PCTech Forums

A friendly computer support place
https://www.pctechforums.com/

Hello Gecko

https://www.pctechforums.com/viewtopic.php?f=22&t=7145

Page 1 of 1

Hello Gecko

PostPosted: Wed May 30, 2007 10:42 pm
by D_N_M
Hello again Gecko I have a log from My wife's PC from work. she says she has to keep rebooting it to make it work. Any help is always appreciated.... Thanks in advance Gecko



StartupList report, 05/30/07, 5:36:15 PM
StartupList version: 1.52.2
Started from : C:\hjt\hijackthis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16441)
* Using default options
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PTI\Link.exe
C:\F2000\FServer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\hjt\hijackthis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\office2\Start Menu\Programs\Startup]
DLHelperEXE.exe
UHaulMessenger.lnk = C:\Program Files\UHaul\UHaulMessenger\AppStart.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
Digital Line Detect.lnk = ?
Easy Link.lnk = C:\PTI\Link.exe
Falcon 2000 Server.lnk = C:\F2000\FServer.exe
Shortcut to BELLEVUEPROPERITIES.NO-IP.COM.lnk = ?

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

IgfxTray = C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\system32\hkcmd.exe
InCD = C:\Program Files\Ahead\InCD\InCD.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
Google Desktop Search = "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
LogMeIn GUI = "C:\Program Files\LogMeIn\LogMeInSystray.exe"
SpySpotter = C:\Program Files\SpySpotter3\SpySpotter.exe -startup
SpySpotter System Defender = C:\Program Files\SpySpotter3\Defender.exe -startup

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
swg = C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\f3PSSavr.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Starware358\bin\Starware358.dll (file missing) - {45A4902E-4479-4EAE-A186-8D0F7E4C78DE}
(no name) - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL (file missing) - {8CA5ED52-F3FB-4414-A105-2E3491156990}
(no name) - c:\program files\google\googletoolbar3.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[csCAM.csAccountManager]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csConsolidatedAccountManager.ocx
CODEBASE = https://host01slc.centershift.com/store ... anager.CAB

[STANPin.clsPins]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\STANPin.dll
CODEBASE = https://host01slc.centershift.com/store31/x/STANPin.CAB

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\macromed\Shockwave 10\Download.dll
CODEBASE = http://download.macromedia.com/pub/shoc ... tor/sw.cab

[ewidoOnlineScan Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\EWIDOO~1.DLL
CODEBASE = http://download.ewido.net/ewidoOnlineScan.cab

[{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}]
CODEBASE = http://ak.exe.imgfarm.com/images/nocach ... 0.0.15.cab

[Shockwave ActiveX Control]
CODEBASE = http://download.macromedia.com/pub/shoc ... tor/sw.cab

[CPlayFirstTriJinxControl Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\TriJinx.1.0.0.67.dll
CODEBASE = http://zone.msn.com/bingame/trix/defaul ... 0.0.67.cab

[Centershift_ClientManager.CS_CCManager]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Centershift_ClientManager31.ocx
CODEBASE = https://www.centershift.com/csweb/compo ... ager31.CAB

[MessagePolling.ctlMsgPolling]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgPolling.ocx
CODEBASE = https://www.centershift.com/csweb/compo ... olling.CAB

[csPrint.Receipt]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csPrint31.dll
CODEBASE = https://host01slc.centershift.com/store ... rint31.CAB

[CSPayment.clsPayment]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CSPayment.dll
CODEBASE = https://host01slc.centershift.com/store ... ayment.CAB

[csDelProcAdmin01_Control.csDelProcAdmin]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csDelProcAdmin01.ocx
CODEBASE = https://host01slc.centershift.com/store ... dmin01.CAB

[csAuctionAdmin.ctlAuctionAdmin]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csAuctionAdmin.ocx
CODEBASE = https://www.centershift.com/csweb/compo ... nAdmin.CAB

[Project1.QuickFIx]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Project1.ocx
CODEBASE = https://www.centershift.com/csweb/compo ... oject1.CAB

[Microsoft RDP Client Control (redist)]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msrdp.ocx
CODEBASE = https://bellevueproperties.no-ip.com/Remote/msrdp.cab

[MJLauncherCtrl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\mjolauncher.dll
CODEBASE = http://zone.msn.com/bingame/chnz/defaul ... uncher.cab

