Tweaks.com Forum / Windows & System Security / HiJack This Logs / I have threats on my computer, help! / Latest Posts

RE: I have threats on my computer, help!

RichieUK — Thu, 27 Mar 2008 13:47:43 GMT

[quote]when do you sleep?[/quote]
When ever i can,and you're welcome:)

RE: I have threats on my computer, help!

lily71 — Thu, 27 Mar 2008 12:38:17 GMT

RichieUK, you were right! My threats have been nutralized. Thank you so much. I really appreciate your help. You help all these people that post their computer problems, that I wonder, when do you sleep?

RE: I have threats on my computer, help!

RichieUK — Wed, 26 Mar 2008 18:02:57 GMT

The problems are inside the System Volume Information folder which is used by System Restore to store restore points.
Just do the following to clear them and remove the threats:

[b]Clear your 'System Restore' points by doing the following: [/b]
Right-click on 'My Computer' and select 'Properties'.
Select 'System Restore'.
Select 'Turn Off System Restore On All Drives'.
Select 'Apply'.
You will then get the following warning:
"You have chosen to turn off System Restore.
If you continue,all existing restore points will be deleted,and you will not be able to track or undo changes to your computer.
Do you want to turn off System Restore?".
Then select 'Yes',your 'System Restore' directories will be purged.

[b]Restart your pc.

Turn 'System Restore' back on:[/b]
Right click on 'My Computer' and select 'Properties'.
Select 'System Restore'.
[b]Unselect[/b] 'Turn Off System Restore On All Drives'.
Select 'Apply',then click 'Ok'.

Other than that you're good to go:)

RE: I have threats on my computer, help!

lily71 — Wed, 26 Mar 2008 10:29:40 GMT

Here are the results of the scan:

Wednesday, March 26, 2008 10:11:51 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 25/03/2008 Kaspersky Anti-Virus database records: 595651

Scan Settings
Scan using the following antivirus database	standard
Scan Archives	true
Scan Mail Bases	true

Scan Target	My Computer
A:\ C:\ D:\ E:\ F:\ G:\

Scan Statistics
Total number of scanned objects	106974
Number of viruses found	1
Number of infected objects	4
Number of suspicious objects	0
Duration of the scan process	03:07:22

Infected Object Name	Virus Name	Last Action
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00a6_AdBlocker_eventcritlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00a6_AdBlocker_eventlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00a7_popupchk_eventcritlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00a7_popupchk_eventlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00aa_File_Monitoring_eventcritlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00aa_File_Monitoring_eventlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00b0_Web_Monitoring_eventlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00b1_PrivacyControl_eventcritlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\00b1_PrivacyControl_eventlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.idx	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\eventlog.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\report.rpt	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-03-25_Log.ALUSchedulerSvc.LiveUpdate	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri469\liveupdt.tri	Object is locked	skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Log.LiveUpdate	Object is locked	skipped

C:\Documents and Settings\LocalService\Cookies\index.dat	Object is locked	skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat	Object is locked	skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\LocalService\NTUSER.DAT	Object is locked	skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG	Object is locked	skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat	Object is locked	skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped

C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG	Object is locked	skipped

C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log	Object is locked	skipped

C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log	Object is locked	skipped

C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log	Object is locked	skipped

C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log	Object is locked	skipped

C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-3-25-2008( 13-26-50 ).LOG	Object is locked	skipped

C:\Documents and Settings\Owner\Cookies\index.dat	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Temp\~DF7A98.tmp	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Temp\~DF7B17.tmp	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Temp\~DFB31D.tmp	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Temp\~DFB335.tmp	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat	Object is locked	skipped

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped

C:\Documents and Settings\Owner\NTUSER.DAT	Object is locked	skipped

C:\Documents and Settings\Owner\ntuser.dat.LOG	Object is locked	skipped

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll	Object is locked	skipped

C:\System Volume Information\MountPointManagerRemoteDatabase	Object is locked	skipped

C:\System Volume Information\_restore{F03BC7CA-958E-4E73-B64E-7D9F75261CF2}\RP11\change.log	Object is locked	skipped

C:\System Volume Information\_restore{F03BC7CA-958E-4E73-B64E-7D9F75261CF2}\RP7\A0000202.exe	Infected: P2P-Worm.Win32.VB.dw	skipped

C:\System Volume Information\_restore{F03BC7CA-958E-4E73-B64E-7D9F75261CF2}\RP7\A0000203.exe	Infected: P2P-Worm.Win32.VB.dw	skipped

C:\System Volume Information\_restore{F03BC7CA-958E-4E73-B64E-7D9F75261CF2}\RP7\A0000204.exe	Infected: P2P-Worm.Win32.VB.dw	skipped

C:\System Volume Information\_restore{F03BC7CA-958E-4E73-B64E-7D9F75261CF2}\RP7\A0000205.exe	Infected: P2P-Worm.Win32.VB.dw	skipped

