Login

Z!re · 08-24-2005, 04:09 PM

It spawns a popup window, with random content (not anymore, content is blocked), it's damn annoying..

Logfiles from hijackthis:

Code:
Logfile of HijackThis v1.99.1

Scan saved at 12:48:33, on 2005-08-24

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

F:\WIN2K\System32\smss.exe

F:\WIN2K\system32\winlogon.exe

F:\WIN2K\system32\services.exe

F:\WIN2K\system32\lsass.exe

F:\WIN2K\system32\svchost.exe

F:\WIN2K\system32\spoolsv.exe

F:\WIN2K\System32\svchost.exe

F:\WIN2K\system32\nvsvc32.exe

F:\WIN2K\system32\regsvc.exe

F:\WIN2K\system32\MSTask.exe

F:\WIN2K\System32\WBEM\WinMgmt.exe

F:\WIN2K\system32\svchost.exe

F:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe

F:\WIN2K\Explorer.EXE

D:\Program\StatnPerf\StatnPerf.exe

D:\Program\D-ToolsNT\daemon.exe

F:\WIN2K\system32\internat.exe

C:\Program\MSN Messenger\msnmsgr.exe

F:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

F:\WIN2K\System32\svchost.exe

D:\Program\firefox.exe

F:\WIN2K\system32\NOTEPAD.EXE

F:\Documents and Settings\Administrator.DEVC01\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 82.112.196.50:8080

O1 - Hosts: 195.13.63.187 irc.westwood.com

O1 - Hosts: 195.13.63.187 servserv.westwood.com

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WIN2K\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Stat 'n' Perf] D:\Program\StatnPerf\StatnPerf.exe -auto

O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program\D-ToolsNT\daemon.exe"  -lang 1033

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WIN2K\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iamapp] d:\Program\Atguard\iamapp.exe

O4 - HKLM\..\Run: [checkrun] F:\win2k\system32\elitefyy32.exe

O4 - HKCU\..\Run: [internat.exe] internat.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: Service Manager.lnk = F:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &Google Search - res://F:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://F:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://F:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://F:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://F:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://F:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone

O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - F:\WIN2K\System32\dmadmin.exe

O23 - Service: WRQ IAM (iamServ) - WRQ, Inc. - d:\Program\Atguard\iamserv.exe

O23 - Service: iPod Service (iPodService) - Unknown owner - F:\Program Files\iPod\bin\iPodService.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WIN2K\system32\nvsvc32.exe

Code:
StartupList report, 2005-08-24, 12:53:04

StartupList version: 1.52.2

Started from : F:\Documents and Settings\Administrator.DEVC01\Desktop\HijackThis\HijackThis.EXE

Detected: Windows 2000 SP4 (WinNT 5.00.2195)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

* Including empty and uninteresting sections

* Showing rarely important sections

==================================================

Running processes:

F:\WIN2K\System32\smss.exe

F:\WIN2K\system32\winlogon.exe

F:\WIN2K\system32\services.exe

F:\WIN2K\system32\lsass.exe

F:\WIN2K\system32\svchost.exe

F:\WIN2K\system32\spoolsv.exe

F:\WIN2K\System32\svchost.exe

F:\WIN2K\system32\nvsvc32.exe

F:\WIN2K\system32\regsvc.exe

F:\WIN2K\system32\MSTask.exe

F:\WIN2K\System32\WBEM\WinMgmt.exe

F:\WIN2K\system32\svchost.exe

F:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe

F:\WIN2K\Explorer.EXE

D:\Program\StatnPerf\StatnPerf.exe

D:\Program\D-ToolsNT\daemon.exe

F:\WIN2K\system32\internat.exe

C:\Program\MSN Messenger\msnmsgr.exe

F:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

F:\WIN2K\System32\svchost.exe

F:\Documents and Settings\Administrator.DEVC01\Desktop\HijackThis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:

[F:\Documents and Settings\Administrator.DEVC01\Start Menu\Programs\Startup]

*No files*

Shell folders AltStartup:

*Folder not found*

User shell folders Startup:

*Folder not found*

User shell folders AltStartup:

*Folder not found*

Shell folders Common Startup:

[F:\Documents and Settings\All Users.WIN2K\Start Menu\Programs\Startup]

Service Manager.lnk = F:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

Shell folders Common AltStartup:

*Folder not found*

User shell folders Common Startup:

*Folder not found*

User shell folders Alternate Common Startup:

*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = F:\WIN2K\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Stat 'n' Perf = D:\Program\StatnPerf\StatnPerf.exe -auto

DAEMON Tools-1033 = "D:\Program\D-ToolsNT\daemon.exe"  -lang 1033

iamapp = d:\Program\Atguard\iamapp.exe

checkrun = F:\win2k\system32\elitefyy32.exe

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

internat.exe = internat.exe

msnmsgr = "C:\Program\MSN Messenger\msnmsgr.exe" /background

Steam = 

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

File association entry for .EXE:

HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:

HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:

HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:

HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:

HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = F:\WIN2K\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:

HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:

HKLM\Software\Microsoft\Active Setup\Installed Components

(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

StubPath = F:\WIN2K\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *

StubPath = "F:\WIN2K\System32\shmgrate.exe" OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *

StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *

StubPath = "F:\WIN2K\System32\shmgrate.exe" OCInstallUserConfigOE

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection F:\WIN2K\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{6A5110B5-E14B-4268-A065-EF89FF33C325}] *

StubPath = regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection F:\WIN2K\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *

StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *

StubPath = %SystemRoot%\system32\ie4uinit.exe

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *

StubPath = %SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:

HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from F:\WIN2K\WIN.INI:

load=*INI section not found*

run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\Windows: load=

HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from F:\WIN2K\SYSTEM.INI:

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

F:\WIN2K\Explorer.exe: PRESENT!

C:\Explorer.exe: not present

F:\WIN2K\Explorer\Explorer.exe: not present

F:\WIN2K\System\Explorer.exe: not present

F:\WIN2K\System32\Explorer.exe: not present

F:\WIN2K\Command\Explorer.exe: not present

F:\WIN2K\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)

.pif: HIDDEN! (arrow overlay: yes)

.exe: not hidden

.com: not hidden

.bat: not hidden

.hta: not hidden

.scr: not hidden

.shs: HIDDEN!

.shb: HIDDEN!

.vbs: not hidden

.vbe: not hidden

.wsh: not hidden

.scf: HIDDEN! (arrow overlay: NO!)

.url: HIDDEN! (arrow overlay: yes)

.js: not hidden

.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in F:\WIN2K

- .reg open command is normal (regedit.exe %1)

- Company name OK: 'Microsoft Corporation'

- Original filename OK: 'REGEDIT.EXE'

- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

*No BHO's found*

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Download Program Files:

[DirectAnimation Java Classes]

CODEBASE = file://F:\WIN2K\Java\classes\dajava.cab

OSD = F:\WIN2K\Downloaded Program Files\DirectAnimation Java Classes.osd

[Microsoft XML Parser for Java]

CODEBASE = file://F:\WIN2K\Java\classes\xmldso.cab

OSD = F:\WIN2K\Downloaded Program Files\Microsoft XML Parser for Java.osd

[{31564D57-0000-0010-8000-00AA00389B71}]

CODEBASE = http://codecs.microsoft.com/codecs/i386/wmvax.cab

[{32564D57-0000-0010-8000-00AA00389B71}]

CODEBASE = http://codecs.microsoft.com/codecs/i386/wmv8ax.cab

[{33564D57-0000-0010-8000-00AA00389B71}]

CODEBASE = http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

[Update Class]

InProcServer32 = F:\WIN2K\System32\iuctl.dll

CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38468.7804398148

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: F:\WIN2K\System32\rnr20.dll