[csPopUpCalendar.csCal]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csCal.ocx
CODEBASE = https://www.centershift.com/csweb/components/csCal.CAB

[CamImage Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\AxisCamControl.ocx
CODEBASE = http://68.45.238.185/activex/AxisCamControl.cab

[cpbrkpie Control]
InProcServer32 = C:\WINDOWS\cpbrkpie.ocx
CODEBASE = http://a19.g.akamai.net/7/19/7125/4058/ ... oupons.cab

[CheckPIN.clsCheckPIN]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CheckPIN.dll
CODEBASE = https://www.centershift.com/csweb/compo ... eckPIN.CAB

[ZoneAxRcMgr Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ZAxRcMgr.ocx
CODEBASE = http://cdn2.zone.msn.com/binframework/v ... b31267.cab

[CSFSO.FileSystemObject]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CSFSO.dll
CODEBASE = https://host01slc.centershift.com/store31/x/CSFSO.CAB

[Gate31.Controller]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Gate31.dll
CODEBASE = https://host01slc.centershift.com/store31/x/Gate31.CAB

[csYM4.csYield]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csYM4.ocx
CODEBASE = https://www.centershift.com/csweb/components/csYM4.CAB

[MSN Games - Installer]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ZIntro.ocx
CODEBASE = http://cdn2.zone.msn.com/binFramework/v ... b56649.cab

[ComponentOne FlexGrid 7.1 (Light)]
InProcServer32 = C:\WINDOWS\system32\vsflex7L.ocx
CODEBASE = https://www.centershift.com/csweb/compo ... flex7L.ocx

[Microsoft Masked Edit Control, version 6.0]
InProcServer32 = C:\WINDOWS\system32\MSMASK32.OCX
CODEBASE = https://www.centershift.com/csweb/compo ... mask32.cab

[STANChangeAddress.clsChangeAddress]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\STANChangeAddress.dll
CODEBASE = https://host01slc.centershift.com/store ... ddress.CAB

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx
CODEBASE = http://download.macromedia.com/pub/shoc ... wflash.cab

[Virtools WebPlayer Class]
InProcServer32 = C:\Program Files\Virtools\3D Life Player\WebPlayer.ocx
CODEBASE = http://a532.g.akamai.net/f/532/6712/5m/ ... taller.exe

[TikGames Online Control]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\gpcontrol.dll
CODEBASE = http://zone.msn.com/bingame/pacz/defaul ... online.cab

[CPlayFirstDinerDashControl Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.72.dll
CODEBASE = http://aolsvc.aol.com/onlinegames/diner ... 0.0.72.cab

[PopCapLoader Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\popcaploader.dll
CODEBASE = http://zone.msn.com/bingame/popcaploader_v10.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE = https://centershift.webex.com/client/T2 ... eatgpc.cab

[csStoSA.csStoSAContainer]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csStoSA.ocx
CODEBASE = https://www.centershift.com/csweb/compo ... sStoSA.CAB

[CentershiftMap.csMap]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csMap30.ocx
CODEBASE = https://host01slc.centershift.com/store31/x/csMap30.CAB

[STANsearchControl.STANuserControl]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\csSearch.ocx
CODEBASE = https://www.centershift.com/csweb/compo ... Search.CAB

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
AVG Anti-Spyware Guard: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (autostart)
pcAnywhere Host Service: C:\Program Files\Symantec\pcAnywhere\awhost32.exe (autostart)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
CdaD10BA: \??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
Fax: %systemroot%\system32\fxssvc.exe (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
LogMeIn Kernel Information Provider: \??\C:\Program Files\LogMeIn\RaInfo.sys (autostart)
LogMeIn Maintenance Service: "C:\Program Files\LogMeIn\RaMaint.exe" (autostart)
LogMeIn: "C:\Program Files\LogMeIn\LogMeIn.exe" (autostart)
Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)
mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)
MSSQL$MICROSOFTBCM: C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe -sMICROSOFTBCM (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (autostart)
Windows Time: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)


--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 19,159 bytes
Report generated in 0.094 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only