C:\WINDOWS\Debug\PASSWD.LOG	Object is locked	skipped

C:\WINDOWS\SchedLgU.Txt	Object is locked	skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	Object is locked	skipped

C:\WINDOWS\Sti_Trace.log	Object is locked	skipped

C:\WINDOWS\system32\CatRoot2\edb.log	Object is locked	skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb	Object is locked	skipped

C:\WINDOWS\system32\config\AppEvent.Evt	Object is locked	skipped

C:\WINDOWS\system32\config\default	Object is locked	skipped

C:\WINDOWS\system32\config\default.LOG	Object is locked	skipped

C:\WINDOWS\system32\config\Internet.evt	Object is locked	skipped

C:\WINDOWS\system32\config\ODiag.evt	Object is locked	skipped

C:\WINDOWS\system32\config\OSession.evt	Object is locked	skipped

C:\WINDOWS\system32\config\SAM	Object is locked	skipped

C:\WINDOWS\system32\config\SAM.LOG	Object is locked	skipped

C:\WINDOWS\system32\config\SecEvent.Evt	Object is locked	skipped

C:\WINDOWS\system32\config\SECURITY	Object is locked	skipped

C:\WINDOWS\system32\config\SECURITY.LOG	Object is locked	skipped

C:\WINDOWS\system32\config\software	Object is locked	skipped

C:\WINDOWS\system32\config\software.LOG	Object is locked	skipped

C:\WINDOWS\system32\config\SysEvent.Evt	Object is locked	skipped

C:\WINDOWS\system32\config\system	Object is locked	skipped

C:\WINDOWS\system32\config\system.LOG	Object is locked	skipped

C:\WINDOWS\system32\drivers\fidbox.dat	Object is locked	skipped

C:\WINDOWS\system32\drivers\fidbox.idx	Object is locked	skipped

C:\WINDOWS\system32\drivers\fidbox2.dat	Object is locked	skipped

C:\WINDOWS\system32\drivers\fidbox2.idx	Object is locked	skipped

C:\WINDOWS\system32\h323log.txt	Object is locked	skipped

C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log	Object is locked	skipped

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl	Object is locked	skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	Object is locked	skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	Object is locked	skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	Object is locked	skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	Object is locked	skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	Object is locked	skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	Object is locked	skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	Object is locked	skipped

C:\WINDOWS\wiadebug.log	Object is locked	skipped

C:\WINDOWS\wiaservc.log	Object is locked	skipped

C:\WINDOWS\WindowsUpdate.log	Object is locked	skipped

Scan process completed.

RE: I have threats on my computer, help!

RichieUK — Tue, 25 Mar 2008 15:44:52 GMT

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:
[b]O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)[/b]

Run this online virus/spyware scan using [b]Internet Explorer[/b]:
[b][url=http://www.kaspersky.com/virusscanner][color="blue"]Kaspersky WebScanner[/color][/url][/b]
Next click [b]Kaspersky Online Scanner[/b]
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan:
• Select My Computer
• This will start the program and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.It does not provide an option to clean/disinfect,[b]i need to see the scan results[/b].
• Now click on the Save as Text button.
• Save the file to your desktop.
• [b]Copy and paste the contents of that file into your next reply[/b].

If the above link doesn't work,try this:
[url]http://www.kaspersky.com/kos/english/kavwebscan.html[/url]

Also post a new Hijackthis log please.

RE: I have threats on my computer, help!

lily71 — Tue, 25 Mar 2008 15:34:54 GMT

Here is the HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:31:35 PM, on 3/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\S3tray2.exe
C:\PROGRA~1\Hardware\Keyboard\Ikeymain.exe
C:\PROGRA~1\Hardware\Mouse\Amoumain.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm?rev=10318
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl03a\BrStDvPt.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\Hardware\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\Hardware\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - http://supportcenter.rr.com/sdccommon/download/tgctlins.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} - http://supportcenter.rr.com/sdccommon/download/tgctlsi.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128703841187
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} - https://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ma_mail_1.gif

--
End of file - 10068 bytes

RE: I have threats on my computer, help!

RichieUK — Mon, 24 Mar 2008 16:32:31 GMT

Welcome:)
Download [b][url=http://download.bleepingcomputer.com/hijackthis/HJTInstall.exe][color="red"]Trend Micro HijackThis 2.0.2[/color][/url][/b] to your desktop:
Double click on HJTInstall.exe,it will prompt you to extract hijackthis.exe to C:\Program Files\Trend Micro\HijackThis.
When the install is complete,HijackThis will automatically launch.
When the license agreement appears,select "I Accept" and then click on the "Do a system scan only" button.
When the scan is complete,click on the "Save Log" button,then save it to your desktop.
[b]Copy and paste the entire contents of that log into your next reply.[/b]

I have threats on my computer, help!

lily71 — Mon, 24 Mar 2008 16:27:25 GMT

Hi, I'm back. I bought the full version of Kaspersky and ran a scan and it detects 9 treats to my computer. What can I do? I know you helped me before, but I really need your hepl again. Thanks!