NameSpace #2: F:\WIN2K\System32\winrnr.dll

NameSpace #3: F:\WIN2K\System32\nwprovau.dll

Protocol #1: F:\WIN2K\system32\msafd.dll

Protocol #2: F:\WIN2K\system32\msafd.dll

Protocol #3: F:\WIN2K\system32\msafd.dll

Protocol #4: F:\WIN2K\system32\rsvpsp.dll

Protocol #5: F:\WIN2K\system32\rsvpsp.dll

Protocol #6: F:\WIN2K\system32\msafd.dll

Protocol #7: F:\WIN2K\system32\msafd.dll

Protocol #8: F:\WIN2K\system32\msafd.dll

Protocol #9: F:\WIN2K\system32\msafd.dll

Protocol #10: F:\WIN2K\system32\msafd.dll

Protocol #11: F:\WIN2K\system32\msafd.dll

Protocol #12: F:\WIN2K\system32\msafd.dll

Protocol #13: F:\WIN2K\system32\msafd.dll

Protocol #14: F:\WIN2K\system32\msafd.dll

Protocol #15: F:\WIN2K\system32\msafd.dll

Protocol #16: F:\WIN2K\system32\msafd.dll

Protocol #17: F:\WIN2K\system32\msafd.dll

Protocol #18: F:\WIN2K\system32\msafd.dll

Protocol #19: F:\WIN2K\system32\msafd.dll

Protocol #20: F:\WIN2K\system32\msafd.dll

Protocol #21: F:\WIN2K\system32\msafd.dll

Protocol #22: F:\WIN2K\system32\msafd.dll

Protocol #23: F:\WIN2K\system32\msafd.dll

Protocol #24: F:\WIN2K\system32\msafd.dll

Protocol #25: F:\WIN2K\system32\msafd.dll

Protocol #26: F:\WIN2K\system32\msafd.dll

Protocol #27: F:\WIN2K\system32\msafd.dll

Protocol #28: F:\WIN2K\system32\msafd.dll

Protocol #29: F:\WIN2K\system32\msafd.dll

Protocol #30: F:\WIN2K\system32\msafd.dll

Protocol #31: F:\WIN2K\system32\msafd.dll

Protocol #32: F:\WIN2K\system32\msafd.dll

Protocol #33: F:\WIN2K\system32\msafd.dll

Protocol #34: F:\WIN2K\system32\msafd.dll

Protocol #35: F:\WIN2K\system32\msafd.dll

Protocol #36: F:\WIN2K\system32\msafd.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)

AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (autostart)

Alerter: %SystemRoot%\System32\services.exe (autostart)

Application Management: %SystemRoot%\system32\services.exe (manual start)

RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)

Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)

ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)

Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)

Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k BITSgroup (manual start)

Computer Browser: %SystemRoot%\System32\services.exe (autostart)

Closed Caption Decoder: System32\DRIVERS\CCDECODE.sys (manual start)

CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)

Indexing Service: F:\WIN2K\System32\cisvc.exe (manual start)

ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start)

d347bus: system32\DRIVERS\d347bus.sys (system)

d347prt: System32\Drivers\d347prt.sys (system)

DHCP Client: %SystemRoot%\System32\services.exe (autostart)

Disk Driver: System32\DRIVERS\disk.sys (system)

Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)

dmboot: System32\drivers\dmboot.sys (disabled)

Logical Disk Manager Driver: System32\drivers\dmio.sys (system)

dmload: System32\drivers\dmload.sys (system)

Logical Disk Manager: %SystemRoot%\System32\services.exe (autostart)

Microsoft DirectMusic SW Synth (WDM): system32\drivers\DMusic.sys (manual start)

DNS Client: %SystemRoot%\System32\services.exe (autostart)

DNSFILT: \??\d:\Program\Atguard\DNSFILT.SYS (manual start)

Event Log: %SystemRoot%\system32\services.exe (autostart)

COM+ Event System: F:\WIN2K\System32\svchost.exe -k netsvcs (manual start)

Fax Service: %systemroot%\system32\faxsvc.exe (manual start)

Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)

Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)

Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)

FWFILT: \??\d:\Program\Atguard\FWFILT.SYS (manual start)

Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)

GEAR CDRom Filter: SYSTEM32\DRIVERS\GEARAspiWDM.sys (manual start)

Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)

Hamachi Network Interface: system32\DRIVERS\hamachi.sys (manual start)

HTTPFILT: \??\d:\Program\Atguard\HTTPFILT.SYS (manual start)

i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)

Iamdrv: \??\d:\Program\Atguard\iamdrv.sys (system)