Logfile of HijackThis v1.99.1
Scan saved at 5:33:05 PM, on 05/30/07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PTI\Link.exe
C:\F2000\FServer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\hjt\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {45A4902E-4479-4EAE-A186-8D0F7E4C78DE} - C:\Program Files\Starware358\bin\Starware358.dll (file missing)
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Starware358 - {9FB3908C-6565-4CB0-95F8-E9F85258723C} - C:\Program Files\Starware358\bin\Starware358.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [SpySpotter] C:\Program Files\SpySpotter3\SpySpotter.exe -startup
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: DLHelperEXE.exe
O4 - Startup: UHaulMessenger.lnk = C:\Program Files\UHaul\UHaulMessenger\AppStart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Easy Link.lnk = C:\PTI\Link.exe
O4 - Global Startup: Falcon 2000 Server.lnk = C:\F2000\FServer.exe
O4 - Global Startup: Shortcut to BELLEVUEPROPERITIES.NO-IP.COM.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm479YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: www.centershift.com
O15 - Trusted Zone: *.centershift.com
O15 - Trusted Zone: http://*.centershift.com
O16 - DPF: {11004D63-D403-4128-BE38-BA8035F01AE4} (csCAM.csAccountManager) - https://host01slc.centershift.com/store ... anager.CAB
O16 - DPF: {1178E4A2-86B4-11D5-89FA-00C04F2FABD2} (STANPin.clsPins) - https://host01slc.centershift.com/store31/x/STANPin.CAB
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... 0.0.15.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/defaul ... 0.0.67.cab
O16 - DPF: {306A3A9D-5711-468C-89E1-08B53607ADEC} (Centershift_ClientManager.CS_CCManager) - https://www.centershift.com/csweb/compo ... ager31.CAB
O16 - DPF: {35A07B73-808D-409F-B12E-8EAE82154C78} (MessagePolling.ctlMsgPolling) - https://www.centershift.com/csweb/compo ... olling.CAB
O16 - DPF: {41A7F6B3-95E6-4E01-B370-DED12CA827B7} (csPrint.Receipt) - https://host01slc.centershift.com/store ... rint31.CAB
O16 - DPF: {52EEED38-6E2F-4B1D-AE39-99FBB56CF8B1} (CSPayment.clsPayment) - https://host01slc.centershift.com/store ... ayment.CAB
O16 - DPF: {567ACF49-8D60-4348-B92D-60BF0C2FE5E0} (csDelProcAdmin01_Control.csDelProcAdmin) - https://host01slc.centershift.com/store ... dmin01.CAB
O16 - DPF: {6B42B55C-583F-480C-861D-CED3FCAD3512} (csAuctionAdmin.ctlAuctionAdmin) - https://www.centershift.com/csweb/compo ... nAdmin.CAB
O16 - DPF: {6F27485C-ACBA-420D-AD25-44DE8FABB1EB} (Project1.QuickFIx) - https://www.centershift.com/csweb/compo ... oject1.CAB
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://bellevueproperties.no-ip.com/Remote/msrdp.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/defaul ... uncher.cab
O16 - DPF: {846D1B10-EC6B-4334-9FFA-EABEC4E8F025} (csPopUpCalendar.csCal) - https://www.centershift.com/csweb/components/csCal.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://68.45.238.185/activex/AxisCamControl.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4058/ ... oupons.cab
O16 - DPF: {98B2DBC7-131A-4F05-8500-AA6C457A6B58} (CheckPIN.clsCheckPIN) - https://www.centershift.com/csweb/compo ... eckPIN.CAB
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v ... b31267.cab
O16 - DPF: {9C2FC5A6-1D2B-434D-82D8-38652C74F43A} (CSFSO.FileSystemObject) - https://host01slc.centershift.com/store31/x/CSFSO.CAB
O16 - DPF: {9E84AFC0-6C29-43FE-8AB5-3A9701CBAB01} (Gate31.Controller) - https://host01slc.centershift.com/store31/x/Gate31.CAB
O16 - DPF: {A866B6B1-D925-4D7E-BDAD-B03EC0451464} (csYM4.csYield) - https://www.centershift.com/csweb/components/csYM4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v ... b56649.cab
O16 - DPF: {C0A63B86-4B21-11D3-BD95-D426EF2C7949} (ComponentOne FlexGrid 7.1 (Light)) - https://www.centershift.com/csweb/compo ... flex7L.ocx
O16 - DPF: {C932BA85-4374-101B-A56C-00AA003668DC} (Microsoft Masked Edit Control, version 6.0) - https://www.centershift.com/csweb/compo ... mask32.cab
O16 - DPF: {C9BADB23-839E-48C7-BA37-4E1433F15E1C} (STANChangeAddress.clsChangeAddress) - https://host01slc.centershift.com/store ... ddress.CAB
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/ ... taller.exe
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/pacz/defaul ... online.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://aolsvc.aol.com/onlinegames/diner ... 0.0.72.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://centershift.webex.com/client/T2 ... eatgpc.cab
O16 - DPF: {E2DAB340-21E9-4795-8105-394CC6DF75BC} (csStoSA.csStoSAContainer) - https://www.centershift.com/csweb/compo ... sStoSA.CAB
O16 - DPF: {EF783396-97FB-400B-A6B0-2AC5A74D65DF} (CentershiftMap.csMap) - https://host01slc.centershift.com/store31/x/csMap30.CAB
O16 - DPF: {F7A34E78-9C47-4B32-A425-4FF7B0E5F77F} (STANsearchControl.STANuserControl) - https://www.centershift.com/csweb/compo ... Search.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{90BD2E5C-50D2-4796-90FB-B56DAB0F252F}: NameServer = 151.197.0.39,151.204.0.84
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe

