0D79-EE96-6A987A21EF6C} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {5C809269-EB3F-2F2C-15BB-646A546285EF} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {5CF4253C-3B35-1340-3A88-274029FACC32} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {5D9E3078-7AEA-2635-9554-24FA5348C86F} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {6142DF2D-C360-0502-AD73-4A2638CAFD64} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {6210CDD7-27EF-620F-E52F-508B11330375} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {6465B789-0CBF-3238-0375-73B85FFDF557} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {66E9F205-39F7-4453-8949-70BF7AB3F201} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {68776939-F609-30F8-8A3C-19BF14448777} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {69E5966E-436F-0E63-E475-436447C8FB30} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {6B0BBCFB-F9CC-17FA-D13E-7470696D83A2} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {6B611C10-E764-4E60-7147-211027D064ED} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {71BEB497-AEC9-73ED-CEB5-3C2D645E57A1} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {72BB16EF-EB3A-17A9-0F36-28700C6E829C} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {73692880-EBFA-453E-51EF-61415BA28BEF} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {769D0AB0-DB06-096D-8B9E-11A20491D41A} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {7D24D96A-0E73-5E67-CF3A-19904E9C97AE} - http://85.255.113.214/1/gdnFR2218.exe
O16 - DPF: {7E25F3C7-E7B3-33C1-D61F-675204F4CA18} - http://85.255.113.214/1/gdnNL2218.exe
O16 - DPF: {7FE44033-BAD1-1EE7-8637-1EDA537D2666} - http://85.255.113.214/1/gdnFR2218.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 13158 bytes
-- Files created between 2008-07-15 and 2008-08-15 -----------------------------
2008-08-15 17:06:36 0 d-------- C:\Program Files\EsetOnlineScanner
2008-08-15 15:46:31 0 d-------- C:\Documents and Settings\Amy\Application Data\Malwarebytes
2008-08-14 13:55:56 0 d-------- C:\Program Files\Trend Micro
2008-08-14 12:15:32 0 d-------- C:\Documents and Settings\Gemma\Application Data\Malwarebytes
2008-08-14 10:21:11 0 d-------- C:\Documents and Settings\Ian\Application Data\Malwarebytes
2008-08-13 23:16:15 0 d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-08-13 23:15:59 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-13 23:15:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-13 17:43:20 0 d-------- C:\Program Files\Enigma Software Group
2008-08-13 17:29:31 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-08-13 14:17:58 0 d-------- C:\Documents and Settings\Amy\Application Data\TmpRecentIcons
2008-08-12 19:14:07 0 d-------- C:\Documents and Settings\Gemma\Application Data\TmpRecentIcons
2008-08-12 11:39:07 0 d-------- C:\Documents and Settings\Ian\Application Data\TmpRecentIcons
2008-07-29 17:52:37 0 d-------- C:\Program Files\iTunes
2008-07-29 17:50:05 0 d-------- C:\Program Files\Bonjour
2008-07-29 17:47:04 0 d-------- C:\Program Files\Apple Software Update
2008-07-29 17:45:47 0 d-------- C:\Program Files\Common Files\Apple
2008-07-29 17:45:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
-- Find3M Report ---------------------------------------------------------------
2008-08-13 16:26:41 0 d-------- C:\Documents and Settings\Amy\Application Data\AVG7
2008-07-29 17:52:51 0 d-------- C:\Program Files\iPod
2008-07-29 17:49:42 0 d-------- C:\Program Files\QuickTime
2008-07-29 17:45:47 0 d-------- C:\Program Files\Common Files
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [12/03/2008 12:07 PM]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [16/03/2006 11:34 AM]
"Cmaudio"="cmicnfg.cpl" []
"SNPSTD2"="C:\WINDOWS\vsnpstd2.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [12/07/2007 05:00 AM]
"Mix Phone Download Hold"="C:\Documents and Settings\All Users\Application Data\BYTE CLOCK MIX PHONE\Mix build.exe" []
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [24/11/2006 01:06 AM]
"USB Storage Toolbox"="C:\WINDOWS\UMStor\Res.EXE" [14/09/2005 09:44 PM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [29/05/2008 07:21 PM]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [10/07/2008 09:47 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [27/05/2008 10:50 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/07/2008 10:51 AM]
"SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [19/06/2008 04:48 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [19/01/2007 12:54 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 01:00 PM]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [06/04/2003 01:17:18]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [06/04/2003 01:06:58]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 01:01:04]
NETGEAR WPN111 Smart Wizard.lnk - C:\Program Files\NETGEAR\WPN111\wpn111.exe [09/12/2006 01:01:32]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"DisableTaskMgr"=0 (0x0)
"NoDispCPL"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuMorePrograms"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"NoToolbarCustomize"=0 (0x0)
"NoSetFolders"=0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdssserv.sys]
@="driver"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e608aa0-68f1-11dc-b188-000b6a56cf9f}]
AutoRun\command- E:\setupSNK.exe
-- End of Deckard's System Scanner: finished at 2008-08-15 18:02:41 ------------
Uninstall List
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Flash Player ActiveX
Apple Mobile Device Support
Apple Software Update
AVG Free Edition
Bonjour
C-Media 3D Audio
Disc2Phone
Disc2Phone
Driving Test Success 2005/6
ESET Online Scanner
Google Toolbar for Internet Explorer
Hazard Perception 2005/6
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB926239)
HP Memories Disc
HP Photo and Imaging 2.0 - All-in-One
HP Photo and Imaging 2.0 - All-in-One Drivers
HP Photo and Imaging 2.0 - hp psc 1200 series
hp psc 1200 series
iPod for Windows 2005-09-23
iTunes
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 2
Malwarebytes' Anti-Malware
Messenger Plus! Live & Sponsor (CiD)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
MSN
MSN Toolbar
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
NETGEAR RangeMax(TM) Wireless USB 2.0 Adapter WPN111
QuickTime
RealPlayer
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Shockwave
SiS 900 PCI Fast Ethernet Adapter Driver
SmartCamera Ver 2.1
Sony Ericsson PC Suite
SpyHunter
The Sims 2
The Sims 2 University
Theme Hospital
Theme Park Inc
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
URGE
USB Disk Win98 Driver
USB PC Camera (SN9C103)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
ZoneAlarm
I can't seem to find the Deckard's System Scanner extra.txt log. I have looked in C:\Deckard\System Scanner folder but there is only the main.txt log for that scan.
I would be really grateful if anyone would be able to help out.
Amy