WRQ IAM: d:\Program\Atguard\iamserv.exe (autostart)

IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)

IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)

IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)

iPod Service: F:\Program Files\iPod\bin\iPodService.exe (manual start)

IPSEC driver: System32\DRIVERS\ipsec.sys (manual start)

IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)

PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)

Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)

Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)

Server: %SystemRoot%\System32\services.exe (autostart)

Workstation: %SystemRoot%\System32\services.exe (autostart)

TCP/IP NetBIOS Helper Service: %SystemRoot%\System32\services.exe (autostart)

Messenger: %SystemRoot%\System32\services.exe (autostart)

NetMeeting Remote Desktop Sharing: F:\WIN2K\System32\mnmsrvc.exe (manual start)

Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)

BDA MPE Filter: System32\DRIVERS\MPE.sys (manual start)

MRXSMB: System32\DRIVERS\mrxsmb.sys (system)

Distributed Transaction Coordinator: F:\WIN2K\System32\msdtc.exe (manual start)

Windows Installer: F:\WIN2K\System32\MsiExec.exe /V (manual start)

Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)

Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)

Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)

Microsoft Search: "F:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe" (autostart)

MSSQLSERVER: d:\Program\MICROS~1\MSSQL\binn\sqlservr.exe (manual start)

MSSQLServerADHelper: F:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (manual start)

Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)

NABTS/FEC VBI Codec: System32\DRIVERS\NABTSFEC.sys (manual start)

NetBEUI Protocol: System32\DRIVERS\nbf.sys (autostart)

NDISFILT: \??\d:\Program\Atguard\NDISFILT.SYS (manual start)

Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)

NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)

Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)

NetBIOS Interface: System32\DRIVERS\netbios.sys (system)

NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)

Network DDE: %SystemRoot%\system32\netdde.exe (manual start)

Network DDE DSDM: %SystemRoot%\system32\netdde.exe (manual start)

NetDetect: \SystemRoot\system32\drivers\netdtect.sys (manual start)

Net Logon: %SystemRoot%\System32\lsass.exe (manual start)

Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

NPPTNT2: \??\F:\WIN2K\System32\npptNT2.sys (system)

NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)

Removable Storage: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

nv: System32\DRIVERS\nv4_mini.sys (manual start)

NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)

IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)

IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)

NWLink IPX/SPX/NetBIOS Compatible Transport Protocol: System32\DRIVERS\nwlnkipx.sys (autostart)

NWLink NetBIOS: System32\DRIVERS\nwlnknb.sys (autostart)

NWLink SPX/SPXII Protocol: System32\DRIVERS\nwlnkspx.sys (autostart)

Parallel class driver: System32\DRIVERS\parallel.sys (manual start)

Parallel port driver: System32\DRIVERS\parport.sys (system)

PCI Bus Driver: System32\DRIVERS\pci.sys (system)

PCIIde: System32\DRIVERS\pciide.sys (system)

Plug and Play: %SystemRoot%\system32\services.exe (autostart)

IPSEC Policy Agent: %SystemRoot%\System32\lsass.exe (autostart)

WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)

Protected Storage: %SystemRoot%\system32\services.exe (autostart)

Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)

Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)

Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)

Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Direct Parallel: System32\DRIVERS\raspti.sys (manual start)

Microsoft Streaming Network Raw Channel Access: system32\drivers\RCA.sys (manual start)

Rdbss: System32\DRIVERS\rdbss.sys (system)

Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)

Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)

Remote Registry Service: %SystemRoot%\system32\regsvc.exe (autostart)

Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)

Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)

QoS RSVP: %SystemRoot%\System32\rsvp.exe -s (manual start)

Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver: System32\DRIVERS\RTL8139.SYS (manual start)

Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)

Smart Card Helper: %SystemRoot%\System32\SCardSvr.exe (manual start)

Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)

Task Scheduler: %SystemRoot%\system32\MSTask.exe (autostart)

Secdrv: \??\F:\WIN2K\system32\drivers\SECDRV.SYS (autostart)

RunAs Service: %SystemRoot%\system32\services.exe (autostart)

System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)

Serial port driver: System32\DRIVERS\serial.sys (system)

Internet Connection Sharing: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