PostPosted: Thu May 31, 2007 12:19 am
by Gecko
Hi D_N_M,

The SpySpotter program is a known rouge anti spyware programs that creates false positives and downloads spyware, you also have a trojan running.

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any other open windows when you are following the procedures below.

Please download to your desktop, do not run it yet you will need it later.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following:
(They may or may not be there)
Defender.exe

Start HijackThis and click "Do a system scan only" put a check next to each of the following entries:
O2 - BHO: (no name) - {45A4902E-4479-4EAE-A186-8D0F7E4C78DE} - C:\Program Files\Starware358\bin\Starware358.dll (file missing)
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL (file missing)
O3 - Toolbar: Starware358 - {9FB3908C-6565-4CB0-95F8-E9F85258723C} - C:\Program Files\Starware358\bin\Starware358.dll (file missing)
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - Startup: DLHelperEXE.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm479YYUS
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... enSaversFW BInitialSetup1.0.0.15.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4058/ ... te/Coupons. cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/ ... 12/player/ install/installer.exe

Now click the "Fixed checked" button and then close HijackThis


Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
SpySpotter
mywebsearch

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.

Click Start and then click Search, in the section "All or part of the file name" type in DLHelperEXE.exe and click the Search button.
When search finds the file please take note of it's exact location it would be something like:
C:\Documents and Settings\username\Local Settings\Temp\DLHelperEXE.exe

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Click Start, click My computer and then right click on your C: drive and select "Properties"
Now click the "Disk cleanup" button, in the next window put a check next to Recycle Bin, Temporary Internet Files and Temporary Files click OK and then click yes in the popup window.

Click killbox.exe, now select the option "Delete on reboot".
Now click on the "All files" button (it will turn green)
Click "Options" and select "Remove Directories"
Next click the folder icon and browse to this location:
C:\Program Files\SpySpotter3\ and select the filder click OK
Click the folder icon again and browse to the location of the DLHelperEXE.exe tou found with search.

Now click the red X icon to delete these files on reboot
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

Once your system has rebooted post a new HiJackThis log when you reply.

PostPosted: Thu May 31, 2007 1:07 am
by D_N_M
I cant get into safe mode the box just (beeps) then proceeds with normal startup.
I did the fixes prior to that but couldnt locate the DLHelperEXE.exe
heres a new log
Thanks again Gecko


Logfile of HijackThis v1.99.1
Scan saved at 8:04:02 PM, on 05/30/07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PTI\Link.exe
C:\F2000\FServer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hjt\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: UHaulMessenger.lnk = C:\Program Files\UHaul\UHaulMessenger\AppStart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Easy Link.lnk = C:\PTI\Link.exe
O4 - Global Startup: Falcon 2000 Server.lnk = C:\F2000\FServer.exe
O4 - Global Startup: Shortcut to BELLEVUEPROPERITIES.NO-IP.COM.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: www.centershift.com
O15 - Trusted Zone: *.centershift.com
O15 - Trusted Zone: http://*.centershift.com
O16 - DPF: {11004D63-D403-4128-BE38-BA8035F01AE4} (csCAM.csAccountManager) - https://host01slc.centershift.com/store ... anager.CAB
O16 - DPF: {1178E4A2-86B4-11D5-89FA-00C04F2FABD2} (STANPin.clsPins) - https://host01slc.centershift.com/store31/x/STANPin.CAB
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/defaul ... 0.0.67.cab
O16 - DPF: {306A3A9D-5711-468C-89E1-08B53607ADEC} (Centershift_ClientManager.CS_CCManager) - https://www.centershift.com/csweb/compo ... ager31.CAB
O16 - DPF: {35A07B73-808D-409F-B12E-8EAE82154C78} (MessagePolling.ctlMsgPolling) - https://www.centershift.com/csweb/compo ... olling.CAB
O16 - DPF: {41A7F6B3-95E6-4E01-B370-DED12CA827B7} (csPrint.Receipt) - https://host01slc.centershift.com/store ... rint31.CAB
O16 - DPF: {52EEED38-6E2F-4B1D-AE39-99FBB56CF8B1} (CSPayment.clsPayment) - https://host01slc.centershift.com/store ... ayment.CAB
O16 - DPF: {567ACF49-8D60-4348-B92D-60BF0C2FE5E0} (csDelProcAdmin01_Control.csDelProcAdmin) - https://host01slc.centershift.com/store ... dmin01.CAB
O16 - DPF: {6B42B55C-583F-480C-861D-CED3FCAD3512} (csAuctionAdmin.ctlAuctionAdmin) - https://www.centershift.com/csweb/compo ... nAdmin.CAB
O16 - DPF: {6F27485C-ACBA-420D-AD25-44DE8FABB1EB} (Project1.QuickFIx) - https://www.centershift.com/csweb/compo ... oject1.CAB
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://bellevueproperties.no-ip.com/Remote/msrdp.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/defaul ... uncher.cab
O16 - DPF: {846D1B10-EC6B-4334-9FFA-EABEC4E8F025} (csPopUpCalendar.csCal) - https://www.centershift.com/csweb/components/csCal.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://68.45.238.185/activex/AxisCamControl.cab
O16 - DPF: {98B2DBC7-131A-4F05-8500-AA6C457A6B58} (CheckPIN.clsCheckPIN) - https://www.centershift.com/csweb/compo ... eckPIN.CAB
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v ... b31267.cab
O16 - DPF: {9C2FC5A6-1D2B-434D-82D8-38652C74F43A} (CSFSO.FileSystemObject) - https://host01slc.centershift.com/store31/x/CSFSO.CAB
O16 - DPF: {9E84AFC0-6C29-43FE-8AB5-3A9701CBAB01} (Gate31.Controller) - https://host01slc.centershift.com/store31/x/Gate31.CAB
O16 - DPF: {A866B6B1-D925-4D7E-BDAD-B03EC0451464} (csYM4.csYield) - https://www.centershift.com/csweb/components/csYM4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v ... b56649.cab
O16 - DPF: {C0A63B86-4B21-11D3-BD95-D426EF2C7949} (ComponentOne FlexGrid 7.1 (Light)) - https://www.centershift.com/csweb/compo ... flex7L.ocx
O16 - DPF: {C932BA85-4374-101B-A56C-00AA003668DC} (Microsoft Masked Edit Control, version 6.0) - https://www.centershift.com/csweb/compo ... mask32.cab
O16 - DPF: {C9BADB23-839E-48C7-BA37-4E1433F15E1C} (STANChangeAddress.clsChangeAddress) - https://host01slc.centershift.com/store ... ddress.CAB
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/pacz/defaul ... online.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://aolsvc.aol.com/onlinegames/diner ... 0.0.72.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://centershift.webex.com/client/T2 ... eatgpc.cab
O16 - DPF: {E2DAB340-21E9-4795-8105-394CC6DF75BC} (csStoSA.csStoSAContainer) - https://www.centershift.com/csweb/compo ... sStoSA.CAB
O16 - DPF: {EF783396-97FB-400B-A6B0-2AC5A74D65DF} (CentershiftMap.csMap) - https://host01slc.centershift.com/store31/x/csMap30.CAB
O16 - DPF: {F7A34E78-9C47-4B32-A425-4FF7B0E5F77F} (STANsearchControl.STANuserControl) - https://www.centershift.com/csweb/compo ... Search.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{90BD2E5C-50D2-4796-90FB-B56DAB0F252F}: NameServer = 151.197.0.39,151.204.0.84
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe

PostPosted: Thu May 31, 2007 1:20 am
by Gecko
D_N_M,

The SpySpotter program is still there let's try a removal tool to get rid of it.