BDA Slip De-Framer: System32\DRIVERS\SLIP.sys (manual start)

Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)

SQLSERVERAGENT: d:\Program\MICROS~1\MSSQL\binn\sqlagent.exe (manual start)

Srv: System32\DRIVERS\srv.sys (manual start)

BDA IPSink: System32\DRIVERS\StreamIP.sys (manual start)

Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)

Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)

Microsoft System Audio Device: system32\drivers\sysaudio.sys (manual start)

Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)

Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)

Telnet: %SystemRoot%\system32\tlntsvr.exe (manual start)

Distributed Link Tracking Client: %SystemRoot%\system32\services.exe (autostart)

Microsoft USB Universal Host Controller Driver: System32\DRIVERS\uhcd.sys (manual start)

Microcode Update Driver: System32\DRIVERS\update.sys (manual start)

Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)

Microsoft USB Standard Hub Driver: System32\DRIVERS\usbhub.sys (manual start)

User Privilege Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Utility Manager: %SystemRoot%\System32\UtilMan.exe (manual start)

VgaSave: \SystemRoot\System32\drivers\vga.sys (system)

VIA AC'97 Audio Controller (WDM): system32\drivers\viaudio.sys (manual start)

Virtual Serial Bus Enumerator: system32\DRIVERS\vsb.sys (manual start)

ELTIMA Virtual Serial Ports Driver: System32\DRIVERS\vserial.sys (manual start)

Windows Time: %SystemRoot%\System32\services.exe (manual start)

Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)

Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)

Windows Management Instrumentation: %SystemRoot%\System32\WBEM\WinMgmt.exe (autostart)

Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Windows Management Instrumentation Driver Extensions: %SystemRoot%\system32\Services.exe (manual start)

World Standard Teletext Codec: System32\DRIVERS\WSTCODEC.SYS (manual start)

Automatic Updates: %systemroot%\system32\svchost.exe -k wugroup (autostart)

Wireless Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:

*No scripts set to run*

Windows NT checkdisk command:

BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':

PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: F:\WIN2K\system32\NETSHELL.dll

WebCheck: F:\WIN2K\system32\webcheck.dll

SysTray: stobject.dll

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 28 713 bytes

Report generated in 0.170 seconds

Command line options:

   /verbose  - to add additional info on each section

   /complete - to include empty sections and unsuspicious data

   /full     - to include several rarely-important sections

   /force9x  - to include Win9x-only startups even if running on WinNT

   /forcent  - to include WinNT-only startups even if running on Win9x

   /forceall - to include all Win9x and WinNT startups, regardless of platform

   /history  - to list version history only

Z!re · 08-24-2005, 05:52 PM

Quick and dirty solution found:
Revert to previous IE install
Make IE only ever use connections to localhost, nothing else (they will fail)
Add rule to FireWall to block all communication done by IE

Problem solved, ofcourse, the stupid adware program still remain on the disk, but atleast i dont get the popups..

I really dont like IE, at all..

barok · 08-24-2005, 06:51 PM

why don't you try firefox then? Mucho superior...

::EDIT:: I just looked through your log. I see you do have firefox. :oops:

There was nothing I could find. mind telling us what kind of ad it was? I've had this problem where this ad would come up and I couldn't find any way to get rid of it for quite a while...

::EDIT2:: try installing this. It's a free version of counterspy: It'll scan and fix any spyware it finds. No realtime protection or immunization though. Maybe it can find something...

http://www.download.com/Spyware-Doctor/3...77263.html

btw,does it have anything to do with "winfixer?"

dumbledore · 08-25-2005, 12:59 AM

ad-aware, spybot s&d, you tried these?

Mr Match · 08-25-2005, 01:23 AM

well, i downloaded the spydoctor, ran it, and found 1431 infections of spyware! :o :o

no wonder my computer was acting funny....

Z!re · 08-25-2005, 01:49 AM

@dumbledore, yup.. no luck..

However, spydoctor seems to have cured it

Sterling Christensen · 08-25-2005, 06:50 AM

Quote:well, i downloaded the spydoctor, ran it, and found 1431 infections of spyware! :o :o

Mostly harmless cookies, probably.

Login
Username:
Password:	Lost Password?
	Remember me