Please download
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool";
it is not a virus, but a program used to stop system processes.
Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

PostPosted: Thu May 31, 2007 2:45 am
by D_N_M
Here is the smitfraud log

SmitFraudFix v2.189

Scan done at 21:43:36.95, 05/30/07
Run from C:\Documents and Settings\office2\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PTI\Link.exe
C:\F2000\FServer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\CSCRIPT.EXE

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\office2


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\office2\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\office2\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32-xpdt



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom NetXtreme 57xx Gigabit Controller - Packet Scheduler Miniport
DNS Server Search Order: 151.197.0.39
DNS Server Search Order: 151.204.0.84

HKLM\SYSTEM\CCS\Services\Tcpip\..\{90BD2E5C-50D2-4796-90FB-B56DAB0F252F}: NameServer=151.197.0.39,151.204.0.84
HKLM\SYSTEM\CS1\Services\Tcpip\..\{90BD2E5C-50D2-4796-90FB-B56DAB0F252F}: NameServer=151.197.0.39,151.204.0.84
HKLM\SYSTEM\CS3\Services\Tcpip\..\{90BD2E5C-50D2-4796-90FB-B56DAB0F252F}: NameServer=151.197.0.39,151.204.0.84


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

PostPosted: Thu May 31, 2007 7:56 pm
by Gecko
D_N_M,

No the smitfraud did not pick it up :(
Let's see if we can get rid of it in normal mode

Click killbox.exe, now select the option "Delete on reboot".
Now click on the "All files" button (it will turn green)
Click "Options" and select "Remove Directories"
Next click the folder icon and browse to this location:
C:\Program Files\SpySpotter3\ and select the folder click OK

Now click the red X icon to delete these files on reboot
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

Once your system has rebooted post a new HiJackThis log when you reply.

PostPosted: Fri Jun 01, 2007 1:29 am
by D_N_M
Here is the new log.


Logfile of HijackThis v1.99.1
Scan saved at 8:26:26 PM, on 05/31/07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PTI\Link.exe
C:\F2000\FServer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: UHaulMessenger.lnk = C:\Program Files\UHaul\UHaulMessenger\AppStart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Easy Link.lnk = C:\PTI\Link.exe
O4 - Global Startup: Falcon 2000 Server.lnk = C:\F2000\FServer.exe
O4 - Global Startup: Shortcut to BELLEVUEPROPERITIES.NO-IP.COM.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: www.centershift.com
O15 - Trusted Zone: *.centershift.com
O15 - Trusted Zone: http://*.centershift.com
O16 - DPF: {11004D63-D403-4128-BE38-BA8035F01AE4} (csCAM.csAccountManager) - https://host01slc.centershift.com/store ... anager.CAB
O16 - DPF: {1178E4A2-86B4-11D5-89FA-00C04F2FABD2} (STANPin.clsPins) - https://host01slc.centershift.com/store31/x/STANPin.CAB
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/defaul ... 0.0.67.cab
O16 - DPF: {306A3A9D-5711-468C-89E1-08B53607ADEC} (Centershift_ClientManager.CS_CCManager) - https://www.centershift.com/csweb/compo ... ager31.CAB
O16 - DPF: {35A07B73-808D-409F-B12E-8EAE82154C78} (MessagePolling.ctlMsgPolling) - https://www.centershift.com/csweb/compo ... olling.CAB
O16 - DPF: {41A7F6B3-95E6-4E01-B370-DED12CA827B7} (csPrint.Receipt) - https://host01slc.centershift.com/store ... rint31.CAB
O16 - DPF: {52EEED38-6E2F-4B1D-AE39-99FBB56CF8B1} (CSPayment.clsPayment) - https://host01slc.centershift.com/store ... ayment.CAB
O16 - DPF: {567ACF49-8D60-4348-B92D-60BF0C2FE5E0} (csDelProcAdmin01_Control.csDelProcAdmin) - https://host01slc.centershift.com/store ... dmin01.CAB
O16 - DPF: {6B42B55C-583F-480C-861D-CED3FCAD3512} (csAuctionAdmin.ctlAuctionAdmin) - https://www.centershift.com/csweb/compo ... nAdmin.CAB
O16 - DPF: {6F27485C-ACBA-420D-AD25-44DE8FABB1EB} (Project1.QuickFIx) - https://www.centershift.com/csweb/compo ... oject1.CAB
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://bellevueproperties.no-ip.com/Remote/msrdp.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/defaul ... uncher.cab
O16 - DPF: {846D1B10-EC6B-4334-9FFA-EABEC4E8F025} (csPopUpCalendar.csCal) - https://www.centershift.com/csweb/components/csCal.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://68.45.238.185/activex/AxisCamControl.cab
O16 - DPF: {98B2DBC7-131A-4F05-8500-AA6C457A6B58} (CheckPIN.clsCheckPIN) - https://www.centershift.com/csweb/compo ... eckPIN.CAB
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v ... b31267.cab
O16 - DPF: {9C2FC5A6-1D2B-434D-82D8-38652C74F43A} (CSFSO.FileSystemObject) - https://host01slc.centershift.com/store31/x/CSFSO.CAB
O16 - DPF: {9E84AFC0-6C29-43FE-8AB5-3A9701CBAB01} (Gate31.Controller) - https://host01slc.centershift.com/store31/x/Gate31.CAB
O16 - DPF: {A866B6B1-D925-4D7E-BDAD-B03EC0451464} (csYM4.csYield) - https://www.centershift.com/csweb/components/csYM4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v ... b56649.cab
O16 - DPF: {C0A63B86-4B21-11D3-BD95-D426EF2C7949} (ComponentOne FlexGrid 7.1 (Light)) - https://www.centershift.com/csweb/compo ... flex7L.ocx
O16 - DPF: {C932BA85-4374-101B-A56C-00AA003668DC} (Microsoft Masked Edit Control, version 6.0) - https://www.centershift.com/csweb/compo ... mask32.cab
O16 - DPF: {C9BADB23-839E-48C7-BA37-4E1433F15E1C} (STANChangeAddress.clsChangeAddress) - https://host01slc.centershift.com/store ... ddress.CAB
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/pacz/defaul ... online.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://aolsvc.aol.com/onlinegames/diner ... 0.0.72.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://centershift.webex.com/client/T2 ... eatgpc.cab
O16 - DPF: {E2DAB340-21E9-4795-8105-394CC6DF75BC} (csStoSA.csStoSAContainer) - https://www.centershift.com/csweb/compo ... sStoSA.CAB
O16 - DPF: {EF783396-97FB-400B-A6B0-2AC5A74D65DF} (CentershiftMap.csMap) - https://host01slc.centershift.com/store31/x/csMap30.CAB
O16 - DPF: {F7A34E78-9C47-4B32-A425-4FF7B0E5F77F} (STANsearchControl.STANuserControl) - https://www.centershift.com/csweb/compo ... Search.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{90BD2E5C-50D2-4796-90FB-B56DAB0F252F}: NameServer = 151.197.0.39,151.204.0.84
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe

PostPosted: Fri Jun 01, 2007 1:39 am
by D_N_M
Hello Gecko;

Was able to delete the spyspotter 3 thru HJT.
Here is the new log..Thank you again.


Logfile of HijackThis v1.99.1
Scan saved at 8:35:38 PM, on 05/31/07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PTI\Link.exe
C:\F2000\FServer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: UHaulMessenger.lnk = C:\Program Files\UHaul\UHaulMessenger\AppStart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Easy Link.lnk = C:\PTI\Link.exe
O4 - Global Startup: Falcon 2000 Server.lnk = C:\F2000\FServer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: www.centershift.com
O15 - Trusted Zone: *.centershift.com
O15 - Trusted Zone: http://*.centershift.com
O16 - DPF: {11004D63-D403-4128-BE38-BA8035F01AE4} (csCAM.csAccountManager) - https://host01slc.centershift.com/store ... anager.CAB
O16 - DPF: {1178E4A2-86B4-11D5-89FA-00C04F2FABD2} (STANPin.clsPins) - https://host01slc.centershift.com/store31/x/STANPin.CAB
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/defaul ... 0.0.67.cab
O16 - DPF: {306A3A9D-5711-468C-89E1-08B53607ADEC} (Centershift_ClientManager.CS_CCManager) - https://www.centershift.com/csweb/compo ... ager31.CAB
O16 - DPF: {35A07B73-808D-409F-B12E-8EAE82154C78} (MessagePolling.ctlMsgPolling) - https://www.centershift.com/csweb/compo ... olling.CAB
O16 - DPF: {41A7F6B3-95E6-4E01-B370-DED12CA827B7} (csPrint.Receipt) - https://host01slc.centershift.com/store ... rint31.CAB
O16 - DPF: {52EEED38-6E2F-4B1D-AE39-99FBB56CF8B1} (CSPayment.clsPayment) - https://host01slc.centershift.com/store ... ayment.CAB
O16 - DPF: {567ACF49-8D60-4348-B92D-60BF0C2FE5E0} (csDelProcAdmin01_Control.csDelProcAdmin) - https://host01slc.centershift.com/store ... dmin01.CAB
O16 - DPF: {6B42B55C-583F-480C-861D-CED3FCAD3512} (csAuctionAdmin.ctlAuctionAdmin) - https://www.centershift.com/csweb/compo ... nAdmin.CAB
O16 - DPF: {6F27485C-ACBA-420D-AD25-44DE8FABB1EB} (Project1.QuickFIx) - https://www.centershift.com/csweb/compo ... oject1.CAB
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://bellevueproperties.no-ip.com/Remote/msrdp.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/defaul ... uncher.cab
O16 - DPF: {846D1B10-EC6B-4334-9FFA-EABEC4E8F025} (csPopUpCalendar.csCal) - https://www.centershift.com/csweb/components/csCal.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://68.45.238.185/activex/AxisCamControl.cab
O16 - DPF: {98B2DBC7-131A-4F05-8500-AA6C457A6B58} (CheckPIN.clsCheckPIN) - https://www.centershift.com/csweb/compo ... eckPIN.CAB
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v ... b31267.cab
O16 - DPF: {9C2FC5A6-1D2B-434D-82D8-38652C74F43A} (CSFSO.FileSystemObject) - https://host01slc.centershift.com/store31/x/CSFSO.CAB
O16 - DPF: {9E84AFC0-6C29-43FE-8AB5-3A9701CBAB01} (Gate31.Controller) - https://host01slc.centershift.com/store31/x/Gate31.CAB
O16 - DPF: {A866B6B1-D925-4D7E-BDAD-B03EC0451464} (csYM4.csYield) - https://www.centershift.com/csweb/components/csYM4.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v ... b56649.cab
O16 - DPF: {C0A63B86-4B21-11D3-BD95-D426EF2C7949} (ComponentOne FlexGrid 7.1 (Light)) - https://www.centershift.com/csweb/compo ... flex7L.ocx
O16 - DPF: {C932BA85-4374-101B-A56C-00AA003668DC} (Microsoft Masked Edit Control, version 6.0) - https://www.centershift.com/csweb/compo ... mask32.cab
O16 - DPF: {C9BADB23-839E-48C7-BA37-4E1433F15E1C} (STANChangeAddress.clsChangeAddress) - https://host01slc.centershift.com/store ... ddress.CAB
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/pacz/defaul ... online.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://aolsvc.aol.com/onlinegames/diner ... 0.0.72.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://centershift.webex.com/client/T2 ... eatgpc.cab
O16 - DPF: {E2DAB340-21E9-4795-8105-394CC6DF75BC} (csStoSA.csStoSAContainer) - https://www.centershift.com/csweb/compo ... sStoSA.CAB
O16 - DPF: {EF783396-97FB-400B-A6B0-2AC5A74D65DF} (CentershiftMap.csMap) - https://host01slc.centershift.com/store31/x/csMap30.CAB
O16 - DPF: {F7A34E78-9C47-4B32-A425-4FF7B0E5F77F} (STANsearchControl.STANuserControl) - https://www.centershift.com/csweb/compo ... Search.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{90BD2E5C-50D2-4796-90FB-B56DAB0F252F}: NameServer = 151.197.0.39,151.204.0.84
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe

PostPosted: Fri Jun 01, 2007 11:32 am
by Gecko
D_N_M,

Your log is clean :)

How is it running now?

PostPosted: Sat Jun 02, 2007 12:35 am
by D_N_M
The wife says it's still running slow but the (New) company has her using a different software and I'm thinking that is why it is slow? it never was this slow with the other company. other than that things are normal she no longer has to reboot several times a day. once again Gecko the help as you know is always appreciated and I get to learn a lil more each time about reading and understanding these logs. Be well Gecko until the next time


D_N_M